VRF

VRF (Virtual Routing and Forwarding) enables network virtualization by creating isolated routing and forwarding instances within a single physical device. It supports MPLS Layer 3 VPNs, multi-tenancy, and network segmentation through separate routing tables, forwarding tables, and interfaces for each VRF instance. VRF provides comprehensive control over route import/export policies using route targets, route distinguishers for unique route identification, route replication between VRFs for selective route leaking, supports both IPv4 and IPv6 address families with granular policy control, includes EVPN integration through VNID (VXLAN Network Identifier) for automated route-target generation and stitching, and supports Multicast Distribution Tree (MDT) configuration for Tenant Routed Multicast (TRM) deployments.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
vrfs	List	`[vrfs]`	No

vrfs (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory
name	String		Yes
description	String		No
route_distinguisher	String		No
rd_auto	Boolean	`true`, `false`	No
address_family_ipv4	Class	`[address_family_ipv4]`	No
address_family_ipv6	Class	`[address_family_ipv6]`	No
vpn_id	String	Regex: `^[0-9a-fA-F]{1,6}:[0-9a-fA-F]{1,8}$`	No
vnid	List	`[vnid]`	No

address_family_ipv4 (iosxe.devices.configuration.vrfs)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_targets	List	String	No
import_route_targets_stitching	List	String	No
export_route_targets	List	String	No
export_route_targets_stitching	List	String	No
route_replicate	List	`[route_replicate]`	No
import_map	String		No
export_map	String		No
mdt	Class	`[mdt]`	No

address_family_ipv6 (iosxe.devices.configuration.vrfs)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_targets	List	String	No
import_route_targets_stitching	List	String	No
export_route_targets	List	String	No
export_route_targets_stitching	List	String	No
import_map	String		No
export_map	String		No

vnid (iosxe.devices.configuration.vrfs)

Name	Type	Constraint	Mandatory	Default Value
vnid_value	Integer	min: `1`, max: `2147483647`	Yes
evpn_instance_vni	List	`[evpn_instance_vni]`	No

route_replicate (iosxe.devices.configuration.vrfs.address_family_ipv4)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
route_map	String		No

mdt (iosxe.devices.configuration.vrfs.address_family_ipv4)

Name	Type	Constraint	Mandatory
default_address	IP		No
auto_discovery_vxlan	Boolean	`true`, `false`	No
auto_discovery_vxlan_inter_as	Boolean	`true`, `false`	No
auto_discovery_interworking_vxlan_pim	Boolean	`true`, `false`	No
auto_discovery_interworking_vxlan_pim_inter_as	Boolean	`true`, `false`	No
overlay_use_bgp	Boolean	`true`, `false`	No
overlay_use_bgp_spt_only	Boolean	`true`, `false`	No
data_multicast	List	`[data_multicast]`	No
data_threshold	Integer	min: `1`, max: `4294967`	No

evpn_instance_vni (iosxe.devices.configuration.vrfs.vnid)

Name	Type	Constraint	Mandatory	Default Value
vni_num	Integer	min: `4096`, max: `16777215`	Yes
core_vlan	Integer	min: `1`, max: `4094`	No

data_multicast (iosxe.devices.configuration.vrfs.address_family_ipv4.mdt)

Name	Type	Mandatory
address	IP	Yes
wildcard	IP	Yes
access_list	String	No

By segmenting the network into multiple VRFs, you achieve traffic isolation, multi-tenancy, and efficient resource utilization, making VRF essential for service providers and enterprises requiring routing separation. The VNID feature enables seamless EVPN integration for VXLAN-based network overlays.

