VRF

Configure Virtual Routing and Forwarding (VRF) instances on Cisco IOS XR devices. VRFs provide network segmentation by creating multiple isolated routing tables within a single router, enabling support for overlapping IP address spaces and multi-tenancy in service provider and enterprise networks.

Diagram

Classes

iosxr

Name	Type	Constraint	Mandatory
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No

devices (iosxr)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (iosxr)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (iosxr)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (iosxr.devices)

Name	Type	Constraint	Mandatory	Default Value
vrfs	List	vrfs	No

vrfs (iosxr.devices.configuration)

Name	Type	Constraint	Mandatory
name	String		Yes
description	String		No
fallback_vrf	String		No
evpn_route_sync	Integer	min: `1`, max: `65534`	No
address_family	Class	address_family	No
rd	String		No
vpn_id	Any	String or String[Regex: `^[0-9a-fA-F]{1,6}:[0-9a-fA-F]{1,8}$`] or String[Regex: `^.[\$\%]\{.$`]	No
remote_route_filtering_disable	Boolean	`true`, `false`	No

address_family (iosxr.devices.configuration.vrfs)

Name	Type	Constraint	Mandatory
ipv4_unicast	Class	ipv4_unicast	No
ipv6_unicast	Class	ipv6_unicast	No
ipv4_multicast	Class	ipv4_multicast	No
ipv6_multicast	Class	ipv6_multicast	No
ipv4_flowspec	Class	ipv4_flowspec	No
ipv6_flowspec	Class	ipv6_flowspec	No

ipv4_unicast (iosxr.devices.configuration.vrfs.address_family)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_policy	String		No
export_route_policy	String		No
import_from_bridge_domain_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_allow_backup	Boolean	`true`, `false`	No
import_from_vrf_allow_best_external	Boolean	`true`, `false`	No
import_from_default_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_default_vrf_route_policy	String		No
export_to_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
export_to_vrf_allow_backup	Boolean	`true`, `false`	No
export_to_vrf_allow_best_external	Boolean	`true`, `false`	No
export_to_default_vrf_route_policy	String		No
export_to_default_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
max_prefix_limit	Integer	min: `32`, max: `10000000`	No
max_prefix_threshold	Integer	min: `1`, max: `100`	No
import_route_targets	List	import_route_targets	No
export_route_targets	List	export_route_targets	No

ipv6_unicast (iosxr.devices.configuration.vrfs.address_family)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_policy	String		No
export_route_policy	String		No
import_from_bridge_domain_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_allow_backup	Boolean	`true`, `false`	No
import_from_vrf_allow_best_external	Boolean	`true`, `false`	No
import_from_default_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_default_vrf_route_policy	String		No
export_to_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
export_to_vrf_allow_backup	Boolean	`true`, `false`	No
export_to_vrf_allow_best_external	Boolean	`true`, `false`	No
export_to_default_vrf_route_policy	String		No
export_to_default_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
max_prefix_limit	Integer	min: `32`, max: `10000000`	No
max_prefix_threshold	Integer	min: `1`, max: `100`	No
import_route_targets	List	import_route_targets	No
export_route_targets	List	export_route_targets	No

ipv4_multicast (iosxr.devices.configuration.vrfs.address_family)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_policy	String		No
export_route_policy	String		No
import_from_bridge_domain_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_allow_backup	Boolean	`true`, `false`	No
import_from_vrf_allow_best_external	Boolean	`true`, `false`	No
import_from_default_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_default_vrf_route_policy	String		No
export_to_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
export_to_vrf_allow_backup	Boolean	`true`, `false`	No
export_to_vrf_allow_best_external	Boolean	`true`, `false`	No
export_to_default_vrf_route_policy	String		No
export_to_default_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
max_prefix_limit	Integer	min: `32`, max: `10000000`	No
max_prefix_threshold	Integer	min: `1`, max: `100`	No
import_route_targets	List	import_route_targets	No
export_route_targets	List	export_route_targets	No

