What is VRF lite and How to Configure it?

This blog will give you answers to these two mostly asked questions i.e. "what is vrf lite' and "how to configure vrf lite" particularly on Cisco routers but the concept is not only limited to Cisco.

In order to understand the concept of VRF lite and its step by step configuration on Cisco routers, let's consider a scenario where two routers connected to each other via two physical links (these links can be sub-interfaces as well) but for simplicity

I have taken two physical links as shown in the below diagram. Based on the scenario some tasks are design to configure respective VRFs and achieve a result. 

Cisco VRF Lite Configuration Example

● Configure the IP addresses on the two interfaces of R01 and R02 connected to each other as per the topology.

● Configure interface GigabitEthernet0/0 on both R01 and R02 so that it belongs to vrf VPN_A.

● Configure interface GigabitEthernet0/1 on both R01 and R02 so that it belongs to vrf VPN_B.

● Configure the following interfaces on R02: 

 ✓ Loopback101 with IP address of 172.16.2.2/24, assigned to vrf VPN_A.

 ✓ Loopback102 with IP address of 192.168.2.2/24, assigned to vrf VPN_B (As a part of VRF lite configuration)

● Configure default routes on R02 for both VRFs toward R01.

● Configure R01 so that from R02, you have IP connectivity between Loopback101 and Loopback102.

VRF Lite on Cisco Routers - Topology Diagram

Before moving to the Cisco VRF lite, make sure you have the IP addressing configured as per above diagram. Here is the initial configuration for the same.

R01:

R02:

What is VRF Lite?

VRF (Virtual Routing and Forwarding) are essentially required to make a single router into multiple virtual routers.

With the help of VRF lite configuration, you can create multiple virtual routing tables which has isolated networks and separate interfaces. They each has its own separate RIB (Routing Information Base) and FIB (Forwarding Information Base). These structures are also known as CEF tables.

How to Configure VRF Lite?

You can assign any interface of a router to a VRF using the command "ip vrf forwarding ". Please note that this command will erase all existing IP addresses already configured on the interface to avoid potential address duplication in the new routing table.

Once configuration is done and assigned that particular interface in a VRF then all packets received on this interface are routed and forwarded using the associated VRF table. You can compare this concept to the way VLAN trunking works at Layer 2.

How VRF Lite Works

Now whichever packet is entering into a specific VRF can only follow routes in that specific VRF’s routing table. Just like layer 2 trunk can span over multiple switches, VRF can also span over multiple devices.

If you require you can extend VRFs beyond a single router by properly mapping the VRFs to the links connecting between two routers.

This results in parallel VPNs being run across multiple devices, also known as VRF Lite, the most basic way to build VPNs. This is the simplest way of creating non-overlapping VPNs in a network. This gives you the answer to our initial question "what is vrf lite".

VRF Lite Scalability

However, the Cisco VRF lite has limited scope of scalability because it requires a dedicated inter-router link for every VPN.

Therefore, if you have two routers and 100 VPNs, you must provision. 100 connections between the two routers, one for every VPN. The connection could be either a separate interface or some Layer 2 virtualization technique, such as Frame-Relay PVC or Ethernet VLAN.

Cisco VRF Lite Capable Routers

In a router, all interfaces (physical or sub-interfaces) are in a global VRF by default which is the regular routing table used in non-VRF capable routers.

In VRF (lite) capable router, you can create a new VRF by issuing the command "ip vrf ", which opens the VRF lite configuration context mode on Cisco routers. After this initial step, you must define a route distinguisher (RD) for this particular VRF using the command rd X:Y , where X and Y are 32-bit numbers. A Route Distinguisher is a special 64-bit prefix prepended to every route in the respective VRF routing table.

VRF Lite - Purpose of Route Distinguisher (RD) 

This is done for the purpose of distinguishing the prefixes inside the router and avoiding collisions if two VRFs contain the same prefixes. The common format for an RD is the combination ASN:NN, where ASN is the autonomous system number and NN is the VRF number inside the router, or more globally, the VPN number within the ASN. 

Alternatively, you may use the format IP-Address:NN, where IP is the router’s IP address and NN is the VRF name. The second format properly reflects the feature of RD being a local distinguisher, but using the format ASN:NN is more popular and common, because it easily associates a VRF with a particular VPN in the network.

VRF Lite - Static and Dynamic Routing

It is possible to associate static routes or dynamic routing protocol processes with the VRFs. In this lab, we work with static routing only. The syntax for a VRF-bound static route is ip route vrf PREFIX MASK [interface] [next-hop] , where [nexthop] is an IP address resolvable through the VRF.

It is also possible to use static routes for inter-VRF communications. If you are using a static route with the [interface] specification, the interface could belong to any VRF.

Note that with multi-access interfaces, you must also specify the next-hop associated with the interface subnet because Cisco IOS will install a CEF entry in the source VRF using the information provided and will not attempt to resolve the next-hop recursively.

Remember that this trick only works with the non-recursive static routes that use directly connected interfaces. 

Now as per tasks, here are the steps of Cisco VRF lite configuration for both the routers.

R01:

R02:

Verification - Configure VRF Lite

Start by checking the VRF interfaces and basic IPv4 connectivity. Notice that the verification commands now use the vrf argument to select the specific routing table.

Let’s look at inter-VRF connectivity in detail. First, check the CEF table for VRF VPN_A in R01.

It appears accurate and complete. Now ping 172.16.2.2 from within VRF VPN_B in R02 and vice-versa.