VRF

VRF (Virtual Routing and Forwarding) enables network virtualization by creating isolated routing and forwarding instances within a single NX-OS device, supporting multi-tenancy and network segmentation through separate routing tables. Each VRF instance can be configured with a route distinguisher, VNI for VXLAN integration, VPN ID, and per-address-family route target import/export policies for both IPv4 and IPv6 unicast. VRF supports EVPN route target auto-derivation, selective route leaking between VRFs, and L3VNI association for VXLAN-based Layer 3 overlay networking.

Diagram

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
vrfs	List	vrfs	No

vrfs (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
vni	Integer	min: 1, max: 16777215	No
l3vni	Boolean	true, false	No
mdt_v4_vxlan	Boolean	true, false	No
mdt_v6_vxlan	Boolean	true, false	No
route_distinguisher	String		No
oui	String		No
vpn_id	String		No
auto_discard	Boolean	true, false	No
icmp_errors_source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
icmp_errors_source_interface_id	Any	String or Integer[min: 0]	No
address_families	List	address_families	No
security_enforce_tag	Integer	min: 0, max: 65535	No
security_enforce_default	Choice	deny, permit	No
security_contracts	List	security_contracts	No

vrfs (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
vni	Integer	min: 1, max: 16777215	No
l3vni	Boolean	true, false	No
route_distinguisher	String		No
oui	String		No
vpn_id	String		No
auto_discard	Boolean	true, false	No
icmp_errors_source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
icmp_errors_source_interface_id	Any	String or Integer[min: 0]	No
address_families	List	address_families	No
security_enforce_tag	Integer	min: 0, max: 65535	No
security_enforce_default	Choice	deny, permit	No

address_families (nxos.devices.configuration.vrfs)

Name	Type	Constraint	Mandatory	Default Value
address_family	Choice	ipv4-unicast, ipv6-unicast	Yes
route_target_both_auto	Boolean	true, false	No
route_target_both_auto_evpn	Boolean	true, false	No
route_target_imports	List	String	No
route_target_exports	List	String	No
route_target_imports_evpn	List	String	No
route_target_exports_evpn	List	String	No
import_map	String		No
export_map	String		No
import_vrf_default_map	String		No
import_vrf_default_prefix_limit	Integer	min: 1, max: 2147483647	No
import_vrf_default_advertise_vpn	Boolean	true, false	No
export_vrf_default_map	String		No
export_vrf_default_prefix_limit	Integer	min: 1, max: 2147483647	No
export_vrf_default_allow_vpn	Boolean	true, false	No

address_families (nxos.devices.configuration.vrfs)

Name	Type	Constraint	Mandatory	Default Value
address_family	Choice	ipv4-unicast, ipv6-unicast	Yes
route_target_both_auto	Boolean	true, false	No
route_target_both_auto_evpn	Boolean	true, false	No
route_target_imports	List	String	No
route_target_exports	List	String	No
route_target_imports_evpn	List	String	No
route_target_exports_evpn	List	String	No
import_map	String		No
export_map	String		No

security_contracts (nxos.devices.configuration.vrfs)

Name	Type	Constraint	Mandatory	Default Value
source	Any	Integer[min: 0, max: 65535] or Choice[any] or String[Regex: ^.*[\$\%]\{.*$]	Yes
destination	Any	Integer[min: 0, max: 65535] or Choice[any] or String[Regex: ^.*[\$\%]\{.*$]	Yes
policy	String		Yes
unidir	Boolean	true, false	No

Examples

Example 1: Single tenant VRF with IPv4 unicast and EVPN route targets

nxos:
  devices:
    - name: LEAF1
      configuration:
        vrfs:
          - name: BLUE
            description: Blue Tenant VRF
            vni: 11010
            route_distinguisher: "65000:1010"
            address_families:
              - address_family: ipv4-unicast
                route_target_imports:
                  - "65000:11010"
                route_target_exports:
                  - "65000:11010"
                route_target_imports_evpn:
                  - "65000:11010"
                route_target_exports_evpn:
                  - "65000:11010"

Example 2: Dual-stack VRF with both IPv4 and IPv6 address families

nxos:
  devices:
    - name: LEAF1
      configuration:
        vrfs:
          - name: GREEN
            description: Green Tenant VRF
            vni: 11020
            route_distinguisher: "65000:1020"
            address_families:
              - address_family: ipv4-unicast
                route_target_imports:
                  - "65000:11020"
                route_target_exports:
                  - "65000:11020"
                route_target_imports_evpn:
                  - "65000:11020"
                route_target_exports_evpn:
                  - "65000:11020"
              - address_family: ipv6-unicast
                route_target_imports:
                  - "65000:11020"
                route_target_exports:
                  - "65000:11020"
                route_target_imports_evpn:
                  - "65000:11020"
                route_target_exports_evpn:
                  - "65000:11020"

