VRF

Configure Virtual Routing and Forwarding (VRF) instances on Cisco IOS XR devices. VRFs provide network segmentation by creating multiple isolated routing tables within a single router, enabling support for overlapping IP address spaces and multi-tenancy in service provider and enterprise networks.

Diagram

Classes

configuration (iosxr.devices)

Name	Type	Constraint	Mandatory	Default Value
vrfs	List	`[vrfs]`	No

vrfs (iosxr.devices.configuration)

Name	Type	Constraint	Mandatory
name	String		Yes
description	String		No
fallback_vrf	String		No
evpn_route_sync	Integer	min: `1`, max: `65534`	No
address_family	Class	`[address_family]`	No
rd	String		No
vpn_id	Any	String or String[Regex: `^[0-9a-fA-F]{1,6}:[0-9a-fA-F]{1,8}$`] or String[Regex: `^.[\$\%]\{.$`]	No
remote_route_filtering_disable	Boolean	`true`, `false`	No

address_family (iosxr.devices.configuration.vrfs)

Name	Type	Constraint	Mandatory
ipv4_unicast	Class	`[ipv4_unicast]`	No
ipv6_unicast	Class	`[ipv6_unicast]`	No
ipv4_multicast	Class	`[ipv4_multicast]`	No
ipv6_multicast	Class	`[ipv6_multicast]`	No
ipv4_flowspec	Class	`[ipv4_flowspec]`	No
ipv6_flowspec	Class	`[ipv6_flowspec]`	No

ipv4_unicast (iosxr.devices.configuration.vrfs.address_family)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_policy	String		No
export_route_policy	String		No
import_from_bridge_domain_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_allow_backup	Boolean	`true`, `false`	No
import_from_vrf_allow_best_external	Boolean	`true`, `false`	No
import_from_default_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_default_vrf_route_policy	String		No
export_to_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
export_to_vrf_allow_backup	Boolean	`true`, `false`	No
export_to_vrf_allow_best_external	Boolean	`true`, `false`	No
export_to_default_vrf_route_policy	String		No
export_to_default_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
max_prefix_limit	Integer	min: `32`, max: `10000000`	No
max_prefix_threshold	Integer	min: `1`, max: `100`	No
import_route_targets	List	`[import_route_targets]`	No
export_route_targets	List	`[export_route_targets]`	No

ipv6_unicast (iosxr.devices.configuration.vrfs.address_family)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_policy	String		No
export_route_policy	String		No
import_from_bridge_domain_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_allow_backup	Boolean	`true`, `false`	No
import_from_vrf_allow_best_external	Boolean	`true`, `false`	No
import_from_default_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_default_vrf_route_policy	String		No
export_to_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
export_to_vrf_allow_backup	Boolean	`true`, `false`	No
export_to_vrf_allow_best_external	Boolean	`true`, `false`	No
export_to_default_vrf_route_policy	String		No
export_to_default_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
max_prefix_limit	Integer	min: `32`, max: `10000000`	No
max_prefix_threshold	Integer	min: `1`, max: `100`	No
import_route_targets	List	`[import_route_targets]`	No
export_route_targets	List	`[export_route_targets]`	No

import_route_targets (iosxr.devices.configuration.vrfs.address_family.ipv4_unicast)

Name	Type	Constraint	Mandatory	Default Value
rt	String		Yes
stitching	Choice	`disable`, `enable`	No

Guidelines and Limitations

Enabling an Address-Family

In IOS-XR, simply enabling an address-family under a VRF (e.g., address-family ipv4 unicast) is a valid and meaningful configuration, even without any additional sub-attributes. There are three supported ways to enable an address-family:

address_family:
  # 1. Enabled by having attributes configured in the address-family
  ipv4_unicast:
    import_route_targets:
      - rt: 10.1.1.1:3
        stitching: enable
    export_route_targets:
      - rt: 10.1.1.1:3
        stitching: enable

  # 2. Explicitly enabled
  ipv6_unicast:
    enable: true

  # 3. Enabled with empty mapping
  ipv4_multicast: {}

Note: All three forms produce the same result on the device. The enable: true form is preferred for clarity. The empty mapping {} is also supported. Declaring a key with no value (e.g., ipv6_unicast:) works functionally but the IDE schema validator will flag it; use enable: true or {} instead.

