mail

VRF (Virtual Routing and Forwarding) lets one router keep several separate routing tables, so traffic is logically isolated on the same physical device.

Facts

VRF: multiple routing tables in one router

Why does it exist?

Without VRF: only one global routing table – overlapping IP addresses impossible, no logical separation, hard to design multi-tenant, no isolation between customers/departments.

How it solves it

VRF creates a separate routing table, a separate CEF table, a separate forwarding instance and separate routing processes (OSPF/EIGRP/BGP). The router behaves like multiple virtual routers in one chassis – distributed logic, each VRF with its own control-plane instance.

Step by step

  1. Create the VRF – the router builds a new routing context
  2. Bind interfaces – they move from the global table to the VRF table
  3. Configure routing inside the VRF
  4. Forwarding – lookups only happen in the VRF’s table
  5. Failure – only the affected VRF is impacted, not global routing

Key terms

Term Explanation
VRF Virtual routing table
VRF-Lite VRF without MPLS
RD Route Distinguisher (makes prefixes unique in MPLS)
RT Route Target (MPLS import/export)
Route leaking Sharing routes between VRFs
VRF-aware routing A routing process bound to a VRF
vpnv4 BGP address-family for MPLS VPN

Elements

Element Description CCNA CCNP
VRF Isolates routing ✔ ✔
VRF-Lite Without MPLS ✖ ✔
MPLS L3VPN Provider VPN ✖ ✔
Route leaking Sharing between VRFs ✖ ✔

Routing protocols in VRF

Each VRF has its own RIB, CEF table and routing process. OSPF, EIGRP and BGP all run per VRF:

Protocol VRF support Notes
OSPF ✔ Separate process per VRF
EIGRP ✔ Named mode recommended
BGP ✔ Address-family vrf
RIP ✔ Rarely used

MPLS case: the PE router runs MP-BGP, routes are exported with RD/RT, label stack does the forwarding: Customer → CE → PE → MP-BGP → core → PE → CE.

Dependencies

Configuration

VRF definition:

vrf definition VRF_A
 rd 100:1
 address-family ipv4
 exit-address-family
!
vrf definition VRF_B
 rd 100:2
 address-family ipv4
 exit-address-family

Interfaces in VRF – subinterface (802.1Q):

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 vrf forwarding VRF_A
 ip address 10.10.10.1 255.255.255.0

Physical interface, loopback or SVI work the same way. Note: vrf forwarding <VRF> removes the IP address – set the IP after the VRF binding.

Routing per VRF:

! Static
ip route vrf VRF_A 0.0.0.0 0.0.0.0 10.10.10.254

! OSPF
router ospf 1 vrf VRF_A
 network 10.10.10.0 0.0.0.255 area 0

! EIGRP named mode
router eigrp CUSTOMER_A
 address-family ipv4 vrf VRF_A autonomous-system 10
  network 10.10.10.0 0.0.0.255

! BGP
router bgp 65000
 address-family ipv4 vrf VRF_A
  neighbor 10.1.1.2 remote-as 65010
  network 10.1.1.0 mask 255.255.255.0

Route leaking (only if VRFs must reach each other):

! Simple static
ip route vrf VRF_A 10.20.20.0 255.255.255.0 GigabitEthernet0/0.20
! Nicer static via next-hop
ip route vrf VRF_A 10.20.20.0 255.255.255.0 10.20.20.254
! (BGP-based and MP-BGP RT import/export also exist)

Verification / troubleshooting

show vrf
show vrf detail
show ip interface brief vrf VRF_A
show ip route vrf VRF_A
show ip protocols vrf VRF_A
show ip cef vrf VRF_A
show bgp vpnv4 unicast all
ping vrf VRF_A 10.10.10.100
traceroute vrf VRF_A 8.8.8.8

Typical faults

Design & best practices

Exam tips ⚠️

30-second summary

Tagged , ,