About Layer 3 Virtualization
Cisco NX-OS supports multiple virtual routing and forwarding instances (VRFs). Each VRF contains a separate address space with unicast and multicast route tables for IPv4 and makes routing decisions independent of any other VRF.
Each router has a default VRF and a management VRF.
Management VRF
-
The management VRF is for management purposes only.
-
Only the mgmt 0 interface can be in the management VRF.
-
The mgmt 0 interface cannot be assigned to another VRF.
-
No routing protocols can run in the management VRF (static only).
Default VRF
-
All Layer 3 interfaces exist in the default VRF.
-
Routing protocols run in the default VRF context.
-
The default VRF uses the default routing context for all show commands.
-
The default VRF is similar to the global routing table concept in Cisco IOS.
VRF and Routing
All unicast and multicast routing protocols support VRFs. When you configure a routing protocol in a VRF, you set routing parameters for the VRF that are independent of routing parameters in another VRF for the same routing protocol instance.
You can assign interfaces and route protocols to a VRF to create virtual Layer 3 networks. An interface exists in only one VRF. The following figure shows one physical network split into two virtual networks with two VRFs. Routers Z, A, and B exist in VRF Red and form one address domain. These routers share route updates that do not include Router C because Router C is configured in a different VRF.
![](/c/dam/en/us/td/i/500001-600000/500001-510000/504001-505000/504430.jpg)
By default, Cisco NX-OS uses the VRF of the incoming interface to select which routing table to use for a route lookup. You can configure a route policy to modify this behavior and set the VRF that Cisco NX-OS uses for incoming packets.
Cisco NX-OS supports route leaking (import or export) between VRFs.
Route Leaking and Importing Routes from the Default VRF
Cisco NX-OS supports route leaking (import or export) between VRFs.
You can import IP prefixes from the global routing table (the default VRF) into any other VRF by using an import policy. The VRF import policy uses a route map to specify the prefixes to be imported into a VRF. The policy can import IPv4 unicast prefixes.
![]() Note |
Routes in the BGP default VRF can be imported directly. Any other routes in the default VRF should be redistributed into BGP first. |
IP prefixes are defined as match criteria for the import route map through standard route policy filtering mechanisms. For example, you can create an IP prefix list or an as-path filter to define an IP prefix or IP prefix range and use that prefix list or as-path filter in a match clause for the route map. Prefixes that pass through the route map are imported into the specified VRF using the import policy. IP prefixes that are imported into a VRF through this import policy cannot be reimported into another VRF.
For more information, see the Guidelines and Limitations for VRF Route Leaking section.
VRF-Aware Services
A fundamental feature of the Cisco NX-OS architecture is that every IP-based feature is VRF aware.
The following VRF-aware services can select a particular VRF to reach a remote server or to filter information based on the selected VRF:
-
AAA—See the Cisco Nexus Security Configuration Guide for more information.
-
Callhome—See the Cisco Nexus System Management Configuration Guide for more information.
-
NTP—See the Cisco Nexus System Management Configuration Guide for more information.
-
RADIUS—See the Cisco Nexus Security Configuration Guide for more information.
-
SNMP—See the Cisco Nexus System Management Configuration Guide for more information.
-
SSH—See the Cisco Nexus Security Configuration Guide for more information.
-
Syslog—See the Cisco Nexus System Management Configuration Guide for more information.
-
TACACS+—See the Cisco Nexus Security Configuration Guide for more information.
-
VRRP—See Configuring VRRP section for more information.
See the appropriate configuration guide for each service for more information on configuring VRF support in that service.
Reachability
Reachability indicates which VRF contains the routing information necessary to get to the server providing the service. For example, you can configure an SNMP server that is reachable on the management VRF. When you configure that server address on the router, you also configure which VRF Cisco NX-OS must use to reach the server.
The following figure shows an SNMP server that is reachable over the management VRF. You configure Router A to use the management VRF for SNMP server host 192.0.2.1.
![](/c/dam/en/us/td/i/100001-200000/180001-190000/186001-187000/186417.eps/_jcr_content/renditions/186417.jpg)
Filtering
Filtering allows you to limit the type of information that goes to a VRF-aware service based on the VRF. For example, you can configure a syslog server to support a particular VRF. The following figure shows two syslog servers with each server supporting one VRF. Syslog server A is configured in VRF Red, so Cisco NX-OS sends only system messages generated in VRF Red to syslog server A.
![](/c/dam/en/us/td/i/100001-200000/180001-190000/186001-187000/186418.eps/_jcr_content/renditions/186418.jpg)
Combining Reachability and Filtering
You can combine reachability and filtering for VRF-aware services. You can configure the VRF that Cisco NX-OS uses to connect to that service as well as the VRF that the service supports. If you configure a service in the default VRF, you can optionally configure the service to support all VRFs.
The following figure shows an SNMP server that is reachable on the management VRF. You can configure the SNMP server to support only the SNMP notifications from VRF Red, for example.
![](/c/dam/en/us/td/i/100001-200000/180001-190000/186001-187000/186419.eps/_jcr_content/renditions/186419.jpg)