IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Internal VRF-based forwarding

Updated: August 12, 2026

Want to summarize with AI?

Log in

This topic describes how the internal VRF-based forwarding feature uses a forwarding-match access control entry (ACE) to redirect packets that do not match predefined access control entries to an internal VRF (iVRF) for deep inspection through GRE tunneling.

Forwarding capabilities in VRFs are enhanced in the ingress direction to allow VRFs to redirect incoming packets to a different destination using GRE tunneling.

Feature history for Internal VRF-based forwarding

Feature Name

Release Information

Description

Internal VRF based Forwarding

Release 26.2.1

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]):*

*This feature is supported on:

  • 88-LC1-48Y8H-EM

Internal VRF based Forwarding

Release 25.4.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8711-48Z-M

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

Internal VRF based Forwarding

Release 25.1.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on Cisco 8011-4G24Y4H-I routers.

Internal VRF based Forwarding

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

*This feature is supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 8712-MOD-M

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

Internal VRF based Forwarding

Release 24.2.11

Forwarding capabilities in VRFs are enhanced, allowing internal VRFs (iVRF) to redirect incoming packets to a different destination using GRE tunneling. This functionality can be used to examine packets that do not match the predefined access control entries. Instead of discarding these packets by default, a forwarding-match ACE sends them to a VRF that can forward them using GRE tunnels. This allows for a more thorough inspection of these discarded packets, helping to identify any hidden threats or attacks in the contents and improving network security.

Configure VRF-based forwarding

In this example, a forwarding-match ACE is used for packets that do not match the predefined access control entries. These packets are then forwarded to a specific destination using GRE tunnels, which allow for deep inspection to better understand any underlying threats.

Procedure

  1. Create an ingress VRF using the vrf command.

    Example:

    Router(config)# vrf ivrf
Router(config)# commit

  2. Configure the ingress ACLs to send the discarded packets to the ingress VRF (iVRF) by using the ipv4 access-list and permit commands.

    Example:

    Router(config)# ipv4 access-list V4-ACL-INGRESS
Router(config-ipv4-acl)# 10 permit tcp 192.0.2.6 255.255.255.0 any
Router(config-ipv4-acl)# 20 permit ipv4 any any nexthop1 vrf iVRF
Router(config-ipv4-acl)# commit

    In this example, the entry 20 permit ipv4 any any nexthop1 vrf iVRF is a forwarding-match ACE for packets that do not match the predefined access control entries.

  3. Apply the ingress ACL to an interface by using the ipv4 access-group command.

    Example:

    Router(config)# interface HundredGigE 0/0/0/0
Router(config-if)# ipv4 access-group V4-ACL-INGRESS
Router(config-if)# commit

  4. Create a GRE tunnel in the iVRF to the desired destination by using the interface, vrf, tunnel mode, tunnel source, and tunnel destination commands.

    Example:

    Router(config)# interface tunnel-ip1
Router(config-if)# vrf iVRF
Router(config-if)# ipv4 address 198.51.100.7 255.255.255.0
Router(config-if)# tunnel mode gre ipv4 encap
Router(config-if)# tunnel source 198.51.100.19
Router(config-if)# tunnel destination 203.0.113.1
Router(config-if)# commit

    For more information on GRE tunnels, see the Configure GRE Tunnel chapter in the Interface and Hardware Component Configuration Guide for Cisco 8000 Series Routers.

  5. Add static routes in the iVRF to redirect traffic to the GRE tunnels by using the router static, vrf, and address-family commands.

    Example:

    Router(config)# router static
Router(config-static)# vrf iVRF
Router(config-static-vrf)# address-family ipv4 unicast
Router(config-static-vrf-afi)# 192.0.2.9/32 tunnel-ip1
Router(config-static-vrf-afi)# commit

  6. Add rules to import BGP routes matching the community rules to the iVRF.

    Example:

    Router(config)# vrf iVRF
Router(config-vrf)# address-family ipv4 unicast
Router(config-vrf-afi)# import from default-vrf route-policy COMMUNITY1
Router(config-vrf-afi)# exit
Router(config-vrf)# community-set 2000
Router(config-vrf-comm)# 2000:2000
Router(config-vrf-comm)# end set
Router(config-vrf)# commit

  7. Rewrite the next-hop for community-matching rules to the route pointing to the GRE tunnel.

    Example:

    Router(config)# vrf iVRF
Router(config-vrf)# route-policy COMMUNITY1
Router(config-vrf-rpl)# if community in 2000 then
Router(config-vrf-rpl-if)# set next-hop 192.0.2.9 destination-vrf
Router(config-vrf-rpl-if)# end if
Router(config-vrf-rpl)# end policy
Router(config-vrf)# commit