VRF Parameters

Key Components:

VRF Name (name): The unique identifier for the VRF instance.
Description (description): A text description for the VRF, useful for documentation and operational clarity.
Route Distinguisher (route_distinguisher): Uniquely identifies routes within the MPLS VPN domain, preventing overlap.
Address Families (address_family_ipv4, address_family_ipv6): Enable IPv4 and/or IPv6 routing within the VRF, each containing route target configuration and route replication settings.
Route Replication (route_replicate): Enables selective route leaking between VRFs by replicating routes from one VRF to another, with optional route-map filtering for granular control over which routes are leaked.
Import/Export Route Maps (import_map, export_map): Apply route-map based filtering policies for VRF route import and export operations, providing fine-grained control over which routes are imported into or exported from the VRF.
VPN ID (vpn_id): Identifies the VPN for interoperability and management.
VNID Configuration (vnid): Configures VXLAN Network Identifier for EVPN integration, enabling automatic route-target generation and stitching for VXLAN-based overlay networks.
MDT Configuration (mdt): Configures Multicast Distribution Tree for Tenant Routed Multicast (TRM) within the IPv4 address family. Supports default group address, auto-discovery for VxLAN and VxLAN-PIM interworking, BGP overlay signaling, data multicast group ranges with wildcard masks, and switching thresholds.
Interface Association (interface): Associates physical or logical interfaces with the VRF for traffic isolation.

Key Parameters Briefly Explained:

name: Sets the VRF instance name.
description: Adds a description to the VRF.
route_distinguisher: Configures the unique route identifier.
rd_auto: Enables automatic route distinguisher assignment.
address_family_ipv4, address_family_ipv6: Enable IPv4/IPv6 address families with route target configuration and route replication.
route_replicate: Configures selective route leaking from other VRFs with optional route-map filtering.
import_map, export_map: Apply route-map based filtering for VRF route import/export operations.
vpn_id: Sets the VPN identifier.
vnid: Configures VXLAN Network Identifier with optional EVPN instance for automatic route-target generation.
mdt: Configures MDT for TRM with default group, auto-discovery, overlay signaling, data group ranges, and threshold.
interface: Associates interfaces with the VRF.

You can use these VRF parameters to define isolated routing environments on your network device. Customize the name, route distinguisher, route targets, route replication settings, VNID configuration, MDT settings, and interface associations to fit your network’s segmentation and multi-tenancy needs. Adjusting these parameters lets you tailor traffic isolation, selective route leaking, routing policies, EVPN integration, and multicast distribution for different network domains.

Sample Configuration

ip vrf definition VRF-PROD
 description Production VRF
 rd 200:1
 route-target export 200:10
 route-target export 300:10
 route-target import 200:10
 route-target import 300:10
 vnid 50001
 address-family ipv4
  route-target import 200:11 stitching
  route-target export 300:11
  route-replicate from vrf global unicast all route-map RM-GLOBAL
  route-replicate from vrf VRF-GUEST unicast all
  import map IMPORT-MAP-1
  export map EXPORT-MAP-1
 exit-address-family
 address-family ipv6
  route-target import 200:13
  route-target export 300:13 stitching
  import map IMPORT-MAP-1
  export map EXPORT-MAP-1
 exit-address-family
!
interface GigabitEthernet0/1
 ip vrf forwarding VRF-PROD
 ip address 10.0.0.1 255.255.255.0

Example YAML Code

The following YAML code sets up a VRF instance on an IOS-XE device, specifying its name, description, route distinguisher, route targets for import and export, route replication for selective route leaking, VNID for EVPN integration, and address family configurations for both IPv4 and IPv6.

iosxe:
  devices:
    - name: Device1
      configuration:
        vrfs:
          - name: "VRF-PROD"
            description: "Production VRF"
            route_distinguisher: "200:1"
            address_family_ipv4:
              enable: true
              import_route_targets: ["200:11"]
              import_route_targets_stitching: ["200:12"]
              export_route_targets: ["300:11"]
              export_route_targets_stitching: ["300:12"]
              route_replicate:
                - name: global
                  route_map: RM-GLOBAL
                - name: VRF-GUEST
              import_map: IMPORT-MAP-1
              export_map: EXPORT-MAP-1
            address_family_ipv6:
              enable: true
              import_route_targets: ["200:13"]
              import_route_targets_stitching: ["200:14"]
              export_route_targets: ["300:13"]
              export_route_targets_stitching: ["300:14"]
              import_map: IMPORT-MAP-1
              export_map: EXPORT-MAP-1
            vpn_id: "36B:1234"
            vnid:
              - vnid_value: 50001
                evpn_instance_vni:
                  - vni_num: 60001

