VRFs and MPLS Layer 3 VPNs: route distinguishers, route targets and MP-BGP

VRFs: several routers in one

A Virtual Routing and Forwarding (VRF) instance is a separate routing table and forwarding table inside one router. Interfaces are assigned to a VRF, and packets arriving on them are routed only using that VRF's table. Two VRFs can use the same addresses without conflict.

Used on its own, this is called VRF-lite: for example, a hospital keeps medical devices, staff and guest traffic in separate VRFs across its campus, with separate VLAN sub-interfaces or links between devices for each VRF. It gives strong separation but needs per-VRF configuration on every hop, so it scales poorly beyond a few devices.

vrf definition GUEST
 address-family ipv4
interface GigabitEthernet0/1.30
 encapsulation dot1Q 30
 vrf forwarding GUEST
 ip address 10.30.0.1 255.255.255.0
show ip route vrf GUEST
ping vrf GUEST 10.30.0.20

Note that vrf forwarding removes any IP address already on the interface, so add the address afterwards.

MPLS L3VPN: the building blocks

A provider wants to give hundreds of customers private networks between their sites over one core. In an MPLS Layer 3 VPN (RFC 4364):

• Each PE has a VRF per customer. CE routers exchange routes with their VRF using static routes or a routing protocol.
• PEs exchange customer routes with each other using MP-BGP in the VPNv4 address family, usually through route reflectors.
• P routers only run the IGP and LDP. They never see customer routes.

Route distinguishers and route targets

Two customers might both use 10.1.0.0/16. To keep the routes apart in BGP, the PE adds a 64-bit route distinguisher (RD), such as 64500:101, making a 96-bit VPNv4 prefix. The RD only makes prefixes unique; it does not decide who receives them.

Route targets (RTs) do that. They are extended communities attached when a route is exported from a VRF; a VRF imports any route carrying one of its import RTs. For a simple VPN, every site of a customer exports and imports the same RT. More complex designs, such as hub-and-spoke or shared services, use different import and export RTs.

Forwarding with two labels

The ingress PE pushes two labels. The inner VPN label was advertised by the egress PE in MP-BGP. The outer transport label comes from LDP and leads to the egress PE's loopback, which is the BGP next hop. P routers swap only the outer label. The egress PE uses the inner label to pick the right VRF and forwards the packet to the CE.

A minimal PE configuration

vrf definition CUST-A
 rd 64500:101
 address-family ipv4
  route-target export 64500:101
  route-target import 64500:101
interface GigabitEthernet0/2
 vrf forwarding CUST-A
 ip address 172.16.1.1 255.255.255.252
router bgp 64500
 neighbor 10.255.0.9 remote-as 64500
 neighbor 10.255.0.9 update-source Loopback0
 address-family vpnv4
  neighbor 10.255.0.9 activate
  neighbor 10.255.0.9 send-community extended
 address-family ipv4 vrf CUST-A
  neighbor 172.16.1.2 remote-as 65010
  neighbor 172.16.1.2 activate

Verify with show bgp vpnv4 unicast all, show ip route vrf CUST-A and show mpls forwarding-table vrf CUST-A.

Real-world example: a national provider's engineer onboarded a new customer, a chain of dental practices, using the same 10.0.0.0/8 range as an existing law-firm customer. Both used the provider's MPLS VPN service. Because each customer had its own VRF, RD and RT on the PE routers, the overlap caused no problem. When a junior engineer accidentally typed the law firm's import RT into one dental practice VRF, that VRF began receiving the law firm's routes; a change review caught it before traffic flowed, and the team added an automated RT check to their provisioning scripts.