What is a VRF, what is VRF-lite, and how do you configure it?

Configuration on IOS-XE

vrf definition CORP
 address-family ipv4
 exit-address-family
!
vrf definition GUEST
 address-family ipv4
 exit-address-family
!
interface GigabitEthernet0/0/1.10
 encapsulation dot1Q 10
 vrf forwarding CORP
 ip address 10.10.0.1 255.255.255.0
!
interface GigabitEthernet0/0/1.50
 encapsulation dot1Q 50
 vrf forwarding GUEST
 ip address 10.50.0.1 255.255.255.0
!
interface GigabitEthernet0/0/0.550
 encapsulation dot1Q 550
 vrf forwarding GUEST
 ip address 172.16.50.1 255.255.255.252
!
ip route vrf GUEST 0.0.0.0 0.0.0.0 172.16.50.2
!
router ospf 10 vrf CORP
 capability vrf-lite
 network 10.10.0.0 0.0.0.255 area 0

Guest users get a default route toward a firewall on their own uplink VLAN, and CORP runs OSPF in its own table.

Gotchas

• vrf forwarding removes the interface's IP address. IOS warns % Interface GigabitEthernet0/0/1.50 IPv4 disabled and address(es) removed due to enabling VRF GUEST. Apply the VRF first, then the address.
• An RD is optional for VRF-lite on current IOS-XE. BGP needs one as soon as it carries the VRF.
• capability vrf-lite turns off checks OSPF does when it thinks it is on an MPLS PE. Without it, some inter-area and external routes may not be installed in a VRF-lite design.
• Every command needs the VRF: show ip route vrf GUEST, ping vrf GUEST 10.50.0.10, traceroute vrf GUEST ....
• The older ip vrf and ip vrf forwarding syntax is IPv4 only. vrf definition supports both families.

VRF-lite or MPLS L3VPN

VRF-lite needs a subinterface and a routing instance per VRF on every hop. With many VRFs or many hops, an MPLS L3VPN or EVPN core carries all VRFs over one set of links with labels, RDs and route targets.