Data Normalization

RD Formats

Fields that accept Route Distinguisher can be in any of four formats:

two-byte AS (e.g., 65001:100)
four-byte AS (e.g., 65536:100)
IPv4 address (e.g., 192.168.1.1:100)
auto (e.g., auto)

All four formats can be used interchangeably. The normalization layer automatically detects the user-specified format and maps to the correct attributes before sending to the device.

Example YAML Code:

Example-1: VRF with explicitly enabled IPv4 and IPv6 unicast address-families.

iosxr:
  devices:
    - name: router-1
      host: 10.10.10.1:57400
      configuration:
        vrfs:
          - name: VRF4
            description: "VRF Description"
            rd: 65001:100
            address_family:
              ipv4_unicast:
                enable: true
              ipv6_unicast:
                enable: true

Example-2: VRF with two-byte AS route distinguisher and IPv4 unicast address family with route targets.

iosxr:
  devices:
    - name: router-1
      host: 10.10.10.1:57400
      configuration:
        vrfs:
          - name: VRF4
            description: "VRF Description"
            rd: 65001:100
            address_family:
              ipv4_unicast:
                import_route_policy: POLICY_IN
                export_route_policy: POLICY_OUT
                import_route_targets:
                  - rt: 65001:100
                export_route_targets:
                  - rt: 65001:100

Example-3: VRF with four-byte AS route distinguisher, IPv6 unicast, import/export options, and max prefix limits.

iosxr:
  devices:
    - name: router-1
      host: 10.10.10.1:57400
      configuration:
        vrfs:
          - name: VRF4
            description: "VRF Description"
            rd: 100000:100
            address_family:
              ipv6_unicast:
                import_route_policy: POLICY_IN
                export_route_policy: POLICY_OUT
                import_from_bridge_domain_advertise_as_vpn: true
                max_prefix_limit: 1000
                max_prefix_threshold: 75
                import_route_targets:
                  - rt: 100000:100
                    stitching: enable
                export_route_targets:
                  - rt: 100000:100
                    stitching: enable

Example-4: VRF with IPv4 address route distinguisher, fallback VRF, EVPN route sync, and VPN ID.

iosxr:
  devices:
    - name: router-1
      host: 10.10.10.1:57400
      configuration:
        vrfs:
          - name: VRF4
            rd: 10.1.1.1:100
            description: "VRF Description"
            fallback_vrf: VRF2
            evpn_route_sync: 100
            vpn_id: 1000:1000
            address_family:
              ipv4_unicast:
                import_route_policy: POLICY_IN
                export_route_policy: POLICY_OUT
                import_route_targets:
                  - rt: 10.1.1.1:100
                export_route_targets:
                  - rt: 10.1.1.1:100

Example-5: PE router Dual-stack L3VPN.

iosxr:
  devices:
    - name: router-1
      host: 10.10.10.1:57400
      configuration:
        vrfs:
          - name: CUSTOMER-A
            description: "CUSTOMER-A dual-stack L3VPN"
            rd: 65000:1001
            address_family:
              ipv4_unicast:
                import_route_policy: CUSTOMER-A-V4
                export_route_policy: CUSTOMER-A-V4
                import_from_default_vrf_route_policy: LEAK-TO-CUSTOMER
                max_prefix_limit: 100000
                max_prefix_threshold: 80
                import_route_targets:
                  - rt: 65000:1001
                  - rt: 65000:9999
                export_route_targets:
                  - rt: 65000:1001
              ipv6_unicast:
                import_route_policy: CUSTOMER-A-V6
                export_route_policy: CUSTOMER-A-V6
                import_route_targets:
                  - rt: 65000:1001
                export_route_targets:
                  - rt: 65000:1001
              ipv4_multicast:
                import_route_targets:
                  - rt: 65000:2001
                export_route_targets:
                  - rt: 65000:2001