Virtual Routing and Forwarding (VRF) is a technology that lets a router or edge device maintain multiple independent routing and forwarding tables at once, so distinct networks – different tenants, customers, or traffic types – can share one piece of hardware while keeping their routes, and even overlapping IP address ranges, fully isolated from one another.
Key takeaways
- VRF gives each tenant or network segment its own isolated routing table.
- Overlapping IP address ranges can coexist safely on the same device.
- Versa SD-WAN uses VRF as its core multitenancy building block.
- MP-BGP route distinguishers and route targets keep VRF routes apart.
- Each LAN or WAN port is explicitly bound to exactly one VRF.
On this page: Why it mattersHow it worksTypesVRF & VersaFAQ
Why is VRF important?
A single router normally keeps one routing table, so every network attached to it must use non-overlapping IP addresses, and every route on that table is visible to every interface. That breaks down the moment one physical device has to serve more than one independent network – a managed service provider with multiple customers, a Versa SD-WAN edge device supporting several business units, or a branch where guest and corporate traffic must never mix.
VRF solves this by letting the same hardware run several routing and forwarding tables side by side, each behaving as if it were on its own separate router. Two tenants can both use 10.0.0.0/8 internally without collision, because their routes live in different VRFs and never cross. This is what makes multitenancy on shared edge hardware practical: a provider or IT team onboards a new customer or department by adding a VRF instead of a physical box, and a misconfiguration in one VRF cannot leak routes into another.
What is VRF?
VRF is a router feature that maintains multiple, logically separate instances of the IP routing table and the forwarding table on one piece of hardware. Each VRF has its own set of routes, its own interfaces bound to it, and – depending on the platform – its own instance of routing protocols such as BGP or OSPF. A packet arriving on an interface assigned to VRF-A is forwarded using only VRF-A’s table; it is never routed using VRF-B’s entries, even if VRF-B holds a route that would otherwise match.
VRF originated in MPLS Layer 3 VPNs, where a provider uses a VRF per customer to keep routes distinct while MP-BGP – extended with route distinguisher and route target attributes – carries every customer’s routes across a shared core without letting them mix. SD-WAN platforms, including Versa’s, reuse that same machinery to extend VRF-based segmentation across an encrypted overlay instead of an MPLS core.
Types of VRF
VRF implementations vary along a few axes. LAN VRF vs transport VRF separates the tenant-facing routing instance – the LAN VRF, which holds a customer’s internal routes – from the underlay-facing transport VRF, which handles WAN connectivity over MPLS or internet circuits; edge devices connect the two internally over BGP to control exactly which routes cross between them. Single-VRF (single-tenant) deployments dedicate one routing instance to one organization. Multi-VRF (multitenant) deployments run several VRFs on the same edge device, one per tenant or business unit, and each VRF can be configured with its own independent overlay topology – one might use a full mesh for real-time voice traffic while another uses spoke-to-hub-only for a locked-down set of terminals, on the same physical box. Default vs custom VRFs matter operationally too: platforms typically auto-create one default VRF per organization that cannot be deleted, with additional VRFs added explicitly up to a platform-specific limit.
VRF & Versa
Versa SD-WAN treats VRF as the core unit of multitenancy. Each organization on a VOS edge device gets its own VRF, and Versa CPE devices distribute VRF labels and assign a global VRF ID, route distinguisher, and BGP route-target and community attributes so routes stay isolated and are correctly reflected across the SD-WAN Controller nodes – see Versa SD-WAN Topology Constructs Based on BGP Attributes. Different VRFs on the same device can run different overlay topologies – full mesh, hub-and-spoke, or spoke-to-spoke-direct – a pattern documented as multi-VRF, or multitenant, topology in the Consolidated SD-WAN Design Guide.
Administrators bind each LAN or WLAN port to a specific VRF when configuring LAN connections; an organization gets one default, non-deletable VRF automatically and can add up to 20 more. VRF also underlies direct internet access (DIA): a logical BGP connection between the tenant VRF and the WAN transport VR lets each tenant break out to the internet locally while keeping its routing table separate from every other tenant on the device.
Frequently asked questions
What is the difference between a VRF and a VLAN?
VLANs segment traffic at Layer 2, the switching domain; VRFs segment traffic at Layer 3, the routing domain. A device can map a VLAN to a specific VRF so Layer 2-separated traffic also gets its own independent routing table, but the two mechanisms solve different problems and are normally used together.
Can two VRFs use the same IP address range?
Yes. Because each VRF maintains a fully separate routing and forwarding table, two VRFs on the same device can use overlapping or identical address ranges – for example, two tenants both running 192.168.1.0/24 – without conflict, since neither table has visibility into the other.
How does traffic move between two VRFs on the same device?
By default, it doesn’t: VRFs are isolated and traffic does not cross between them. Deliberate leaking is possible through route-target import and export policies, MP-BGP redistribution, or an inter-VRF firewall or NAT hop, but it must be explicitly configured – isolation is the default posture.
What is the difference between a VRF and a VPN?
A VPN is the broader concept: a private network built over shared or public infrastructure. VRF is one mechanism used to implement that private routing separation on the routers themselves, most commonly as part of an MPLS Layer 3 VPN or an SD-WAN overlay.
How many VRFs can one device support?
It depends on the platform and license. Versa Titan-managed organizations can configure up to 20 VRFs per organization, while Versa SD-WAN edge devices managed through Director support VRF counts governed by platform scale limits and the specifics of the deployment’s multitenancy design.
More on VRF
If you want to learn more, these are sources we trust.
| RFC 4364: BGP/MPLS IP VPNs | RFC 2547: BGP/MPLS VPNs |
|---|---|
| The IETF standard for how route distinguishers, route targets, and per-VRF forwarding keep customer routes separate on a shared network. | The original standard that introduced the BGP/MPLS VPN and VRF forwarding model, later superseded by RFC 4364. |
Related terms
If you’re reading about VRF, these are worth looking at next.
| Direct Internet Access | Universal CPE | Security Service Edge |
|---|---|---|
| Local branch internet breakout, built on a logical BGP connection between a tenant’s VRF and the WAN transport VR. | Branch hardware that hosts multiple tenants and functions on one box – VRF is what keeps their routing tables apart. | The cloud security services that enforce policy on traffic after it leaves a tenant’s isolated VRF and routing domain. |