Network virtualisation on routers: VRF-lite, Cisco EVN and LISP

What a VRF is

A router normally has one routing table. Virtual routing and forwarding (VRF) creates extra, independent routing tables on the same device. Each interface belongs to exactly one VRF, or to the global table. Traffic in one VRF cannot reach another unless you deliberately leak routes between them, and two VRFs can even use the same IP addresses. It is like having several routers in one box.

Service providers use VRFs with MPLS and BGP to build layer 3 VPNs for customers. VRF-lite means using VRFs on their own, without MPLS, which is common in enterprises for separating guest, IoT, building management or acquired networks.

Configuring VRF-lite

vrf definition GUEST
 address-family ipv4
 exit-address-family
interface GigabitEthernet0/0.50
 encapsulation dot1Q 50
 vrf forwarding GUEST
 ip address 192.168.50.1 255.255.255.0
interface GigabitEthernet0/2.50
 encapsulation dot1Q 50
 vrf forwarding GUEST
 ip address 10.250.0.1 255.255.255.252
ip route vrf GUEST 0.0.0.0 0.0.0.0 10.250.0.2
router ospf 50 vrf GUEST
 network 192.168.50.0 0.0.0.255 area 0
show ip route vrf GUEST
ping vrf GUEST 10.250.0.2

Putting an interface into a VRF removes its IP address, so assign the VRF first, then the address. Older software uses ip vrf GUEST and ip vrf forwarding GUEST. Most commands that deal with routing, such as ping, traceroute and show, need the vrf keyword, which is the most common source of "it does not work" confusion. To carry several VRFs between two routers with VRF-lite, use one sub-interface (or VLAN) per VRF on the link, each with its own routing protocol instance or static routes.

Sometimes VRFs need to share something, such as a DHCP or DNS server. This is route leaking, done with static routes pointing into another VRF or with BGP import and export rules. Keep leaking to a minimum and control it with a firewall where possible.

Cisco Easy Virtual Network (EVN)

With VRF-lite, every link between routers needs one sub-interface, one subnet and one routing configuration per VRF. With ten VRFs and twenty links, that is a lot of configuration. Easy Virtual Network (EVN) was a Cisco simplification: each VRF is given a VNET tag, and a single VNET trunk interface carries all VRFs, creating the sub-interfaces automatically.

vrf definition GUEST
 vnet tag 101
 address-family ipv4
 exit-address-family
interface GigabitEthernet0/1
 vnet trunk
 ip address 10.0.12.1 255.255.255.252

EVN was only supported on certain platforms and releases and is now rarely deployed. Large campuses now tend to use fabric technologies, such as BGP EVPN or SD-Access, to carry virtual networks instead.

LISP: separating identity from location

An IP address normally says both who a device is and where it is. When a device moves, its address must change or routes must follow it. The Locator/ID Separation Protocol (LISP, RFC 9300 and RFC 9301) splits these roles:

• EID (endpoint identifier): the address of the host, which stays the same wherever it goes.
• RLOC (routing locator): the address of the router at the site where the host currently lives.
• Map server and map resolver: a database that records which RLOC each EID is behind, and answers queries.
• ITR and ETR: ingress and egress tunnel routers that look up the mapping and encapsulate traffic between sites.

A router sending to an EID asks the map resolver for the current RLOC, caches the answer and tunnels traffic to that RLOC. If the host moves, only the mapping changes. LISP is the control plane of Cisco SD-Access campus fabrics, where it tracks where every endpoint is attached (see network planes and SDN).

Real-world example: a hotel group's network team needed to keep guest Wi-Fi, payment terminals and the building management system apart on each site's single core switch. They created three VRFs, each with its own default route: guests straight to the internet, payments to the firewall's PCI zone and building management to a VPN for the maintenance contractor. When a guest's device scanned the network, it could only see guest addresses, because the core switch simply had no route from the guest VRF to the others.