# VRF-Lite and Multi-Protocol BGP

> Chapter 10 of the Courseiva ENARSI curriculum — https://courseiva.com/learn/enarsi/vrf-lite-and-multi-protocol-bgp

**Official objective:** 2.1 — Configure and verify VRF-Lite and MP-BGP

## Introduction

If you do not grasp VRF-Lite and Multi-Protocol BGP, you will fail the 300-410 exam because half of the enterprise routing questions assume you can keep traffic from different customers or departments completely separate inside the same physical router. Large companies, internet service providers, and data centres routinely use these technologies to avoid buying a separate router for every customer. VRF-Lite creates virtual routers inside one physical box, and MP-BGP ensures those virtual routers can exchange routing information safely without leaking data between them.

## The Apartment Block Mailroom Analogy

300 tenants live in a single apartment block. Each tenant occupies a different flat, but they all share the same building address and the same mailroom. Now imagine the post office delivers 10,000 letters every day, all addressed to different flats. The mailroom sorter has to look at each letter, see the flat number, and put it into the correct pigeonhole. If the sorter gets it wrong, a tenant receives someone else's post — a privacy disaster.

Now consider this: the building is owned by a property management company that also owns two other blocks across the street, each with its own tenants and mailrooms. The management company wants to allow tenants in all three buildings to send parcels to each other, but it must never mix up parcels from different buildings. Each building's mailroom has its own set of pigeonholes, and the inter-building courier carries a label on every parcel that says which building it came from. The courier cannot read the flat number until it has checked the building label. This is VRF-Lite and MP-BGP. VRF-Lite creates separate mailrooms (routing tables) inside one router, so that different customers or departments never see each other's traffic. MP-BGP is the courier that carries extra labels (address-family information) so that routes from one VRF can be shared with another without confusion.

## Core explanation

Let us start with the core problem that VRF-Lite solves. Imagine you work for an Internet Service Provider (ISP). You have 100 business customers, and each customer wants their own private network. Without VRF-Lite, you would need 100 separate physical routers, one per customer, which is expensive and messy to manage. VRF stands for Virtual Routing and Forwarding. Think of a VRF as a virtual router inside a real router. Each VRF has its own routing table — that is the list of directions the router uses to decide where to send packets. Each VRF also has its own interfaces — the physical or virtual ports that connect to cables. This means that traffic in VRF A never sees VRF B, even though both live in the same hardware.

VRF-Lite is the simplified version of VRF that does not use Multi-Protocol Label Switching (MPLS). MPLS is a more advanced, carrier-grade technology. VRF-Lite is exactly what it says on the tin: a lightweight VRF implementation that runs on a single router without needing MPLS. You configure it by creating a VRF definition, assigning interfaces to it, and then configuring routing protocols inside each VRF independently. For example, you can have OSPF (Open Shortest Path First, a routing protocol) running inside VRF Customer-A and a different OSPF process inside VRF Customer-B. The two customers never interfere.

Now we introduce MP-BGP. BGP stands for Border Gateway Protocol. It is the protocol that makes the internet work — it exchanges routing information between different networks. Regular BGP only handles IPv4 routes. But what about IPv6, VPN routes, or routes that belong to a specific VRF? That is where Multi-Protocol BGP (MP-BGP) comes in. MP-BGP extends the original BGP by adding address families. An address family is simply a label that tells BGP what type of route it is carrying: IPv4 unicast, IPv6 unicast, VPN-IPv4 (for VRF routes), and so on. When MP-BGP carries a VPN-IPv4 route, it attaches a Route Distinguisher (RD) — a 8-byte number that makes the route globally unique — and one or more Route Targets (RTs), which are tags that tell routers which VRF should import that route.

