What is VRF?

A VRF (Virtual Routing and Forwarding) instance is a separate routing table on a router, letting several isolated networks share one device.

Each interface on a router belongs to one VRF, either the default (global) table or a named one. Routes learnt or configured in a VRF are only used for packets arriving on that VRF's interfaces, so traffic in one VRF cannot reach another unless you deliberately leak routes between them. Because the tables are independent, two VRFs can even use the same address space, such as 10.0.0.0/24, without conflict. Routing protocols run per VRF too: a router can have an OSPF process in one, a BGP address family in another, and a static default route in a third. On Linux, a VRF is a special network device that interfaces are enslaved to, with its own routing table, and FRR and VyOS build on that.

Network engineers meet VRFs in three main forms. "VRF-lite" uses VRFs on a single router or across a few routers to keep, say, guest and corporate traffic apart. A management VRF puts out-of-band management interfaces in their own table, so management traffic can't leak into production and a production routing problem can't cut off access. And provider L3VPNs and EVPN fabrics use a VRF per customer or tenant on each edge router, with BGP carrying the routes between them. Common mistakes include forgetting that ping, traceroute and SSH need to be told which VRF to use, and expecting a firewall or NAT rule in the default table to affect traffic in a VRF. A VRF separates routing at layer 3, while a VLAN separates at layer 2, and the two are often paired. The EVPN and VXLAN lesson uses VRFs in a routed fabric.