Skip to content
Log in Sign up My account

1.7 VRF-Lite

Blueprint 1.7: Configure and verify VRF-Lite

  • VRF definitions (multiprotocol vrf definition and the legacy ip vrf syntax)
  • Assigning interfaces and subinterfaces to a VRF
  • Running routing protocols per VRF: static, OSPF, EIGRP, BGP
  • Route leaking basics between a VRF and the global table
  • Verifying and troubleshooting with VRF-aware show, ping and traceroute

What VRF-Lite is

A Virtual Routing and Forwarding instance (VRF) is a separate routing table and forwarding table (FIB) inside one router. Each interface belongs to exactly one table: either the global table or one VRF. Packets arriving on an interface are looked up only in that interface's table, so traffic in one VRF cannot reach another VRF unless you deliberately leak routes between them.

VRF-Lite is VRFs without MPLS. Separation across the network is achieved hop by hop: every router in the path has the VRFs configured, and each VRF gets its own link or, more commonly, its own 802.1Q subinterface on a shared physical link. Compare it with MPLS L3VPN (ENARSI 2.2), where only the provider edge routers know the VRFs and MP-BGP plus labels carry them across a shared core.

VRF-Lite MPLS L3VPN
Who knows the VRF Every router in the path Only PE routers
How VRFs are kept apart between routers A separate interface or subinterface per VRF on each link VPN label inside an MPLS LSP
Route distinguisher Optional (needed only if you use BGP VRF address families) Required
Route targets Not used (except for local leaking through BGP) Required, control import and export
Scale Small: config grows with VRFs x links Large
Typical use Campus segmentation, guest isolation, multi-tenant branch, SD-Access border handoff Service provider and large enterprise WAN

Uses you will meet in exam scenarios: guest Wi-Fi isolated from corporate traffic, overlapping customer address space on a shared router, a management VRF (on Catalyst 8000v the dedicated management port lives in VRF Mgmt-intf), and the per-VN handoff from an SD-Access border to a fusion router.

graph LR
  subgraph R1 ["R1"]
    A1["VRF CUST-A<br/>Lo1 192.168.1.1/24"]
    B1["VRF CUST-B<br/>Lo2 192.168.1.1/24"]
  end
  subgraph R2 ["R2"]
    A2["VRF CUST-A<br/>Lo1 192.168.2.1/24"]
    B2["VRF CUST-B<br/>Lo2 192.168.2.1/24"]
    G2["Global<br/>Gi0/2"]
  end
  A1 -- "Gi0/1.10 dot1q 10<br/>10.1.2.0/30 OSPF 10" --- A2
  B1 -- "Gi0/1.20 dot1q 20<br/>10.1.2.4/30 EIGRP AS 200" --- B2
  G2 -- "10.2.3.0/30" --- R3["R3 shared server<br/>Lo99 10.99.99.1/24"]

The two customers use identical LAN prefixes. That is fine, because the prefixes live in different tables.

Defining a VRF

vrf definition CUST-A
 description Customer A
 address-family ipv4
 exit-address-family
 address-family ipv6
 exit-address-family

ip vrf CUST-A
 description Customer A

! Converts every ip vrf to vrf definition with an ipv4 address family
vrf upgrade-cli multi-af-mode common-policies
Item vrf definition ip vrf
Interface command vrf forwarding NAME ip vrf forwarding NAME
Address families IPv4 and IPv6, each enabled with address-family IPv4 only
RD rd under the VRF, optional for VRF-Lite Same
Show command show vrf show ip vrf (also works for vrf definition VRFs with IPv4)

With the multiprotocol form, an address family must be enabled in the VRF for that protocol to work on its interfaces. A VRF with only address-family ipv4 will not carry IPv6. The show vrf output lists the enabled families in its Protocols column.

Exam trap

Do not mix the two syntaxes on one VRF. A VRF created with vrf definition is bound with vrf forwarding; a VRF created with ip vrf is bound with ip vrf forwarding. If a question shows ip vrf forwarding X failing on an interface while show vrf lists X, the VRF was created with vrf definition.

