Course contents

Module 5: Scaling and OperationsLesson 5.7 (7 of 7 in this module)37 of 43 in the BGP course

BGP with VRF-Lite

One router can keep several completely separate routing tables. VRF-Lite does this without MPLS. With BGP inside a VRF, one router can serve several customers or tenants, even if they use the same addresses.

Advanced · 13 min read

You'll learn to define a VRF, assign an interface to it, configure BGP in the VRF address family, and verify with the vrf keyword.

Several routing tables on one router

A VRF (virtual routing and forwarding instance) is a separate routing table with its own interfaces. Two VRFs can contain 198.51.100.0/24 at the same time without clashing. VRF-Lite uses VRFs without MPLS: each VRF is joined to the next router over its own link or VLAN sub-interface.

BGP with VRF-Lite: two customers, two separate tables on one router
BGP with VRF-Lite: two customers, two separate tables on one routerR1 in AS 64500 has two VRFs. VRF CUST-A peers with CE-A in AS 65010. VRF CUST-B peers with CE-B in AS 65020. Each VRF has its own routing table and BGP table, so both customers can use 10.10.10.0/24.R1, AS 64500VRF CUST-Aown routing tableown BGP tableVRF CUST-Bown routing tableown BGP tableCE-AAS 65010CE-BAS 65020eBGPeBGPBoth customers use10.10.10.0/24.The VRFs keep themseparate.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each VRF is a separate routing table on the same hardware. The BGP session lives inside one VRF and never sees the other.
Two VRFs on one router, each with its own BGP session
Two VRFs on one router, each with its own BGP sessionR1 has two VRFs. VRF RED connects to customer CE-RED at 192.0.2.10, and VRF BLUE connects to customer CE-BLUE at 192.0.2.14 on a different link. Each VRF has its own routing table and its own BGP address family, so the same prefix can exist in both without a clash. Routes learned in one VRF are never visible in the other.R1 (one router)VRF REDown routing tableown BGP sessionVRF BLUEown routing tableown BGP sessionCE-RED192.0.2.10CE-BLUE192.0.2.14Same prefixcan exist in bothno clashaddress-family ipv4 vrf RED / address-family ipv4 vrf BLUE

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each neighbour is configured under its VRF address family. The same prefix can exist in both VRFs without clashing.

Configure the VRF and its BGP session

In this example R1 serves a customer (AS 64510) in a VRF called CUST-A. The customer link is a new interface in the VRF; the course ISP links stay in the global table.

Order of configuration
Order of configurationCreate the VRF, place the interface, then configure BGP under the VRF.vrf definitioncreates the tableinterface vrfforwardingip addressafter the VRFaddress-family ipv4vrf under BGP

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Moving an interface into a VRF removes its address, so set the address afterwards.
vrf definition CUST-A rd 64500:1 address-family ipv4 exit-address-family interface GigabitEthernet0/3 vrf forwarding CUST-A ip address 192.0.2.9 255.255.255.252 no shutdown

R1. Creating the VRF and assigning the interface removes any address already on the interface, so set the address after vrf forwarding.

router bgp 64500 address-family ipv4 vrf CUST-A neighbor 192.0.2.10 remote-as 64510 neighbor 192.0.2.10 activate exit-address-family

BGP configuration for the neighbour goes under the VRF address family, not the global one.

Verify with the vrf keyword

Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show bgp vrf CUST-A ipv4 unicast summary
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.0.2.10    4        64510       9       9        3    0    0 00:03:12        1
The session is Established inside the VRF and one prefix was received. Plain show ip bgp summary would not show this neighbour because it lives in a different table.

Other commands take the same keyword: show ip route vrf CUST-A and ping vrf CUST-A 192.0.2.10. A common beginner error is a ping that fails only because the VRF name was left out.

Verification commands that need vrf
Verification commands that need vrfWithout the vrf keyword the global table is read.show ip bgp vpnv4 vrf <name>The BGP table for that VRFshow ip route vrf <name>The routing table for that VRFping vrf <name> <addr>A ping from that table

On small screens, swipe sideways or focus the diagram and use the arrow keys.

If a command shows nothing, check you used the vrf form.

Technical reference: Cisco IOS XE BGP configuration guide. Output above is illustrative.

Check your understanding

Predict · scenario 1

A ping to a customer neighbour fails, but the customer interface is up. What did you probably forget?

Predict · scenario 2

Where is the BGP neighbour for a VRF configured?

Predict · scenario 3

You add vrf forwarding to an interface that has an IP address. What happens?

FAQ

What is the difference between VRF-Lite and MPLS VPN?
VRF-Lite keeps separate tables on one router and relies on separate links or sub-interfaces to carry each VRF between routers. MPLS VPN adds labels and MP-BGP to carry many VRFs over one shared core.
What is a route distinguisher for in VRF-Lite?
It makes routes in a VRF unique. Cisco IOS XE requires one for the BGP VRF address family. With VRF-Lite it is a local identifier only.
Why do ping and show ip route need a vrf keyword?
Without the keyword the commands use the global table. A VRF has its own table, so you must name it to see its routes or test its reachability.