Virtual Routing and Forwarding (VRF)

VRF (Virtual Routing and Forwarding) is a network virtualization technology that allows a router to have multiple independent routing tables.

Just like VLANs isolate traffic at Layer 2 by creating virtual switches, VRFs isolate routing domains at Layer 3 by creating virtual routers on a single physical device.

Figure 1 – VLANs isolate Layer 2 traffic and VRFs isolate Layer 3 routing

In this course, we'll focus on VRF-Lite, a simplified version of VRF that does not use MP-BGP (Multiprotocol BGP) or MPLS (Multiprotocol Label Switching). This is the type of VRF you need to understand for the CCNA exam. To help you grasp its value, let's walk through a real-world example.

Imagine a Service Provider needs to connect two customers to the same ISP router.
As the diagram shows, both Customer 1 and Customer 2 need to access the internet through the ISP. But the network engineer is facing a key question:

Figure 2 – Connecting two customers to the same ISP router without isolating their traffic

By default, the ISP router uses a single global routing table.
As soon as both customers are connected, the ISP router learns their networks and inserts them into its routing table.

Figure 3 – Without VRF: all routes in one routing table.

This leads to a serious risk of traffic leakage between customers, since the ISP router doesn't distinguish between Customer 1 and Customer 2's routes.
This means Customer 1 could potentially reach Customer 2's network if we're not careful, a serious security risk.

What we need is a way to completely separate Customer 1's routes from Customer 2's routes. This is exactly what Virtual Routing and Forwarding (VRF) allows us to achieve.

With VRF, we can turn a single physical router into multiple virtual routers. In our example, we'll create two virtual routing instances:

• One VRF named Customer_1 with its own routing table

• One VRF named Customer_2 with its own routing table

Then, we assign the appropriate physical interfaces to each VRF.

Figure 4 – VRFs create separate routing instances per customer.

At this point, the ISP router hosts two independent routing environments:

• Each VRF has its own set of interfaces

• Each VRF has its own routing table

• And there is complete separation between the two

Each customer is now isolated within its own VRF: Customer 1 and Customer 2 cannot see or reach each other, even though they share the same physical ISP router.

VRF brings two key benefits for your CCNA study.

Independent Routing Tables

Each VRF maintains its own routing table that is completely separated from others.

By default:

• Traffic from one VRF can't reach another

• Routing entries and interfaces are fully isolated

We can look at the content of our 2 VRFs with the show ip route vrf vrf-name command:

Figure 5 – Each VRF has its own routing table.

We can see that the VRF Customer_1 has the network 203.0.113.0/30 in its routing table. When we check the VRF Customer_2, we find the same subnet 203.0.113.0/30.