Skip to content
Study CCNP

2.2.a VRF

3 min read ENCOR 350-401 v1.2

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

A VRF is a separate routing table on the same router or Layer 3 switch.

That is the practical definition you need first. One device can route for multiple logical networks, and each VRF keeps its routes separate from the others.

VRF stands for Virtual Routing and Forwarding. In enterprise networks, you often use VRF-Lite to separate departments, tenants, management traffic, labs, or overlapping customer networks without needing a separate physical router for each one.

Why VRFs matter

Without VRFs, a router has one global routing table.

show ip route

With VRFs, the same router can have multiple tables.

show ip route vrf BLUE
show ip route vrf RED
show ip route vrf MGMT

Interfaces belong to a VRF. Routes learned or configured on that interface go into that VRF's table.

Interface Gi0/1
 VRF BLUE -> BLUE routing table
Interface Gi0/2
 VRF RED -> RED routing table

Traffic in BLUE does not automatically see routes in RED. That is the point.

VRF vs VLAN

Do not mix these up.

A VLAN separates Layer 2 broadcast domains. A VRF separates Layer 3 routing tables.

You often use both together.

VLAN 10
 SVI Vlan10 -> VRF BLUE
VLAN 20
 SVI Vlan20 -> VRF RED

Basic VRF-Lite config

Topology

PC-BLUE
R1 Gi0/1 · VRF BLUE
BLUE upstream
PC-RED
R1 Gi0/2 · VRF RED
RED upstream

Goal

  • BLUE and RED can use separate routing tables.
  • BLUE cannot accidentally route through RED.
  • Verification uses ping vrf and show ip route vrf.

R1 configuration

conf t
!
vrf definition BLUE
description Blue customer or department
address-family ipv4
exit-address-family
!
vrf definition RED
description Red customer or department
address-family ipv4
exit-address-family
!
interface GigabitEthernet0/1
 description BLUE LAN
 vrf forwarding BLUE
 ip address 10.10.10.1 255.255.255.0
 no shutdown
!
interface GigabitEthernet0/2
 description RED LAN
 vrf forwarding RED
 ip address 10.20.20.1 255.255.255.0
 no shutdown
!
interface GigabitEthernet0/3
 description BLUE upstream
 vrf forwarding BLUE
 ip address 192.0.2.1 255.255.255.252
 no shutdown
!
interface GigabitEthernet0/4
 description RED upstream
 vrf forwarding RED
 ip address 198.51.100.1 255.255.255.252
 no shutdown
!
ip route vrf BLUE 0.0.0.0 0.0.0.0 192.0.2.2
ip route vrf RED 0.0.0.0 0.0.0.0 198.51.100.2
end

Important: on many IOS/IOS XE platforms, applying vrf forwarding to an interface removes the existing IP address. Put the VRF on the interface first, then configure the IP address.

Verification commands

show vrf
show ip interface brief vrf BLUE
show ip interface brief vrf RED
show ip route vrf BLUE
show ip route vrf RED
ping vrf BLUE 192.0.2.2
ping vrf RED 198.51.100.2

Expected result:

BLUE routes appear only in BLUE.
RED routes appear only in RED.
The global routing table does not automatically contain BLUE or RED routes.

Lab: overlapping IP addresses

Goal

See why VRFs are useful when two customers use the same subnet.

Topology

Customer-A 10.1.1.10/24
R1 Gi0/1 · VRF CUST_A
Customer-B 10.1.1.10/24
R1 Gi0/2 · VRF CUST_B

R1

conf t
vrf definition CUST_A
address-family ipv4
exit-address-family
!
vrf definition CUST_B
address-family ipv4
exit-address-family
!
interface GigabitEthernet0/1
 description CUST_A LAN
 vrf forwarding CUST_A
 ip address 10.1.1.1 255.255.255.0
 no shutdown
!
interface GigabitEthernet0/2
 description CUST_B LAN
 vrf forwarding CUST_B
 ip address 10.1.1.1 255.255.255.0
 no shutdown
 end

This would not work in one global routing table, because the router would have duplicate connected routes. With VRFs, each table can have its own 10.1.1.0/24 route.

Verify

show ip route vrf CUST_A connected
show ip route vrf CUST_B connected
ping vrf CUST_A 10.1.1.10
ping vrf CUST_B 10.1.1.10

The two pings are different because they happen in different routing tables.

Route leaking

Sometimes you need controlled communication between VRFs. That is called route leaking.

For ENCOR, focus first on separation. If a question introduces shared services, internet access, or management reachability, then think about controlled leaking using static routes, routing protocols, or platform-specific features.

Basic idea:

BLUE needs a route to shared DNS.
RED needs a route to shared DNS.
BLUE and RED do not need routes to each other.

Do not leak routes casually. Leaking removes part of the isolation you created.

Troubleshooting checklist

  1. Is the interface in the expected VRF?
show run interface gi0/1
show ip interface brief vrf BLUE
  1. Is the route in the expected VRF table?
show ip route vrf BLUE
  1. Did you accidentally check the global table?
show ip route
  1. Are you using VRF-aware ping/traceroute?
ping vrf BLUE 10.10.10.10
traceroute vrf BLUE 10.10.10.10
  1. Did applying the VRF remove the interface IP address?
show run interface gi0/1

Exam traps

  • show ip route checks the global table, not a VRF table.
  • Use ping vrf NAME, not a normal ping, when testing from the router.
  • Interfaces belong to VRFs; routes follow the interface into that VRF.
  • VRF-Lite does not require MPLS.
  • A VRF is Layer 3 separation. A VLAN is Layer 2 separation.
  • Applying vrf forwarding can clear the interface IP address on many platforms.

Quick check

  1. What does a VRF separate?
  2. Why can two VRFs contain the same subnet?
  3. What command shows routes in VRF BLUE?
  4. Why might a normal ping fail while ping vrf BLUE succeeds?
  5. What is route leaking, and why should it be controlled?