Assigning interfaces

interface GigabitEthernet0/1.10
 encapsulation dot1Q 10
 vrf forwarding CUST-A
 ip address 10.1.2.1 255.255.255.252

Binding an interface to a VRF removes its IPv4 and IPv6 addresses, because those addresses belonged to the previous table. IOS warns you:

R1(config-subif)# vrf forwarding CUST-A
% Interface GigabitEthernet0/1.10 IPv4 disabled and address(es) removed due to enabling VRF CUST-A

Always configure vrf forwarding first and the IP address second. Removing the VRF from an interface (no vrf forwarding) also removes the address.

On a shared link, both routers must use the same 802.1Q tag for the same VRF. The tag is what keeps the VRFs apart on the wire. If R1 puts CUST-A on VLAN 10 and R2 puts CUST-B on VLAN 10, the two customers are joined on one segment and routes leak between them as soon as compatible routing processes see each other.

Routing per VRF

Every routing protocol is made VRF-aware either with a separate process per VRF (OSPF) or a VRF address family inside one process (EIGRP, BGP). A process or address family only uses interfaces in its own VRF. A network statement in the global process does not match an interface in a VRF, even if the address fits.

ip route vrf CUST-A 0.0.0.0 0.0.0.0 10.1.2.2
ip route vrf CUST-A 192.168.2.0 255.255.255.0 GigabitEthernet0/1.10 10.1.2.2

router ospf 10 vrf CUST-A
 router-id 10.255.10.1
 network 10.1.2.0 0.0.0.3 area 0
 network 192.168.1.0 0.0.0.255 area 0

router eigrp 1
 address-family ipv4 vrf CUST-B autonomous-system 200
  network 10.1.2.4 0.0.0.3
  network 192.168.1.0
 exit-address-family

router eigrp CUSTOMERS
 address-family ipv4 unicast vrf CUST-B autonomous-system 200
  network 10.1.2.4 0.0.0.3
  network 192.168.1.0
 exit-address-family

vrf definition CUST-A
 rd 65001:10
 address-family ipv4
 exit-address-family
!
router bgp 65001
 address-family ipv4 vrf CUST-A
  neighbor 10.1.2.2 remote-as 65002
  neighbor 10.1.2.2 activate
  network 192.168.1.0 mask 255.255.255.0
 exit-address-family

Points to remember for each protocol:

  • OSPF: one process per VRF, and a process number cannot be shared between VRFs. The process picks its router ID from interfaces in its own VRF; if the VRF has no up interface with an IP address, the process cannot choose a router ID and does not start. Set router-id explicitly. You cannot move an existing global process into a VRF; remove it and recreate it with the vrf keyword.
  • OSPF and the down bit: an OSPF process in a VRF assumes it may be on an MPLS PE and applies the down-bit (DN) loop check to Type 3, 5 and 7 LSAs. In a pure VRF-Lite design that receives LSAs from a real PE (multi-VRF CE), use capability vrf-lite under the VRF process so those routes are not ignored.
  • EIGRP: one global process can hold many VRF address families. Each VRF address family needs its own autonomous-system number, either on the address-family line or with autonomous-system inside it. Without it the address family never sends hellos.
  • BGP: one BGP process per router. Each VRF is an address-family ipv4 vrf NAME. IOS requires an RD on the VRF before it accepts a BGP VRF address family, even when there is no MPLS.

Exam trap

show ip ospf neighbor lists neighbors for all OSPF processes, including VRF processes, but show ip route and ping only use the global table. A candidate who sees FULL adjacencies and then gets "% Network not in table" has forgotten the vrf keyword, not found a fault.