Example 3: Multiple tenant VRFs on a leaf switch with L2 VNI route target imports

nxos:
  devices:
    - name: LEAF2
      configuration:
        vrfs:
          - name: BLUE
            description: Blue Tenant VRF
            vni: 11010
            route_distinguisher: "65000:1010"
            address_families:
              - address_family: ipv4-unicast
                route_target_imports:
                  - "65000:11010"
                  - "65000:10101"
                  - "65000:10102"
                route_target_exports:
                  - "65000:11010"
                route_target_imports_evpn:
                  - "65000:11010"
                route_target_exports_evpn:
                  - "65000:11010"
          - name: GREEN
            description: Green Tenant VRF
            vni: 11020
            route_distinguisher: "65000:1020"
            address_families:
              - address_family: ipv4-unicast
                route_target_both_auto: true
                route_target_both_auto_evpn: true

Example 4: VRF with import/export maps

nxos:
  devices:
    - name: LEAF1
      configuration:
        vrfs:
          - name: RED
            description: Red Tenant VRF
            vni: 11030
            route_distinguisher: "65000:1030"
            address_families:
              - address_family: ipv4-unicast
                route_target_imports:
                  - "65000:11030"
                route_target_exports:
                  - "65000:11030"
                import_map: RM_IMPORT
                export_map: RM_EXPORT
                route_target_imports_evpn:
                  - "65000:11030"
                route_target_exports_evpn:
                  - "65000:11030"

Example 5: VRF with route leaking to and from the default VRF

nxos:
  devices:
    - name: LEAF1
      configuration:
        vrfs:
          - name: SHARED
            route_distinguisher: "65000:100"
            address_families:
              - address_family: ipv4-unicast
                import_vrf_default_map: RM_FROM_DEFAULT
                import_vrf_default_prefix_limit: 1000
                import_vrf_default_advertise_vpn: true
                export_vrf_default_map: RM_TO_DEFAULT
                export_vrf_default_prefix_limit: 500
                export_vrf_default_allow_vpn: true

Example 6: L3VNI VRF with Tenant Routed Multicast (TRM) MDT settings

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          ngmvpn: true
        vrfs:
          - name: BLUE
            vni: 50001
            l3vni: true
            mdt_v4_vxlan: true
            mdt_v6_vxlan: false

Examples

Example 1: Single tenant VRF with IPv4 unicast and EVPN route targets

nxos:
  devices:
    - name: LEAF1
      configuration:
        vrfs:
          - name: BLUE
            description: Blue Tenant VRF
            vni: 11010
            route_distinguisher: "65000:1010"
            address_families:
              - address_family: ipv4-unicast
                route_target_imports:
                  - "65000:11010"
                route_target_exports:
                  - "65000:11010"
                route_target_imports_evpn:
                  - "65000:11010"
                route_target_exports_evpn:
                  - "65000:11010"

Example 2: Dual-stack VRF with both IPv4 and IPv6 address families

nxos:
  devices:
    - name: LEAF1
      configuration:
        vrfs:
          - name: GREEN
            description: Green Tenant VRF
            vni: 11020
            route_distinguisher: "65000:1020"
            address_families:
              - address_family: ipv4-unicast
                route_target_imports:
                  - "65000:11020"
                route_target_exports:
                  - "65000:11020"
                route_target_imports_evpn:
                  - "65000:11020"
                route_target_exports_evpn:
                  - "65000:11020"
              - address_family: ipv6-unicast
                route_target_imports:
                  - "65000:11020"
                route_target_exports:
                  - "65000:11020"
                route_target_imports_evpn:
                  - "65000:11020"
                route_target_exports_evpn:
                  - "65000:11020"

Example 3: Multiple tenant VRFs on a leaf switch with L2 VNI route target imports

nxos:
  devices:
    - name: LEAF2
      configuration:
        vrfs:
          - name: BLUE
            description: Blue Tenant VRF
            vni: 11010
            route_distinguisher: "65000:1010"
            address_families:
              - address_family: ipv4-unicast
                route_target_imports:
                  - "65000:11010"
                  - "65000:10101"
                  - "65000:10102"
                route_target_exports:
                  - "65000:11010"
                route_target_imports_evpn:
                  - "65000:11010"
                route_target_exports_evpn:
                  - "65000:11010"
          - name: GREEN
            description: Green Tenant VRF
            vni: 11020
            route_distinguisher: "65000:1020"
            address_families:
              - address_family: ipv4-unicast
                route_target_both_auto: true
                route_target_both_auto_evpn: true

Example 4: VRF with import/export maps

nxos:
  devices:
    - name: LEAF1
      configuration:
        vrfs:
          - name: RED
            description: Red Tenant VRF
            vni: 11030
            route_distinguisher: "65000:1030"
            address_families:
              - address_family: ipv4-unicast
                route_target_imports:
                  - "65000:11030"
                route_target_exports:
                  - "65000:11030"
                import_map: RM_IMPORT
                export_map: RM_EXPORT
                route_target_imports_evpn:
                  - "65000:11030"
                route_target_exports_evpn:
                  - "65000:11030"