Cisco IOS VRF Lite Configuration Guide

A router normally maintains a single global routing table shared by every interface. VRF (Virtual Routing and Forwarding) breaks that assumption: each VRF gets its own fully independent routing and forwarding table, invisible to the global table and to every other VRF. VRF lite is the plain-IP version of this technology - no MPLS, no MP-BGP - used on a single router or a chain of routers to keep customer A and customer B completely separate, even when they use overlapping IP space. This guide walks through VRF definition, interface binding, per-VRF static routing and the verification commands, including the interface-assignment pitfall that clears your IP address.

VRF Lite vs MPLS L3VPN

Step 1: Define the VRF

Classic IOS uses ip vrf; newer IOS XE supports the vrf definition form with explicit address families. Both are shown:

Router(config)# ip vrf CUSTOMER-A
Router(config-vrf)# description Customer A routing domain
Router(config-vrf)# exit

! IOS XE modern syntax
Router(config)# vrf definition CUSTOMER-A
Router(config-vrf)# address-family ipv4
Router(config-vrf-af)# exit-address-family

Step 2: Assign an Interface to the VRF

Critical: ip vrf forwarding must come BEFORE ip address, because binding an interface to a VRF clears any IP address already configured on it:

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip vrf forwarding CUSTOMER-A
Router(config-if)# ip address 10.0.0.1 255.255.255.0

Overlapping addresses between customers are now legal, because each VRF is an isolated table: both CUSTOMER-A and CUSTOMER-B can use 10.0.0.0/24 on their own interfaces.

Step 3: Add Routes Inside the VRF

Static routes, routing protocols and even ping must name the VRF explicitly:

Router(config)# ip route vrf CUSTOMER-A 0.0.0.0 0.0.0.0 203.0.113.1
Router(config)# router ospf 100 vrf CUSTOMER-A
Router# ping vrf CUSTOMER-A 10.0.0.2

Verifying VRFs

Router# show ip vrf
Router# show ip route vrf CUSTOMER-A
Router# show ip vrf interfaces

show ip vrf lists every VRF and the interfaces bound to it; show ip route vrf displays only that VRF's routing table. With all interfaces inside VRFs, the global table's connected routes disappear - that is normal, and it is exactly why the management interface is usually left in the global table.

Use Cases

• Multi-tenant CPE and aggregation routers with overlapping customer addressing.
• Separating production, management and guest traffic on one router.
• Lab replication of MPLS VPN designs without the MPLS core.

Related articles: Linux network namespaces (the Linux equivalent of VRF separation) and Dell OS10 out-of-band management VRF.

原文链接：https://networklessons.com/mpls/vrf-lite-configuration-on-cisco-ios