Verification commands

Task Command
VRFs, RDs, protocols and interfaces show vrf, show vrf brief, show vrf detail CUST-A
Interfaces per VRF with addresses show ip vrf interfaces
Routing table show ip route vrf CUST-A
Forwarding table show ip cef vrf CUST-A 192.168.2.0
ARP show ip arp vrf CUST-A
Protocol settings show ip protocols vrf CUST-A
EIGRP neighbors show ip eigrp vrf CUST-B neighbors
BGP show ip bgp vpnv4 vrf CUST-A summary
Reachability ping vrf CUST-A 192.168.2.1 source Loopback1, traceroute vrf CUST-A 192.168.2.1
Remote access in a VRF ssh -l admin -vrf CUST-A 10.1.2.2 or telnet 10.1.2.2 /vrf CUST-A 
R1# show vrf
  Name                             Default RD            Protocols   Interfaces
  CUST-A                           <not set>             ipv4        Lo1
                                                                     Gi0/1.10
  CUST-B                           <not set>             ipv4        Lo2
                                                                     Gi0/1.20

R1# show ip vrf interfaces
Interface              IP-Address      VRF                              Protocol
Lo1                    192.168.1.1     CUST-A                           up
Gi0/1.10               10.1.2.1        CUST-A                           up
Lo2                    192.168.1.1     CUST-B                           up
Gi0/1.20               10.1.2.5        CUST-B                           up

R1# show ip route vrf CUST-A ospf
Routing Table: CUST-A
...
      192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks
O        192.168.2.1/32 [110/2] via 10.1.2.2, 00:04:10, GigabitEthernet0/1.10

R1# show ip eigrp vrf CUST-B neighbors
EIGRP-IPv4 Neighbors for AS(200) VRF(CUST-B)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   10.1.2.6                Gi0/1.20                 12 00:03:58    3   100  0  4

The OSPF route appears as a /32 because OSPF advertises a loopback as a host route unless the loopback uses ip ospf network point-to-point. That is normal, not a fault.

Route leaking basics

Isolation is the point of a VRF, but most designs need some shared service: DNS, DHCP, an Internet edge or a management server in the global table. Moving routes between tables is called route leaking.

Method How When to use
Static, VRF to global ip route vrf CUST-A 10.99.99.0 255.255.255.0 10.2.3.2 global A VRF needs to reach a few global prefixes
Static, global to VRF ip route 192.168.1.0 255.255.255.0 GigabitEthernet0/1.10 10.1.2.1 (exit interface is in the VRF) The return path for the above
Static, VRF to VRF ip route vrf CUST-A 172.16.5.0 255.255.255.0 GigabitEthernet0/3 172.16.9.1 where Gi0/3 is in another VRF Small, specific leaks
BGP route targets VRFs export and import RTs under vrf definition; BGP must run with the VRF address families, and the routes must be in BGP Many prefixes, or ongoing leaking between VRFs on one router
Fusion router or firewall An external device peers with each VRF and routes between them SD-Access and campus designs where policy must be enforced between VRFs

The global keyword tells IOS to resolve the next hop in the global table. Without it, IOS looks for the next hop in the VRF, does not find it, and the static route never enters the routing table.

graph LR
  subgraph R2 ["R2"]
    VA["VRF CUST-A table<br/>S 10.99.99.0/24 via 10.2.3.2 global"]
    GT["Global table<br/>S 192.168.1.0/24 via 10.1.2.1 Gi0/1.10"]
  end
  R1A["R1 CUST-A<br/>192.168.1.0/24"] -- "Gi0/1.10" --- VA
  GT -- "Gi0/2 10.2.3.0/30" --- R3["R3 server<br/>10.99.99.1"]

Exam trap

Leaking only works in both directions or not at all. A VRF static route toward the shared server with no return route in the global table gives you a ping that fails with every reply lost, not with "unreachable". And if two VRFs use the same prefix, only one of them can be leaked into the global table. Overlapping customers need NAT (for example ip nat inside source ... vrf NAME) or a fusion firewall instead.

Troubleshooting VRF-Lite

Work through the table one layer at a time, always with the vrf keyword.

