Multi-VRF overview

Virtual Routing and Forwarding (VRF) allows routers to maintain multiple routing tables and forwarding tables on the same router. A Multi-VRF router can run multiple instances of routing protocols with a neighboring router with overlapping address spaces configured on different VRF instances.

Some vendors also use the terms Multi-VRF CE or VRF-Lite for this technology. VRF-Lite provides a reliable mechanism for a network administrator to maintain multiple virtual routers on the same device. The goal of providing isolation among different VPN instances is accomplished without the overhead of heavyweight protocols (such as MPLS) used in secure VPN technologies. Overlapping address spaces can be maintained among the different VPN instances.

Central to VRF-Lite is the ability to maintain multiple VRF tables on the same Provider Edge (PE) Router. VRF-Lite uses multiple instances of a routing protocol such as OSPF or BGP to exchange route information for a VPN among peer PE routers. The VRF-Lite capable PE router maps an input customer interface to a unique VPN instance. The router maintains a different VRF table for each VPN instance on that PE router. Multiple input interfaces may also be associated with the same VRF on the router, if they connect to sites belonging to the same VPN. This input interface can be a physical interface or a virtual Ethernet interface on a port.

In Multi-VRF deployments:

  • Two VRF-capable routers must be directly connected at Layer 3, deploying BGP, OSPF, RIP, or static routes.
  • Each VRF maintains unique routing and forwarding tables.
  • Each VRF can be assigned one or more Layer 3 interfaces on a router to be part of the VRF.
  • Each VRF can be configured with IPv4 address family, IPv6 address family, or both.
  • A packet’s VRF instance is determined based on the VRF index of the interface on which the packet is received.
  • Separate routing protocol instances are required for each VRF instance.
  • Overlapping address spaces can be configured on different VRF instances.

Multi-VRF deployments provide the flexibility to maintain multiple virtual routers, which are segregated for each VRF instance. The following illustrates a generic, high-level topology where different enterprise functions are assigned unique VRF instances.

Figure 36  Example high-level Multi-VRF topology

A Multi-VRF instance can be configured on any of the following:

  • Platforms that support untagged physical ports - Applies only to the Brocade ICX 7750 and the Brocade ICX 7450. It is recommended that these ports be configured "route-only" to prevent the leaking of switching traffic if two interfaces in the same VLAN are configured with different VRFs.
  • Virtual interfaces
  • Loopback interfaces
  • Ethernet interfaces
  • Tunnel interfaces - The tunnel can belong to any user-defined VRF, but the tunnel source and tunnel destination are restricted to the default VRF.

A Multi-VRF instance cannot be configured on any of the following:

  • Physical interfaces
  • Management interfaces

To configure Multi-VRF, perform the following steps:

  • Configure VRF-related system-max values.
  • (Optional) Configure tagging on peer interfaces for security.
  • Configure VRF instances.
  • Configure an IPv4 or IPv6 Address Family (AF) and Neighbor Discovery Protocol for new VRF instances.
  • Configure routing protocols for new Multi-VRF instances.
  • Assign VRF instances to Layer 3 interfaces.
Parent topic: Multi-VRF