Why does this matter for VRF-Lite? On its own, VRF-Lite keeps VRFs isolated on one router. But if you have two routers, say Router A and Router B, and each has a VRF called Customer-X, those VRFs cannot talk to each other unless you either: (a) run a separate routing protocol instance between the two routers for each VRF, or (b) use MP-BGP to exchange VRF routes between routers. Option (b) is simpler and scales far better. MP-BGP acts as the inter-router messenger. It carries routes with their RD and RT labels. When Router A learns a route for Customer-X, it injects it into MP-BGP with a specific RT. Router B, configured to import routes that carry that RT, receives the route and places it into its own Customer-X VRF. The two VRFs on different routers now act like a single virtual network.

A key feature of MP-BGP for VRF-Lite is that it uses the BGP next-hop mechanism differently. In ordinary BGP, the next hop is the IP address of the router that advertises the route. In MP-BGP with VRF, the next hop can be the loopback interface of the advertising router, and the receiving router uses a route in its global table (not in the VRF) to reach that next hop. This technique avoids needing a separate routing table entry for every VRF peer. You also have to configure the BGP session to use an update-source that is reachable from the global routing table, typically a loopback interface.

Let us run through a simple configuration example. On Router A, you create a VRF called 'Blue' with an RD of 100:1 and an RT of 100:1. You assign interface Gig0/0/1 to VRF Blue. On Router B, you create VRF Blue with the same RD and RT, and assign interface Gig0/0/2 to it. Then you enable MP-BGP on both routers, enter the address-family ipv4 vrf Blue submode, and advertise the networks connected to the VRF interfaces. Router A sends these routes to Router B with the RT 100:1. Router B, because it has been told to import routes with RT 100:1 into VRF Blue, installs them. Now a PC on Router A's end of VRF Blue can ping a PC on Router B's end. Without MP-BGP, you would have to configure a separate routing protocol, like OSPF, inside each VRF across the two routers — which would require multiple routing processes and more overhead.

In summary, VRF-Lite provides the compartments, and MP-BGP provides the secure courier service between compartments on different routers. Together, they allow network engineers to build complex, multi-tenant, scalable networks without buying a truckload of hardware.

## Real-world context

An IT professional at a medium-sized managed service provider, call them Jane, has 20 enterprise clients. Each client wants a private WAN (Wide Area Network) connecting three branch offices. Jane cannot afford to buy 20 routers for each client — she has one pair of powerful Cisco ASR 1000 routers at the head office. She uses VRF-Lite to create 20 VRFs, one per client. She labels them VRF-AcmeCorp, VRF-GlobalTech, and so on. Each VRF has its own routing table, and each branch office connection goes into the correct VRF.

Now Jane needs the client's branch offices to talk to each other. The branch routers are different models and are not VRF-capable in the same way. She enables MP-BGP between the head office routers and each branch router. She configures MP-BGP address-family ipv4 vrf AcmeCorp on the head office router and does the same on the branch router. The branch router sees only the routes for that client. The head office router's MP-BGP process carries all 20 clients' routes, but each route is tagged with a unique Route Distinguisher and Route Target. The head office router's global routing table remains lean — it only contains routes to reach the loopback interfaces of the branch routers. All 20 clients' VRF routes are kept in separate VRFs. Jane can now add a new client by creating a VRF and a few commands.

Step by step, what Jane does:
- Creates the VRF on both head office routers: 'vrf definition ClientX' then 'rd 65000:100' and 'route-target export 65000:100' and 'route-target import 65000:100'.
- Assigns the interface that connects to the client's branch to that VRF: 'interface Gig0/0/10.100' then 'encapsulation dot1Q 100' then 'vrf forwarding ClientX' then 'ip address 10.10.10.1 255.255.255.0'.
- Configures MP-BGP on the head office router: 'router bgp 65000' then 'address-family ipv4 vrf ClientX' then 'neighbor 10.10.10.2 remote-as 65001' then 'neighbor 10.10.10.2 activate'.
- Repeats for other VRFs.