Symptom Likely cause Check
Interface shows unassigned Address removed when vrf forwarding was added show ip vrf interfaces, re-enter the address
Ping fails, "% Network not in table" Command run in the global table Use ping vrf, show ip route vrf
No neighbor in one VRF, link up Routing process not in that VRF, or network statement in the wrong process show ip protocols vrf NAME, show running-config | section router
No EIGRP hellos in a VRF Missing autonomous-system in the VRF address family show ip eigrp vrf NAME interfaces is empty
OSPF process in a VRF does not start No router ID available in that VRF Log message about failing to allocate a router ID; set router-id
Routes from VRF A appear in VRF B Subinterface tags swapped or an interface in the wrong VRF on one router show vrf on both ends, show interfaces GiX.Y | include Encapsulation
Neighbor up and routes present, but ping fails Ping sourced from an address the far side has no route back to, or an ACL on a subinterface ping vrf NAME ... source, traceroute vrf NAME, show ip cef vrf NAME
Leaked static route missing from the VRF table Missing global keyword, or next hop not resolvable show ip route vrf NAME static, show running-config | include ip route vrf
Leak works one way only No return route in the other table Traceroute from both ends

Exam trap

A guest-to-corporate "isolation breach" in a VRF-Lite network is almost always one interface in the wrong VRF or a VLAN tag mismatch on a shared trunk. Routing protocols happily form a neighbor relationship between a CORP process on one router and a GUEST process on the other if the segment joins them. Compare the neighbor's router ID with what you expect for that VRF.

Topology: three IOSv routers, as in the first diagram on this page. R1 and R2 share one physical link (Gi0/1 on both) with subinterfaces per customer. R3 is a shared server in R2's global table.

Device Interface VRF Address
R1 Gi0/1.10 (dot1q 10) CUST-A 10.1.2.1/30
R1 Gi0/1.20 (dot1q 20) CUST-B 10.1.2.5/30
R1 Lo1 / Lo2 CUST-A / CUST-B 192.168.1.1/24 / 192.168.1.1/24
R2 Gi0/1.10 / Gi0/1.20 CUST-A / CUST-B 10.1.2.2/30 / 10.1.2.6/30
R2 Lo1 / Lo2 CUST-A / CUST-B 192.168.2.1/24 / 192.168.2.1/24
R2 Gi0/2 global 10.2.3.1/30
R3 Gi0/1, Lo99 global 10.2.3.2/30, 10.99.99.1/24

The second customer subnet on the shared link uses 10.1.2.4/30 rather than the course convention, because both VRFs share the R1 to R2 cable.

Build

  1. On R1 and R2, create vrf definition CUST-A and vrf definition CUST-B, each with address-family ipv4.
  2. Create the subinterfaces and loopbacks. Enter vrf forwarding before each IP address.
  3. CUST-A: router ospf 10 vrf CUST-A on both routers with router IDs 10.255.10.1 and 10.255.10.2. Add ip ospf network point-to-point on Lo1 so the /24 is advertised.
  4. CUST-B: router eigrp 1, address-family ipv4 vrf CUST-B autonomous-system 200 on both routers, networks 10.1.2.4/30 and 192.168.1.0 (R1) or 192.168.2.0 (R2).

  5. Shared server for CUST-A only. On R2:

    ip route vrf CUST-A 10.99.99.0 255.255.255.0 10.2.3.2 global
ip route 192.168.1.0 255.255.255.0 GigabitEthernet0/1.10 10.1.2.1
router ospf 10 vrf CUST-A
 redistribute static subnets

    On R3: ip route 0.0.0.0 0.0.0.0 10.2.3.1. 6. Save: copy running-config flash:vrf-good.cfg on R1 and R2.

