Virtualization · Topic 2 of 4
VRF Virtual Routing and Forwarding
Configure and verify VRF on Cisco IOS XE: separate routing tables on one router, interface assignment, per VRF routing and the key show commands.
- 5 min
- Includes a diagram
- A VRF is a separate routing table, with its own interfaces and routes, on one router.
vrf definition NAMEcreates a multiprotocol VRF.ip vrf NAMEis the older IPv4 form.vrf forwarding NAMEputs an interface in the VRF, and clears its IP address.
What it is
A VRF (Virtual Routing and Forwarding instance) is a separate routing table on one physical router.
Each VRF has its own routes, its own interfaces and its own forwarding table. Two VRFs on one router can even use the same IP addresses, and they will not conflict. This is data path virtualization, and it keeps traffic from different groups apart without separate hardware.
How it works
A VRF is defined once, then interfaces and routing are tied to it.
Defining a VRF
On IOS XE the modern command is vrf definition. It creates a VRF that can hold IPv4 and IPv6 address families.
R1(config)# vrf definition RED
R1(config-vrf)# rd 100:1
R1(config-vrf)# address-family ipv4
R1(config-vrf-af)# exit-address-familyThe rd is a route distinguisher. It makes routes unique when VRFs are carried through an MPLS network. In a simple local VRF setup it is not essential, but it is good practice to set it.
An older syntax, ip vrf NAME, is also seen. It supports IPv4 only. Support for it depends on the software release, so you may still meet it in an exam.
Placing an interface in a VRF
An interface belongs to the global routing table until you assign it.
R1(config)# interface GigabitEthernet0/1
R1(config-if)# vrf forwarding RED
R1(config-if)# ip address 10.1.1.1 255.255.255.0The older form for the ip vrf syntax is ip vrf forwarding RED. Applying the command to an interface removes any IP address already on it, so enter the address afterwards.
Routing inside a VRF
Routes for a VRF are kept in that VRF. You add static routes and routing protocol processes with the VRF named.
R1(config)# ip route vrf RED 0.0.0.0 0.0.0.0 10.1.1.2
R1(config)# router ospf 10 vrf RED
R1(config-router)# network 10.1.1.0 0.0.0.255 area 0An OSPF process is tied to one VRF in this way. BGP uses an address family per VRF. EIGRP also supports VRFs through address families.
Verifying
Ordinary commands show only the global table, so you must name the VRF.
R1# show vrf
R1# show ip route vrf RED
R1# show ip interface brief vrf RED
R1# ping vrf RED 10.1.1.2
R1# traceroute vrf RED 10.1.1.2show vrf lists each VRF and the interfaces assigned to it. If a ping fails in the global table but works with the vrf keyword, the destination is in the VRF.
VRF Lite and MPLS VPN
VRF Lite means using VRFs without MPLS. Each VRF is carried across the network using separate links or subinterfaces, with a routing protocol per VRF at each hop. It suits small designs, since every hop needs configuration.
A full MPLS VPN uses route distinguishers and route targets so that a provider can carry many customers over one core. Route targets control which VRFs import and export routes.
Route leaking
VRFs are isolated by default. To allow limited sharing, you can leak routes between them, for example to give every VRF access to a shared services network. On IOS XE one way is to use route targets, with route-target import and route-target export under the address family.
Leaking needs care, because it opens the isolation you built.
Typical uses
- Separate guest, corporate and building management traffic on shared equipment.
- Give each tenant in a shared building or data centre its own routing table.
- Keep a management network off the production routing table.
- Support overlapping addresses between customers.
What to remember for the exam
Eight facts cover most questions on this topic.
- A VRF is a separate routing table, with its own interfaces and routes, on one router.
vrf definition NAMEcreates a multiprotocol VRF.ip vrf NAMEis the older IPv4 form.vrf forwarding NAMEputs an interface in the VRF, and clears its IP address.- Add the address after the VRF assignment.
- Static routes use
ip route vrf NAME. OSPF usesrouter ospf ID vrf NAME. show ip route vrf NAMEandping vrf NAMElook inside a VRF.- VRF Lite uses VRFs without MPLS.
- Route targets control import and export between VRFs.
If an interface lost its address after you added it to a VRF, that is normal. Re-enter the IP address.
Common mistakes
These four mistakes appear often.
Checking the wrong table. Plain show ip route shows the global table, so use the vrf keyword.
Setting the address before the VRF. The address is removed when the VRF is assigned.
Forgetting the address family. In a vrf definition, the IPv4 address family must be enabled for IPv4 to work.
Expecting VRFs to share routes. They are isolated until you leak routes on purpose.
Two VRFs can use the same subnet, but a ping from one VRF does not reach a host in the other unless routes are leaked or a path exists outside the router.
Check yourself
Work through these three questions.
What does an interface lose when you apply
vrf forwardingto it?Its IP address is removed, so you enter the address again after the VRF assignment.
Which command shows the routing table of a VRF called RED?
show ip route vrf REDshows the routes in that VRF.Can two VRFs on one router use the same subnet?
Yes, each VRF has its own routing table, so overlapping addresses do not conflict.
Topic 2 of 4 in Virtualization
Test yourself on Virtualization
The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.