The result: each client's branch network is completely isolated from every other client, even though they share the same physical router at the head office. If a virus hits one client's network, it cannot spread to another client. If a client's routing table grows huge, it does not affect the performance of other clients. Jane's company saves money on hardware, power, and rack space, and the network is far simpler to manage than 20 separate physical routers.

## Exam focus

The 300-410 exam loves to test VRF-Lite and MP-BGP together. Specifically, it tests whether you understand that VRF-Lite is the feature that creates separate routing tables on a single router, while MP-BGP is the protocol used to exchange those VRF routes between routers. The exam will present you with a scenario: a company has multiple customers or departments, and you must pick the correct configuration commands and the correct explanation of how traffic is isolated.

Key topics that appear frequently:
- Configuration of VRF-Lite: you must know the commands 'vrf definition vrf-name', 'rd route-distinguisher', 'route-target export/import', and 'interface type number vrf forwarding vrf-name'. Expect drag-and-drop or multiple-choice questions asking which command assigns an interface to a VRF.
- MP-BGP address-family mode: you need to know how to enter 'address-family ipv4 vrf vrf-name' and how to activate neighbours under that address family. Traps often involve forgetting that 'neighbor ... activate' is required inside the address family.
- Route Distinguisher vs. Route Target: many candidates mix them up. The RD makes the route globally unique. The RT decides which VRFs import/export the route. The exam will give you a scenario and ask whether the RD or RT is incorrect.
- BGP next-hop behaviour with VRFs: the exam tests that MP-BGP uses the global routing table to reach the next hop, not the VRF table. Correct answer patterns often say 'the next hop is reachable via the global routing table' or 'the VRF uses the global table to resolve the BGP next hop'.
- Differences between VRF-Lite and traditional VRF with MPLS: VRF-Lite does not need MPLS, does not support MPLS VPNs, and is limited to a single router or a pair of directly connected routers running MP-BGP. The exam will ask which scenario fits VRF-Lite.

Trap patterns:
- The exam will sometimes show a configuration where the RD is missing or mismatched between routers. They expect you to spot that routes will not be installed.
- They will give a scenario where the engineer uses 'network' command in the global BGP config instead of under the VRF address family. The correct answer is 'routes will be advertised in the global BGP table, not in the VRF'.
- They ask about 'matching Route Targets' as the requirement for VRF import. If the RTs do not match, the route is not imported, even if the RD matches.
- They may ask about the maximum number of VRFs on a platform — but the correct answer is 'platform-dependent', not a fixed number.

Key definitions to memorise:
- 'VRF-Lite: A feature that provides VRF functionality without MPLS, using MP-BGP between routers.'
- 'Route Distinguisher (RD): An 8-byte value prepended to an IPv4 prefix to make it unique across VRFs.'
- 'Route Target (RT): A BGP community used to control the import and export of VRF routes.'

## Step by step

1. **Define the VRF** — On the router, enter global configuration mode and type 'vrf definition vrf-name'. This creates a container that will hold its own routing table and forwarding rules. For VRF-Lite, you do not need to enable MPLS; just the definition is enough.
2. **Configure the Route Distinguisher and Route Targets** — Inside the VRF definition, configure 'rd 100:1' (or similar). The RD uniquely identifies the VRF routes globally. Then configure 'route-target export 100:1' and 'route-target import 100:1'. These control how routes are tagged and accepted when exchanged via MP-BGP.
3. **Assign interfaces to the VRF** — Navigate to an interface (e.g., 'interface Gig0/0/1') and type 'vrf forwarding vrf-name'. This command places that interface inside the VRF. After this, the IP address you assign to that interface belongs exclusively to the VRF's routing table.
4. **Configure MP-BGP for the VRF** — Enter BGP configuration mode ('router bgp 65000'), then enter 'address-family ipv4 vrf vrf-name'. This tells BGP to handle routes for that specific VRF. You must then advertise networks or enable neighbours inside this address family using the 'neighbor command and 'activate'.
5. **Verify VRF and MP-BGP configuration** — Use 'show vrf' to list all VRFs and their interfaces. Use 'show ip route vrf vrf-name' to see the routing table for that VRF. Use 'show bgp vpnv4 vrf vrf-name' to verify that MP-BGP has installed the correct routes. This is how you confirm traffic isolation is working.
6. **Troubleshoot route import/export issues** — If routes do not appear, check that the Route Target values match on both routers. Verify that the BGP session is established (show bgp vpnv4 vrf vrf-name neighbors). Ensure the BGP next hop is reachable via the global routing table using 'show ip route' from global config.