Verify the baseline

R1# ping vrf CUST-A 192.168.2.1 source Loopback1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
R1# ping vrf CUST-B 192.168.2.1 source Loopback2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/3 ms
R1# ping vrf CUST-A 10.99.99.1 source Loopback1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/3 ms
R1# ping vrf CUST-B 10.99.99.1 source Loopback2
.....
Success rate is 0 percent (0/5)
R1# show ip route vrf CUST-A | include 10.99
O E2     10.99.99.0/24 [110/20] via 10.1.2.2, 00:02:31, GigabitEthernet0/1.10

Both customers reach their own remote LAN with the same addresses. Only CUST-A reaches the shared server, which is the design.

Break and fix

Restore the baseline between faults with configure replace flash:vrf-good.cfg force.

  1. Fault: on R2, remove router ospf 10 vrf CUST-A and configure router ospf 10 (no vrf keyword) with the same router ID, network statements and redistribution.
    • Symptom: R1 has no OSPF neighbor for CUST-A. CUST-B is unaffected.
    • Diagnosis: show ip ospf interface brief on R2 lists no interfaces for process 10. show ip protocols vrf CUST-A on R2 shows no OSPF process. The global process's network statements cannot match subinterface Gi0/1.10, because that interface is in CUST-A.
    • Fix: no router ospf 10, then recreate it as router ospf 10 vrf CUST-A.
  2. Fault: on R1, recreate the EIGRP VRF address family without the autonomous system: address-family ipv4 vrf CUST-B followed only by the network statements.
    • Symptom: no CUST-B neighbor and no CUST-B routes. ping vrf CUST-B 192.168.2.1 fails.
    • Diagnosis: show ip eigrp vrf CUST-B interfaces on R1 returns nothing, while R2 shows the interface with zero peers.
    • Fix: add autonomous-system 200 inside the address family.
  3. Fault: on R2, replace the leak with ip route vrf CUST-A 10.99.99.0 255.255.255.0 10.2.3.2 (no global).
    • Symptom: CUST-A loses the shared server. R1 no longer has the O E2 route.
    • Diagnosis: show ip route vrf CUST-A static on R2 is empty. The next hop 10.2.3.2 is looked up in CUST-A, where it does not exist, so the static route is not installed and nothing is redistributed.
    • Fix: add the global keyword back.
  4. Fault (isolation breach): on R2, swap the tags: encapsulation dot1Q 20 on Gi0/1.10 and encapsulation dot1Q 10 on Gi0/1.20.
    • Symptom: both customers lose their adjacencies. If you had used the same protocol for both VRFs, the processes would form cross-VRF adjacencies instead and leak routes, which is worse.
    • Diagnosis: show interfaces GigabitEthernet0/1.10 | include Encapsulation on both routers shows different VLAN IDs for the same VRF.
    • Fix: restore the tags.

Quick check

R1 has interface Gi0/2, ip address 10.5.5.1 255.255.255.0, vrf forwarding RED. Why does show ip interface brief show Gi0/2 as unassigned?

The vrf forwarding command removed the address because it belonged to the global table. The address has to be configured again after the VRF assignment.

Does VRF-Lite need a route distinguisher?

No. VRF-Lite works without an RD. You need one only when the VRF is used in a BGP VRF address family (including BGP route-target leaking between local VRFs) or in MPLS L3VPN.

A static route ip route vrf BLUE 0.0.0.0 0.0.0.0 203.0.113.1 never appears in the BLUE table. The next hop is on Gi0/0, which is in the global table. What is missing?

The global keyword. Without it, IOS tries to resolve 203.0.113.1 in VRF BLUE.

References

  • Cisco IOS XE IP Routing configuration guide, "Multi-VRF Support" (VRF-Lite) chapter: search on cisco.com
  • Cisco IOS XE MPLS Layer 3 VPNs configuration guide, "Multiprotocol BGP VRF" and "Route Leaking" topics: search on cisco.com
  • Cisco Live On-Demand Library: search "VRF-Lite" and "network segmentation"
  • RFC 4364 (BGP/MPLS IP VPNs), for the RD and RT concepts that VRF-Lite borrows
  • Related practice: VRF-Lite multi-tenant edge diagram, Sim 08 fault 1