Platform-Specific VNID Configuration

Router Platform (No Core-VLAN)

iosxe:
  devices:
    - name: Router1
      configuration:
        vrfs:
          - name: VRF1
            vnid:
              - vnid_value: 10001
                evpn_instance_vni:
                  - vni_num: 20001

Switch Platform (With Core-VLAN)

iosxe:
  devices:
    - name: Switch1
      configuration:
        vrfs:
          - name: VRF1
            vnid:
              - vnid_value: 10100
                evpn_instance_vni:
                  - vni_num: 20100
                    core_vlan: 3100  # Switch-only: maps VNI to core VLAN

Platform Notes:

Router platforms (Cat8k): Do NOT include core_vlan - configuration will be rejected
Switch platforms (Cat9k): core_vlan is optional - required only for explicit VLAN-to-VNI mapping
Core-VLANs should use high range (3000+) to avoid conflicts with data VLANs

MDT Configuration (Tenant Routed Multicast)

MDT enables multicast forwarding within VRFs for TRM deployments. The mdt block under address_family_ipv4 configures the default multicast group, auto-discovery mode, overlay signaling, and data group ranges.

Sample CLI Configuration

ip vrf definition TRM_VRF
 rd 65000:100
 address-family ipv4
  mdt default 239.1.1.1
  mdt auto-discovery vxlan
  mdt auto-discovery vxlan inter-as
  mdt data 239.1.2.0 0.0.0.255
  mdt data threshold 50
 exit-address-family

Router Platform (VxLAN auto-discovery not available)

iosxe:
  devices:
    - name: Router1
      configuration:
        vrfs:
          - name: TRM_VRF
            route_distinguisher: "65000:100"
            address_family_ipv4:
              enable: true
              mdt:
                default_address: 239.1.1.1
                data_threshold: 50
                data_multicast:
                  - address: 239.1.2.0
                    wildcard: 0.0.0.255

Switch Platform (With VxLAN auto-discovery)

iosxe:
  devices:
    - name: Switch1
      configuration:
        vrfs:
          - name: TRM_VRF
            route_distinguisher: "65000:100"
            address_family_ipv4:
              enable: true
              mdt:
                default_address: 239.1.1.1
                auto_discovery_vxlan: true
                auto_discovery_vxlan_inter_as: true
                data_threshold: 50
                data_multicast:
                  - address: 239.1.2.0
                    wildcard: 0.0.0.255
                  - address: 239.1.3.0
                    wildcard: 0.0.0.255
                    access_list: MDT-ACL

RD-Auto Configuration

The following YAML establishes a VRF on the device and enables rd-auto under the VRF.

iosxe:
  devices:
    - name: Device1
      configuration:
        vrfs:
          - name: "VRF-PROD"
            description: "Production VRF"
            rd_auto: true

VRF (Virtual Routing and Forwarding) enables network virtualization by creating isolated routing and forwarding instances within a single physical device. It supports MPLS Layer 3 VPNs, multi-tenancy, and network segmentation through separate routing tables, forwarding tables, and interfaces for each VRF instance. VRF provides comprehensive control over route import/export policies using route targets, route distinguishers for unique route identification, route replication between VRFs for selective route leaking, and supports both IPv4 and IPv6 address families with granular policy control.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
vrfs	List	`[vrfs]`	No