## Comparisons

### Route Distinguisher (RD) vs Route Target (RT)

**Route Distinguisher (RD):**
- Makes a VRF route globally unique across the network
- Configured on the VRF definition using 'rd' command
- Does not control which VRF imports the route

**Route Target (RT):**
- Controls import and export of routes between VRFs
- Configured using 'route-target export' and 'route-target import'
- Can be different from the RD number

### VRF-Lite vs Full VRF with MPLS

**VRF-Lite:**
- Does not require MPLS
- Works on a single router or directly connected routers
- Simpler configuration, lower hardware requirements

**Full VRF with MPLS:**
- Requires MPLS core infrastructure
- Designed for large-scale service provider networks
- Supports complex features like MPLS VPN and Inter-AS

### BGP (regular) vs MP-BGP

**BGP (regular):**
- Carries only IPv4 unicast routes
- Does not support VRF address families
- Does not have address-family submodes

**MP-BGP:**
- Supports multiple address families (IPv4, IPv6, VPN-IPv4, etc.)
- Required for VRF-Lite inter-router route exchange
- Uses Route Distinguishers and Route Targets

## Diagram

_Two routers each hosting two VRFs (Blue and Red) with MP-BGP exchanging routes tagged with Route Targets, and with the global routing table used for next-hop resolution._

```mermaid
flowchart TD
    A[Router A - VRF Blue] -->|MP-BGP routes with RT:100:1| B[Router B - VRF Blue]
    A --> C[Router A - VRF Red]
    B --> D[Router B - VRF Red]
    E[Customer Blue Branch 1] --> A
    F[Customer Blue Branch 2] --> B
    G[Customer Red Branch 1] --> C
    H[Customer Red Branch 2] --> D
    subgraph Global Table
        I[Loopback 0 - reachable globally]
    end
    A --> I
    B --> I
```

## Common misconceptions

- **Misconception:** VRF-Lite and VRF with MPLS are the same thing. **Reality:** VRF-Lite does not use MPLS and only works on a single router or between routers running MP-BGP directly. VRF with MPLS uses MPLS labels for traffic separation across large service provider networks. (The names sound similar, so beginners assume the 'Lite' is just a marketing term. It is actually a significant architectural difference.)
- **Misconception:** MP-BGP only works for IPv6. **Reality:** MP-BGP is designed for multiple address families, including IPv4, IPv6, VPN-IPv4 (for VRFs), and others. The 'Multi-Protocol' part means it can carry different types of routes, not just IPv6. (Many beginners hear 'Multi-Protocol' and mistakenly think it refers solely to IPv6 support, because IPv6 is often presented as a 'new protocol'.)
- **Misconception:** A Route Distinguisher (RD) controls which VRF the route goes into. **Reality:** The RD makes the route globally unique but does not control import or export. Route Targets (RTs) control which VRF imports or exports the route. (Both are numbers attached to VRF routes, and the RD is configured first, so beginners assume it is the main filter.)
- **Misconception:** You need to configure MP-BGP on every device in the network, including endpoints. **Reality:** MP-BGP runs only between routers. End devices like PCs and servers do not run BGP; they use static routes or DHCP. MP-BGP is a routing protocol for routers to exchange routes. (Because the term 'Multi-Protocol' sounds universal, beginners think every device must support it.)
- **Misconception:** VRF-Lite requires a separate IP address for each VRF on the same physical interface. **Reality:** VRF-Lite can use sub-interfaces (VLANs) on a single physical interface, each with a different IP address in a different VRF, using 802.1Q trunking. (Without knowing about sub-interfaces, beginners think you need a separate physical port for each VRF, which defeats the purpose.)

