VRF

networking

Virtual Routing and Forwarding: multiple independent routing tables on one router, so overlapping or unrelated networks never mix.

The routing sibling of the VLAN idea: virtualize the table, not just the broadcast domain.

A VRF gives a router several independent routing tables, so the same address space can exist more than once on one device without collision. It is the mechanism behind provider VPNs and behind any design that must keep tenants, environments or acquired networks separate while sharing hardware.

What it does not do is provide security by itself. Separation is a routing property, and a route leaked between VRFs, a shared services block, or a firewall configured to bridge them all reconnect what the design intended to isolate. VRFs also multiply operational complexity in a specific way: every diagnostic command needs to name the table, and a command run in the wrong VRF reports a truthful answer about the wrong network.

← All glossary entries