vrfs (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory
name	String		Yes
description	String		No
route_distinguisher	String		No
address_family_ipv4	Class	`[address_family_ipv4]`	No
address_family_ipv6	Class	`[address_family_ipv6]`	No
vpn_id	String	Regex: `^[0-9a-fA-F]{1,6}:[0-9a-fA-F]{1,8}$`	No

address_family_ipv4 (iosxe.devices.configuration.vrfs)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_targets	List	String	No
import_route_targets_stitching	List	String	No
export_route_targets	List	String	No
export_route_targets_stitching	List	String	No
route_replicate	List	`[route_replicate]`	No

address_family_ipv6 (iosxe.devices.configuration.vrfs)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_targets	List	String	No
import_route_targets_stitching	List	String	No
export_route_targets	List	String	No
export_route_targets_stitching	List	String	No

route_replicate (iosxe.devices.configuration.vrfs.address_family_ipv4)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
route_map	String		No

VRF Parameters

Key Components:

VRF Name (name): The unique identifier for the VRF instance.
Description (description): A text description for the VRF, useful for documentation and operational clarity.
Route Distinguisher (route_distinguisher): Uniquely identifies routes within the MPLS VPN domain, preventing overlap.
Address Families (address_family_ipv4, address_family_ipv6): Enable IPv4 and/or IPv6 routing within the VRF, each containing route target configuration and route replication settings.
Route Replication (route_replicate): Enables selective route leaking between VRFs by replicating routes from one VRF to another, with optional route-map filtering for granular control over which routes are leaked.
VPN ID (vpn_id): Identifies the VPN for interoperability and management.
Interface Association (interface): Associates physical or logical interfaces with the VRF for traffic isolation.

Key Parameters Briefly Explained:

name: Sets the VRF instance name.
description: Adds a description to the VRF.
route_distinguisher: Configures the unique route identifier.
address_family_ipv4, address_family_ipv6: Enable IPv4/IPv6 address families with route target configuration and route replication.
route_replicate: Configures selective route leaking from other VRFs with optional route-map filtering.
vpn_id: Sets the VPN identifier.
interface: Associates interfaces with the VRF.

You can use these VRF parameters to define isolated routing environments on your network device. Customize the name, route distinguisher, route targets, route replication settings, and interface associations to fit your network’s segmentation and multi-tenancy needs. Adjusting these parameters lets you tailor traffic isolation, selective route leaking, and routing policies for different network domains.

Sample Configuration

ip vrf definition VRF-PROD
 description Production VRF
 rd 200:1
 route-target export 200:10
 route-target export 300:10
 route-target import 200:10
 route-target import 300:10
 address-family ipv4
  route-target import 200:11 stitching
  route-target export 300:11
  route-replicate from vrf global unicast all route-map RM-GLOBAL
  route-replicate from vrf VRF-GUEST unicast all
 exit-address-family
 address-family ipv6
  route-target import 200:13
  route-target export 300:13 stitching
 exit-address-family
!
interface GigabitEthernet0/1
 ip vrf forwarding VRF-PROD
 ip address 10.0.0.1 255.255.255.0

Example YAML Code

The following YAML code sets up a VRF instance on an IOS-XE device, specifying its name, description, route distinguisher, route targets for import and export, route replication for selective route leaking, and address family configurations for both IPv4 and IPv6.

iosxe:
  devices:
    - name: Device1
      configuration:
        vrfs:
          - name: "VRF-PROD"
            description: "Production VRF"
            route_distinguisher: "200:1"
            address_family_ipv4:
              import_route_targets: ["200:11"]
              import_route_targets_stitching: ["200:12"]
              export_route_targets: ["300:11"]
              export_route_targets_stitching: ["300:12"]
              route_replicate:
                - name: global
                  route_map: RM-GLOBAL
                - name: VRF-GUEST
            address_family_ipv6:
              import_route_targets: ["200:13"]
              import_route_targets_stitching: ["200:14"]
              export_route_targets: ["300:13"]
              export_route_targets_stitching: ["300:14"]
            vpn_id: "36B:1234"