ipv6_multicast (iosxr.devices.configuration.vrfs.address_family)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_policy	String		No
export_route_policy	String		No
import_from_bridge_domain_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_allow_backup	Boolean	`true`, `false`	No
import_from_vrf_allow_best_external	Boolean	`true`, `false`	No
import_from_default_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_default_vrf_route_policy	String		No
export_to_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
export_to_vrf_allow_backup	Boolean	`true`, `false`	No
export_to_vrf_allow_best_external	Boolean	`true`, `false`	No
export_to_default_vrf_route_policy	String		No
export_to_default_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
max_prefix_limit	Integer	min: `32`, max: `10000000`	No
max_prefix_threshold	Integer	min: `1`, max: `100`	No
import_route_targets	List	import_route_targets	No
export_route_targets	List	export_route_targets	No

ipv4_flowspec (iosxr.devices.configuration.vrfs.address_family)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_policy	String		No
export_route_policy	String		No
import_from_bridge_domain_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_allow_backup	Boolean	`true`, `false`	No
import_from_vrf_allow_best_external	Boolean	`true`, `false`	No
import_from_default_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_default_vrf_route_policy	String		No
export_to_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
export_to_vrf_allow_backup	Boolean	`true`, `false`	No
export_to_vrf_allow_best_external	Boolean	`true`, `false`	No
export_to_default_vrf_route_policy	String		No
export_to_default_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
max_prefix_limit	Integer	min: `32`, max: `10000000`	No
max_prefix_threshold	Integer	min: `1`, max: `100`	No
import_route_targets	List	import_route_targets	No
export_route_targets	List	export_route_targets	No

ipv6_flowspec (iosxr.devices.configuration.vrfs.address_family)

Name	Type	Constraint	Mandatory
enable	Boolean	`true`, `false`	No
import_route_policy	String		No
export_route_policy	String		No
import_from_bridge_domain_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_vrf_allow_backup	Boolean	`true`, `false`	No
import_from_vrf_allow_best_external	Boolean	`true`, `false`	No
import_from_default_vrf_advertise_as_vpn	Boolean	`true`, `false`	No
import_from_default_vrf_route_policy	String		No
export_to_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
export_to_vrf_allow_backup	Boolean	`true`, `false`	No
export_to_vrf_allow_best_external	Boolean	`true`, `false`	No
export_to_default_vrf_route_policy	String		No
export_to_default_vrf_allow_imported_vpn	Boolean	`true`, `false`	No
max_prefix_limit	Integer	min: `32`, max: `10000000`	No
max_prefix_threshold	Integer	min: `1`, max: `100`	No
import_route_targets	List	import_route_targets	No
export_route_targets	List	export_route_targets	No

import_route_targets (iosxr.devices.configuration.vrfs.address_family.ipv4_unicast)

Name	Type	Constraint	Mandatory	Default Value
rt	String		Yes
stitching	Choice	`disable`, `enable`	No

export_route_targets (iosxr.devices.configuration.vrfs.address_family.ipv4_unicast)

Name	Type	Constraint	Mandatory	Default Value
rt	String		Yes
stitching	Choice	`disable`, `enable`	No

Guidelines and Limitations

Enabling an Address-Family

In IOS-XR, simply enabling an address-family under a VRF (e.g., address-family ipv4 unicast) is a valid and meaningful configuration, even without any additional sub-attributes. There are three supported ways to enable an address-family:

address_family:
  # 1. Enabled by having attributes configured in the address-family
  ipv4_unicast:
    import_route_targets:
      - rt: 10.1.1.1:3
        stitching: enable
    export_route_targets:
      - rt: 10.1.1.1:3
        stitching: enable

  # 2. Explicitly enabled
  ipv6_unicast:
    enable: true

  # 3. Enabled with empty mapping
  ipv4_multicast: {}

Note: All three forms produce the same result on the device. The enable: true form is preferred for clarity. The empty mapping {} is also supported. Declaring a key with no value (e.g., ipv6_unicast:) works functionally but the IDE schema validator will flag it; use enable: true or {} instead.

