Skip to content
Study CCNP

2.2.a VRF

4 min read ENCOR 350-401 v1.2 Updated

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this objective tests

This is a configure-and-verify objective. The exam wants you to build Virtual Routing and Forwarding (VRF) instances, assign interfaces, and prove the tables stay separate.

A VRF is a separate routing table on the same router or Layer 3 switch. One device routes for multiple logical networks. Each VRF keeps its routes separate from the others. Enterprise networks use VRF-Lite to separate departments, tenants, or management traffic without extra physical routers. VRF-Lite does not require MPLS.

How a VRF works

Without VRFs, a router has one global routing table. With VRFs, the same router has one table per VRF plus the global table.

Interface Gi0/1 -> VRF BLUE -> BLUE routing table
Interface Gi0/2 -> VRF RED  -> RED routing table

Interfaces belong to a VRF. Connected and learned routes on that interface enter the table of that VRF. Traffic in BLUE does not see routes in RED. That isolation is the point.

A VLAN is not a VRF. A VLAN separates Layer 2 broadcast domains. A VRF separates Layer 3 routing tables. You often use both together: an SVI for VLAN 10 in VRF BLUE, an SVI for VLAN 20 in VRF RED.

Warning: On many IOS platforms, vrf forwarding on an interface removes the existing IP address. Configure the VRF first, then the IP address.

Example: two VRFs on one router

Scenario: R1 serves two departments. BLUE uses 10.10.10.0/24 on Gi0/1 and upstream 192.0.2.0/30 on Gi0/3. RED uses 10.20.20.0/24 on Gi0/2 and upstream 198.51.100.0/30 on Gi0/4. Each VRF has its own default route.

R1 configuration:

vrf definition BLUE
 description BLUE department
 address-family ipv4
 exit-address-family
!
vrf definition RED
 description RED department
 address-family ipv4
 exit-address-family
!
interface GigabitEthernet0/1
 description BLUE LAN
 vrf forwarding BLUE
 ip address 10.10.10.1 255.255.255.0
 no shutdown
!
interface GigabitEthernet0/2
 description RED LAN
 vrf forwarding RED
 ip address 10.20.20.1 255.255.255.0
 no shutdown
!
interface GigabitEthernet0/3
 description BLUE upstream
 vrf forwarding BLUE
 ip address 192.0.2.1 255.255.255.252
 no shutdown
!
interface GigabitEthernet0/4
 description RED upstream
 vrf forwarding RED
 ip address 198.51.100.1 255.255.255.252
 no shutdown
!
ip route vrf BLUE 0.0.0.0 0.0.0.0 192.0.2.2
ip route vrf RED 0.0.0.0 0.0.0.0 198.51.100.2

Expected show ip vrf output:

R1# show ip vrf
  Name                             Default RD            Interfaces
  BLUE                             <not set>             Gi0/1
                                                         Gi0/3
  RED                              <not set>             Gi0/2
                                                         Gi0/4

Each interface appears under exactly one VRF. No interface appears in two VRFs.

Expected show ip route vrf BLUE output:

R1# show ip route vrf BLUE
Routing Table: BLUE
Gateway of last resort is 192.0.2.2 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 192.0.2.2
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.10.10.0/24 is directly connected, GigabitEthernet0/1
L        10.10.10.1/32 is directly connected, GigabitEthernet0/1
      192.0.2.0/30 is subnetted, 1 subnets
C        192.0.2.0 is directly connected, GigabitEthernet0/3

The BLUE table contains only BLUE routes. The RED routes do not appear. The global table, shown by show ip route, contains none of these routes.

Reachability tests must name the VRF:

R1# ping vrf BLUE 192.0.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.0.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5)

A plain ping 192.0.2.2 uses the global table and fails. That failure is expected, not a fault.

Route leaking

Route leaking is controlled communication between VRFs. Sometimes two VRFs must share a service, such as a DNS server or internet access.

For ENCOR, know the idea:

  • BLUE needs a route to the shared DNS server.
  • RED needs a route to the shared DNS server.
  • BLUE and RED still do not get routes to each other.

Leaking uses static routes between tables, routing protocol import, or platform features. Leak only what the design requires. Every leaked route removes part of the isolation you built.

Lab: overlapping subnets in two VRFs

Goal

Prove that two customers can use the same subnet on one router.

Topology

PC-A 10.1.1.10/24 -- R1 Gi0/1 (VRF CUST_A, 10.1.1.1/24)
PC-B 10.1.1.10/24 -- R1 Gi0/2 (VRF CUST_B, 10.1.1.1/24)

One global table cannot hold two identical connected routes. Two VRFs can.

Do these steps:

  1. Configure R1 with the full config below.
  2. Run show ip vrf and confirm both interfaces appear.
  3. Run show ip route vrf CUST_A connected and show ip route vrf CUST_B connected.
  4. Ping 10.1.1.10 in VRF CUST_A.
  5. Ping 10.1.1.10 in VRF CUST_B.
  6. Run show ip route and confirm the global table has no 10.1.1.0/24 route.

R1 config:

vrf definition CUST_A
 address-family ipv4
 exit-address-family
!
vrf definition CUST_B
 address-family ipv4
 exit-address-family
!
interface GigabitEthernet0/1
 description CUST_A LAN
 vrf forwarding CUST_A
 ip address 10.1.1.1 255.255.255.0
 no shutdown
!
interface GigabitEthernet0/2
 description CUST_B LAN
 vrf forwarding CUST_B
 ip address 10.1.1.1 255.255.255.0
 no shutdown

Verification commands:

show ip vrf
show ip route vrf CUST_A connected
show ip route vrf CUST_B connected
ping vrf CUST_A 10.1.1.10
ping vrf CUST_B 10.1.1.10
show ip route

Expected results:

  • Each VRF table shows its own connected 10.1.1.0/24 route.
  • Both pings succeed. They use different tables, so they reach different PCs.
  • The global table has no 10.1.1.0/24 route. Isolation is proven.

Troubleshooting checklist

  1. Is the interface in the expected VRF? Check with show ip vrf and show run interface gi0/1.
  2. Is the route in the expected VRF table? Check with show ip route vrf BLUE.
  3. Did you check the global table by mistake? show ip route is not a VRF table.
  4. Are you using VRF-aware tools? Use ping vrf BLUE and traceroute vrf BLUE.
  5. Did vrf forwarding remove the IP address? Check with show run interface gi0/1 and re-enter the address.

Exam traps

  • show ip route checks the global table, not a VRF table.
  • Use ping vrf NAME when you test from the router.
  • Interfaces belong to VRFs. Routes follow the interface.
  • VRF-Lite does not require MPLS.
  • A VRF is Layer 3 separation. A VLAN is Layer 2 separation.
  • Applying vrf forwarding can clear the interface IP address.

Pass check

You are ready for this objective when you can do these things:

  • Configure a VRF and assign an interface in the correct order.
  • Read show ip vrf and map interfaces to VRFs.
  • Read show ip route vrf NAME and explain each route type.
  • Prove isolation between two VRFs with overlapping subnets.
  • Explain what route leaking is and why it must be controlled.

Related objectives