Cisco IOS
VRF / VRF-Lite Guide
Understand VRFs with a simple config generator for single-VRF spoke designs over DMVPN
What is a VRF?
Virtual Routing and Forwarding (VRF) lets a single router hold multiple completely separate routing tables at the same time. Think of it as running several independent routers inside one physical box.
- Each VRF has its own interfaces, routing table, and default gateway.
-
The same IP network (e.g.
10.0.0.0/24) can be reused in different VRFs without conflict. - Traffic in one VRF stays completely isolated from other VRFs unless you explicitly leak routes between them.
- Used without MPLS this is called VRF-Lite — very common on Cisco branch and campus routers.
VRF vs VLAN
| Feature | VLAN | VRF |
|---|---|---|
| OSI Layer | Layer 2 — switch / broadcast domain | Layer 3 — IP routing table instance |
| What it separates | MAC broadcasts and switch ports | IP routing, subnets, and default routes |
| Typical example | VLAN 10 Users, VLAN 20 Voice | VRF PROD, VRF MGMT, VRF GUEST |
| Used together? | Yes — the SVI for VLAN 10 can live inside VRF PROD so users in VLAN 10 use the PROD routing table and default gateway. | |
For VLAN config use the VLAN Config Generator. For WAN/VPN background see WAN & VPN Services and Network Types in this toolkit.
Common VRF Use Cases
VRF-Lite on Campus
Split management, users, and guest into separate VRFs on the same distribution router or
firewall.
WAN / DMVPN Segmentation
Run a DMVPN tunnel per VRF so production and management traffic stay separate over the same
physical WAN.
Per-Customer VPN
Each customer gets its own VRF — overlapping RFC1918 addresses are no problem because
each VRF is isolated.
Show & Verify Commands
| Command | Purpose |
|---|---|
| show vrf | List all VRFs, interfaces assigned, and state |
| show vrf detail | Full VRF details including RD, RT, and interfaces |
| show ip route vrf NAME | Routing table for a specific VRF |
| show ip interface brief | Verify interface VRF assignment and IP |
| ping vrf NAME x.x.x.x | Ping sourced from inside a specific VRF |
| traceroute vrf NAME x.x.x.x | Traceroute inside a specific VRF |
| show ip eigrp vrf NAME neighbors | EIGRP neighbors inside a VRF |
| show ip bgp vpnv4 vrf NAME | BGP prefixes for a specific VRF (MPLS/VPNv4) |
Simple VRF Config — Single VRF Per Spoke
Creates one VRF, binds an access VLAN SVI and your DMVPN tunnel interface into it, adds an optional default route, and drops in a routing protocol stub. This matches the build tunnels first, then specify VRFs at the spokes design.
conf t
!
vrf definition PROD
rd 65000:10
route-target export 65000:10
route-target import 65000:10
address-family ipv4
exit-address-family
exit
!
interface Vlan10
description Users SVI in VRF PROD
vrf forwarding PROD
ip address 10.10.10.1 255.255.255.0
no shutdown
!
interface Tunnel0
description DMVPN Tunnel in VRF PROD
vrf forwarding PROD
! Re-apply tunnel IP after vrf forwarding
no shutdown
!
ip route vrf PROD 0.0.0.0 0.0.0.0 10.255.0.1
!
router eigrp 100
address-family ipv4 vrf PROD
autonomous-system 100
network 0.0.0.0
af-interface Tunnel0
no shutdown
exit-af-interface
exit-address-family
!
end
! copy running-config startup-configNext Steps
- Use the DMVPN Generator to build matching hub/spoke tunnel configs — ensure the tunnel interface is placed in VRF PROD.
- Use BGP & EIGRP to fine-tune routing inside this VRF (neighbors, auth, timers).
- Use the VLAN Config Generator for additional SVIs that should also live in VRF PROD.
VRF + VLAN + EIGRP + DMVPN Flow
How a VLAN on the access switch, a VRF on the spoke router, EIGRP, and a DMVPN tunnel all work together in your single-VRF-per-spoke design.
+-------------------+ 802.1Q Trunk +-------------------------------+
| Access Switch | | Spoke Router |
| | | |
| [VLAN 10 Users]--+-------------------+ interface Vlan10 |
| [VLAN 20 Voice] | | vrf forwarding PROD |
+-------------------+ | ip address 10.10.10.1 /24 |
| (default GW for users) |
| |
| interface Tunnel0 |
| vrf forwarding PROD |
| ip nhrp nhs <hub> |
| tunnel mode gre multipoint |
| |
| router eigrp 100 |
| address-family ipv4 vrf PROD|
| (advertises Vlan10 subnet) |
+---------------+---------------+
|
DMVPN / mGRE
(over Internet
or private WAN)
|
+---------------+---------------+
| Hub Router |
| |
| interface Tunnel0 |
| vrf forwarding PROD |
| tunnel mode gre multipoint |
| ip nhrp map multicast dyn |
| |
| router eigrp 100 |
| address-family ipv4 vrf PROD|
| (learns all spoke subnets) |
+-------------------------------+
Step-by-step:
- Step 1 — Users connect to VLAN 10 on the access switch. Trunk carries VLAN 10 to the spoke router.
- Step 2 — The spoke router has a Vlan10 SVI placed inside VRF PROD. This SVI is the users default gateway.
- Step 3 — Tunnel0 (DMVPN mGRE) is also placed inside VRF PROD. Both the SVI and the tunnel share the same routing table.
- Step 4 — EIGRP runs inside VRF PROD and advertises the Vlan10 subnet across the DMVPN tunnel to the hub.
- Step 5 — The Hub Router has a matching VRF PROD with its own Tunnel0 and EIGRP address-family. It learns all spoke subnets dynamically.
️ Key rule: When you add
vrf forwarding PROD to an existing interface, IOS removes the IP address
automatically. Always re-apply the IP after binding the VRF.
Use the DMVPN Generator for tunnel config • BGP & EIGRP for address-family routing • VLAN Config Generator for VLANs and SVIs.