USD ($)
$
United States Dollar
India Rupee

What is VRF lite and How to Configure it?

Created by Deepak Sharma in Articles 12 May 2024
Share

This blog will give you answers to these two mostly asked questions i.e. "what is vrf lite' and "how to configure vrf lite" particularly on Cisco routers but the concept is not only limited to Cisco.

In order to understand the concept of VRF lite and its step by step configuration on Cisco routers, let's consider a scenario where two routers connected to each other via two physical links (these links can be sub-interfaces as well) but for simplicity

I have taken two physical links as shown in the below diagram. Based on the scenario some tasks are design to configure respective VRFs and achieve a result. 


Cisco VRF Lite Configuration Example

● Configure the IP addresses on the two interfaces of R01 and R02 connected to each other as per the topology.

● Configure interface GigabitEthernet0/0 on both R01 and R02 so that it belongs to vrf VPN_A.

● Configure interface GigabitEthernet0/1 on both R01 and R02 so that it belongs to vrf VPN_B.

● Configure the following interfaces on R02: 

 ✓ Loopback101 with IP address of 172.16.2.2/24, assigned to vrf VPN_A.

 ✓ Loopback102 with IP address of 192.168.2.2/24, assigned to vrf VPN_B (As a part of VRF lite configuration)

● Configure default routes on R02 for both VRFs toward R01.

● Configure R01 so that from R02, you have IP connectivity between Loopback101 and Loopback102.


VRF Lite on Cisco Routers - Topology Diagram



Before moving to the Cisco VRF lite, make sure you have the IP addressing configured as per above diagram. Here is the initial configuration for the same.

R01:


!
enable
configure terminal
!
hostname R01
!
no ip domain lookup
ip routing
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface GigabitEthernet0/0
 ip address 192.1.12.1 255.255.255.0
!
interface GigabitEthernet0/1
 ip address 192.1.21.1 255.255.255.0
!
line con 0
 exec-timeout 0 0
 logging synchronous
 privilege level 15
 no login
!
line vty 0 4
 privilege level 15
 no login
!
end
!
write
!


R02:


!
enable
configure terminal
!
hostname R02
!
no ip domain lookup
ip routing
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
!
interface GigabitEthernet0/0
 ip address 192.1.12.2 255.255.255.0
!
interface GigabitEthernet0/1
 ip address 192.1.21.2 255.255.255.0
!
line con 0
 exec-timeout 0 0
 logging synchronous
 privilege level 15
 no login
!
line vty 0 4
 privilege level 15
 no login
!
end
!
write
!


What is VRF Lite?

VRF (Virtual Routing and Forwarding) are essentially required to make a single router into multiple virtual routers.

With the help of VRF lite configuration, you can create multiple virtual routing tables which has isolated networks and separate interfaces. They each has its own separate RIB (Routing Information Base) and FIB (Forwarding Information Base). These structures are also known as CEF tables.


How to Configure VRF Lite?

You can assign any interface of a router to a VRF using the command "ip vrf forwarding ". Please note that this command will erase all existing IP addresses already configured on the interface to avoid potential address duplication in the new routing table.

Once configuration is done and assigned that particular interface in a VRF then all packets received on this interface are routed and forwarded using the associated VRF table. You can compare this concept to the way VLAN trunking works at Layer 2.


How VRF Lite Works

Now whichever packet is entering into a specific VRF can only follow routes in that specific VRF’s routing table. Just like layer 2 trunk can span over multiple switches, VRF can also span over multiple devices.

If you require you can extend VRFs beyond a single router by properly mapping the VRFs to the links connecting between two routers.

This results in parallel VPNs being run across multiple devices, also known as VRF Lite, the most basic way to build VPNs. This is the simplest way of creating non-overlapping VPNs in a network. This gives you the answer to our initial question "what is vrf lite".


VRF Lite Scalability

However, the Cisco VRF lite has limited scope of scalability because it requires a dedicated inter-router link for every VPN.

Therefore, if you have two routers and 100 VPNs, you must provision. 100 connections between the two routers, one for every VPN. The connection could be either a separate interface or some Layer 2 virtualization technique, such as Frame-Relay PVC or Ethernet VLAN.


Cisco VRF Lite Capable Routers

In a router, all interfaces (physical or sub-interfaces) are in a global VRF by default which is the regular routing table used in non-VRF capable routers.

In VRF (lite) capable router, you can create a new VRF by issuing the command "ip vrf ", which opens the VRF lite configuration context mode on Cisco routers. After this initial step, you must define a route distinguisher (RD) for this particular VRF using the command rd X:Y , where X and Y are 32-bit numbers. A Route Distinguisher is a special 64-bit prefix prepended to every route in the respective VRF routing table.


