Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Configure VRFs in the kernel

Updated: September 8, 2026

Want to summarize with AI?

Log in

Configure a custom VRF in IOS XR and verify that it is automatically synchronized to the Linux kernel as a network namespace, enabling Linux applications to operate within isolated VRF contexts.

Use this procedure to configure IOS XR VRFs so that corresponding Linux network namespaces are created automatically. This capability isolates Linux applications or processes into specific VRFs, such as an out-of-band management VRF, and allows those applications to open sockets and send or receive traffic only on interfaces in that VRF.

VRFs configured in IOS XR are automatically synchronized to the Linux kernel as network namespaces (netns). Each globally configured VRF creates a Linux network namespace with the prefix vrf added to the VRF name. The default VRF in IOS XR is named default and appears in Linux as vrf-default.

Procedure

  1. Identify the current network namespace or VRF.

    Example:

    [ios:~]$ip netns identify $$
vrf-default
global-vrf

  2. Configure a custom VRF named blue in IOS XR.

    Example:

    Router#conf t
Router(config)#vrf blue
Router(config-vrf)#commit

  3. Verify that VRF blue is configured in IOS XR.

    Example:

    Router#show run vrf
vrf blue
!

  4. Verify that VRF blue is created as a network namespace in the Linux kernel.

    Example:

    Router#bash
[ios:~]$ls -l /var/run/netns
total 0
-r--r--r--. 1 root root 0 Jul 30 04:17 default
-r--r--r--. 1 root root 0 Jul 30 04:17 global-vrf
-r--r--r--. 1 root root 0 Jul 30 04:17 tpnns
-r--r--r--. 1 root root 0 Aug  1 17:01 vrf-blue
-r--r--r--. 1 root root 0 Jul 30 04:17 vrf-default
-r--r--r--. 1 root root 0 Jul 30 04:17 xrnns

  5. Access VRF blue to launch and run processes from the new network namespace.

    Example:

    [ios:~]$ip netns exec vrf-blue bash
[ios:~]$
[ios:~]$ip netns identify $$
vrf-blue
[ios:~]$

    Running ifconfig shows only the default to_xr interface because no IOS XR interface is currently assigned to this VRF.

  6. Configure interface HundredGigE 0/0/0/24 in VRF blue from IOS XR. The interface is automatically configured in the vrf-blue namespace in the Linux kernel.

    Example:

    Router#conf t
Router(config)#int HundredGigE 0/0/0/24
Router(config-if)#no ipv4 address
Router(config-if)#vrf blue
Router(config-if)#ipv4 address 10.1.1.10/24
Router(config-if)#commit

  7. Verify that interface HundredGigE 0/0/0/24 is configured in VRF blue in IOS XR.

    Example:

    Router#show run int HundredGigE 0/0/0/24
interface HundredGigE0/0/0/24
 vrf blue
 ipv4 address 10.1.1.10 255.255.255.0
!

  8. Verify that the interface is configured in VRF blue in the Linux kernel.

    Example:

    Router#bash
[ios:~]$ip netns exec vrf-blue bash
[ios:~]$ifconfig
Hu0_0_0_24  Link encap:Ethernet  HWaddr 78:e7:e8:d3:20:c0
            inet addr:10.1.1.10  Bcast:0.0.0.0  Mask:255.255.255.0
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

    The interface appears in the vrf-blue network namespace, confirming successful synchronization between IOS XR and the Linux kernel.

The VRF blue is created as a Linux network namespace vrf-blue, the IOS XR interface is visible in that namespace, and Linux processes can be isolated to this VRF context.