Data Normalization

RD Formats

Fields that accept Route Distinguisher can be in any of four formats:

two-byte AS (e.g., 65001:100)
four-byte AS (e.g., 65536:100)
IPv4 address (e.g., 192.168.1.1:100)
auto (e.g., auto)

All four formats can be used interchangeably. The normalization layer automatically detects the user-specified format and maps to the correct attributes before sending to the device.

Example YAML Code:

Example-1: VRF with explicitly enabled IPv4 and IPv6 unicast address-families.

iosxr:
  devices:
    - name: router-1
      host: 10.10.10.1:57400
      configuration:
        vrfs:
          - name: VRF4
            description: "VRF Description"
            rd: 65001:100
            address_family:
              ipv4_unicast:
                enable: true
              ipv6_unicast:
                enable: true

Example-2: VRF with two-byte AS route distinguisher and IPv4 unicast address family with route targets.

iosxr:
  devices:
    - name: router-1
      host: 10.10.10.1:57400
      configuration:
        vrfs:
          - name: VRF4
            description: "VRF Description"
            rd: 65001:100
            address_family:
              ipv4_unicast:
                import_route_policy: POLICY_IN
                export_route_policy: POLICY_OUT
                import_route_targets:
                  - rt: 65001:100
                export_route_targets:
                  - rt: 65001:100

Example-3: VRF with four-byte AS route distinguisher, IPv6 unicast, import/export options, and max prefix limits.

iosxr:
  devices:
    - name: router-1
      host: 10.10.10.1:57400
      configuration:
        vrfs:
          - name: VRF4
            description: "VRF Description"
            rd: 100000:100
            address_family:
              ipv6_unicast:
                import_route_policy: POLICY_IN
                export_route_policy: POLICY_OUT
                import_from_bridge_domain_advertise_as_vpn: true
                max_prefix_limit: 1000
                max_prefix_threshold: 75
                import_route_targets:
                  - rt: 100000:100
                    stitching: enable
                export_route_targets:
                  - rt: 100000:100
                    stitching: enable

Example-4: VRF with IPv4 address route distinguisher, fallback VRF, EVPN route sync, and VPN ID.

iosxr:
  devices:
    - name: router-1
      host: 10.10.10.1:57400
      configuration:
        vrfs:
          - name: VRF4
            rd: 10.1.1.1:100
            description: "VRF Description"
            fallback_vrf: VRF2
            evpn_route_sync: 100
            vpn_id: 1000:1000
            address_family:
              ipv4_unicast:
                import_route_policy: POLICY_IN
                export_route_policy: POLICY_OUT
                import_route_targets:
                  - rt: 10.1.1.1:100
                export_route_targets:
                  - rt: 10.1.1.1:100

Example-5: PE router Dual-stack L3VPN.

iosxr:
  devices:
    - name: router-1
      host: 10.10.10.1:57400
      configuration:
        vrfs:
          - name: CUSTOMER-A
            description: "CUSTOMER-A dual-stack L3VPN"
            rd: 65000:1001
            address_family:
              ipv4_unicast:
                import_route_policy: CUSTOMER-A-V4
                export_route_policy: CUSTOMER-A-V4
                import_from_default_vrf_route_policy: LEAK-TO-CUSTOMER
                max_prefix_limit: 100000
                max_prefix_threshold: 80
                import_route_targets:
                  - rt: 65000:1001
                  - rt: 65000:9999
                export_route_targets:
                  - rt: 65000:1001
              ipv6_unicast:
                import_route_policy: CUSTOMER-A-V6
                export_route_policy: CUSTOMER-A-V6
                import_route_targets:
                  - rt: 65000:1001
                export_route_targets:
                  - rt: 65000:1001
              ipv4_multicast:
                import_route_targets:
                  - rt: 65000:2001
                export_route_targets:
                  - rt: 65000:2001