VRF Lite - Purpose of Route Distinguisher (RD) 

This is done for the purpose of distinguishing the prefixes inside the router and avoiding collisions if two VRFs contain the same prefixes. The common format for an RD is the combination ASN:NN, where ASN is the autonomous system number and NN is the VRF number inside the router, or more globally, the VPN number within the ASN. 

Alternatively, you may use the format IP-Address:NN, where IP is the router’s IP address and NN is the VRF name. The second format properly reflects the feature of RD being a local distinguisher, but using the format ASN:NN is more popular and common, because it easily associates a VRF with a particular VPN in the network.


VRF Lite - Static and Dynamic Routing

It is possible to associate static routes or dynamic routing protocol processes with the VRFs. In this lab, we work with static routing only. The syntax for a VRF-bound static route is ip route vrf PREFIX MASK [interface] [next-hop] , where [nexthop] is an IP address resolvable through the VRF.

It is also possible to use static routes for inter-VRF communications. If you are using a static route with the [interface] specification, the interface could belong to any VRF.

Note that with multi-access interfaces, you must also specify the next-hop associated with the interface subnet because Cisco IOS will install a CEF entry in the source VRF using the information provided and will not attempt to resolve the next-hop recursively.

Remember that this trick only works with the non-recursive static routes that use directly connected interfaces. 

Now as per tasks, here are the steps of Cisco VRF lite configuration for both the routers.

R01:

!

ip vrf VPN_A

 rd 100:1

!

ip vrf VPN_B

 rd 100:2

!

interface GigabitEthernet0/0

 ip vrf forwarding VPN_A

 ip address 192.1.12.1 255.255.255.0

!

interface GigabitEthernet0/1

 ip vrf forwarding VPN_B

 ip address 192.1.21.1 255.255.255.0

!

ip route vrf VPN_A 192.168.2.0 255.255.255.0 GigabitEthernet0/1 192.1.21.2

ip route vrf VPN_B 172.16.2.0 255.255.255.0 GigabitEthernet0/0 192.1.12.2

!


R02:

!

ip vrf VPN_A

 rd 100:1

!

ip vrf VPN_B

 rd 100:2 

!

interface GigabitEthernet0/0

 ip vrf forwarding VPN_A

 ip address 192.1.12.2 255.255.255.0

!

interface GigabitEthernet0/1

 ip vrf forwarding VPN_B

 ip address 192.1.21.2 255.255.255.0

!

interface Loopback101

 ip vrf forwarding VPN_A

 ip address 172.16.2.2 255.255.255.0

!

interface Loopback102

 ip vrf forwarding VPN_B

 ip address 192.168.2.2 255.255.255.0

!

ip route vrf VPN_A 0.0.0.0 0.0.0.0 192.1.12.1

ip route vrf VPN_B 0.0.0.0 0.0.0.0 192.1.21.1

!


Verification - Configure VRF Lite

Start by checking the VRF interfaces and basic IPv4 connectivity. Notice that the verification commands now use the vrf argument to select the specific routing table.


Let’s look at inter-VRF connectivity in detail. First, check the CEF table for VRF VPN_A in R01.


It appears accurate and complete. Now ping 172.16.2.2 from within VRF VPN_B in R02 and vice-versa.


Don't Miss to Checkout our Next Articles

Configuring IPSec over GRE on Cisco IOS Routers

Explaining the Operation of WAN Optimization



Other Popular & Useful Articles

Authentication and Troubleshooting in BGP

Example Configuration for BGP MED Attribute

Deepak Sharma

He is a senior solution network architect and currently working with one of the largest financial company. He has an impressive academic and training background. He has completed his B.Tech and MBA, which makes him both technically and managerial proficient. He has also completed more than 450 online and offline training courses, both in India and ...

More... | Author`s Bog | Book a Meeting

Comments (2)

Ankit verma Student
13 Oct 2023 | 01:00 pm

Great post with configuration scenario example. I do not have 2 physical links to connect two routers to each other. can this work with sub-interfaces i.e. if router interface is connected to a switch port as trunk port.

Deepak Sharma User
13 Oct 2023 | 01:12 pm

Hello Ankit, yes you can configure vrf lite using sub-interfaces of the routers but make sure you have enough bandwidth on these interfaces.

sanchit thareja Student
31 Oct 2023 | 08:38 pm

Why do require to use vrf lite anyways ?

Deepak Sharma User
2 Mar 2024 | 10:13 pm

Most of the cases it is not required however in some corner cases where you may require to extend your virtual routing table from one router to another then VRF lite is to be configured.
There may be a case when you do not have a budget to have other router for separate routing table then you can divide the router into multiple routing table using VRF and extend that to other router using vrf lite.

Share

Share this post with others

Contact learning advisor

New Cisco ACI Training Live Batch Starts June 15th!
New Cisco ACI Training Live Batch Starts June 15th!
Advance your career? Don't miss out on our Cisco Application Centric Infrastructure (ACI) training ...
Enroll Now