## Key takeaways

- VRF-Lite creates separate, isolated routing tables on a single physical router, allowing multiple customers to share the same hardware without seeing each other's traffic.
- MP-BGP extends BGP to carry multiple address families, including VPN-IPv4 routes, which are necessary for exchanging VRF routes between routers.
- A Route Distinguisher (RD) makes a VRF route globally unique, but it does not control routing decisions — Route Targets (RTs) do that.
- When configuring MP-BGP for VRF-Lite, you must enter the address-family ipv4 vrf vrf-name submode and activate the neighbour there.
- The BGP next hop for VRF routes is resolved using the global routing table, not the VRF table, so the inter-router link must be reachable globally.
- VRF-Lite does not use MPLS, making it simpler and cheaper than full MPLS VPN, but it is limited to smaller-scale deployments.
- Mismatched Route Targets between routers prevent VRF routes from being imported, even if the RD matches perfectly.
- VRF-Lite supports overlapping IP addresses across different VRFs because each VRF has its own routing table.
- The command 'vrf forwarding vrf-name' on an interface assigns that interface to the VRF, and the interface must be in the VRF before you assign an IP address.
- MP-BGP sessions for VRF-Lite often use loopback interfaces as the update-source to ensure reachability independent of any single physical link.

## FAQ

**What is the difference between VRF and VRF-Lite?**

VRF-Lite is a simplified VRF implementation that does not use MPLS and is designed for a single router or a pair of routers running MP-BGP. Full VRF usually implies MPLS VPN support across a service provider network.

**Do I need a separate BGP session for each VRF?**

No, you can use a single MP-BGP session that carries multiple address families. Each VRF route is tagged with an RD/RT, and the router distributes routes to the correct VRF based on RT matching.

**Can overlapping IP addresses exist in different VRFs on the same router?**

Yes, that is one of the main benefits of VRF-Lite. Because each VRF has its own routing table, two VRFs can use the same IP subnet (e.g., 10.0.0.0/24) without conflict.

**Why is my MP-BGP route not showing up in the VRF?**

The most common cause is a mismatch in Route Target import/export settings. Another cause is that the BGP neighbour is not activated under the address-family ipv4 vrf. Check both.

**What does 'neighbor activate' do under address-family mode?**

It enables BGP to exchange routes with that neighbour for the specific address family. Without it, the neighbour is defined globally but does not send or receive routes for that VRF.

**Is VRF-Lite supported on all Cisco routers?**

VRF-Lite is supported on most Cisco IOS and IOS-XE devices running advanced IP services or higher feature sets. Lower-end models may have VRF-Lite limitations, so always check the platform documentation.

## Check your understanding

1. **What command assigns an interface to a VRF in Cisco IOS?**

   Answer: The command is 'vrf forwarding vrf-name' under the interface configuration mode.

2. **Which MP-BGP address family is used to exchange VRF routes between routers?**

   Answer: The address family is 'ipv4 vrf vrf-name'. For example, 'address-family ipv4 vrf CustomerA'.

3. **What is the purpose of a Route Target (RT) in MP-BGP?**

   Answer: The Route Target controls which VRFs import or export a given route. It acts as a tag that determines route distribution.

4. **Can two different VRFs on the same router use the same IP subnet?**

   Answer: Yes, because each VRF has its own separate routing table, so overlapping addresses do not conflict.

5. **What happens if the Route Target import value on Router B does not match the Route Target export value on Router A?**

   Answer: Router B will not import the VRF routes from Router A because the Route Target filter fails.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/enarsi/vrf-lite-and-multi-protocol-bgp