VRF

Virtual Routing and Forwarding (VRF) is a technology used in computer networks that allows multiple instances of a routing table to co-exist within the same router at the same time. Because the routing instances are independent, the same or overlapping IP addresses can be used without conflicting with each other.

VRF may be implemented in a network device by having distinct routing tables, also known as Forwarding Information Bases (FIBs), one per VRF. Alternatively, a network device may have the ability to configure different virtual routers, where each one has its own FIB that is not accessible to any other virtual router instance on the same device.

The simplest form of VRF implementation is VRF Lite. In this implementation, each router within the network participates in the virtual routing environment in a peer-based fashion. While simple to deploy and appropriate for small to medium enterprises and shared data centres, VRF Lite does not scale to the size required by global enterprises or large carriers due to the need to implement each VRF instance on every router.

The scaling limitations of VRF Lite are resolved by the implementation of IPVPNs. In this implementation, a core backbone network is responsible for the transmission of data across the wide area between VRF instances at each edge location. IPVPNs have been traditionally deployed by carriers to provide a shared wide-area backbone network for multiple customers however they are also appropriate in large enterprise, multi-tenant and shared data centre environments.

In a typical deployment, Customer Edge (CE) routers handle local routing in a traditional fashion and disseminate routing information into Provider Edge (PE) where the routing tables are virtualised. The PE router then encapsulates the traffic, marks it to identify the VRF instance, and transmits it across the provider backbone network to the destination PE router. The destination PE router then un-encapsulates the traffic and forwards it to the CE router at the destination.

The backbone network is completely transparent to the customer equipment, allowing multiple customers or user communities to utilise the common backbone network while maintaining end-to-end traffic separation.

Routes across the provider backbone network are maintained using an Interior Gateway Protocol. Typically iBGP is used due to its ability to use extended community attributes to identify the different customers' routes (which may have overlapping IP schemes) within a single common routing table.

IPVPN is most commonly deployed across a Multiprotocol Label Switching (MPLS) backbone as the inherent labelling of packets in MPLS lends itself to the identification of the customer VRF. Some IPVPN implementations (notably Nortel's IPVPN Lite) utilise a simpler IP-in-IP encapsulation over a pure IP backbone, eliminating the need to maintain and support an MPLS environment.

External links

* [http://www.cisco.com/en/US/docs/net_mgmt/vpn_solutions_center/1.1/user/guide/VPN_UG1.html Cisco document on MPLS & VRF]

* [http://www.juniper.net/techpubs/software/junos/junos85/swconfig85-vpns/frameset.html Latest Juniper documentation on configuring VPNs and VRFs]

* [http://support.nortel.com/go/main.jsp?cscat=DOCDETAIL&id=731425&poid=9015 Nortel IP Routing documentation (covering VRF Lite)]

* [http://support.nortel.com/go/main.jsp?cscat=DOCDETAIL&id=731634&poid=9015 Nortel IPVPN and IPVPN Lite Configuration documentation]