IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Virtual Routing and Forwarding (VRF) redirect in ABF

Updated: September 8, 2026

Want to summarize with AI?

This topic describes how ACL-based forwarding (ABF) supports Virtual Routing and Forwarding (VRF) redirect for IPv4 and IPv6 addresses on the Cisco 8000 Series Router.

The ACL-based forwarding (ABF) with VRF redirect is a network feature

supports forwarding incoming IPv4 and IPv6 traffic to virtual routing and forwarding (VRF) instances by using VRF as the next hop
enables two types of VRF redirect—VRF-select and VRF-aware, and
supports up to three next hops per access control entry (ACE).

Feature History Table

Table 1. Feature History Table
Feature Name	Release Information	Description
Virtual Routing and Forwarding (VRF) redirect in ACL-based Forwarding (ABF)	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC:K100])(select variants only*) This feature is now supported on Cisco 8712-MOD-M routers.
Virtual Routing and Forwarding (VRF) redirect in ACL-based Forwarding (ABF)	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
Virtual Routing and Forwarding (VRF) redirect in ACL-based Forwarding (ABF)	Release 7.3.3	With this feature, ABF supports VRF redirect for IPv4 and IPv6 addresses. You can enable this feature by configuring a VRF as the next hop in ABF ACEs. ABF supports two types of VRF redirect: VRF-select VRF-aware ABF with VRF redirect enables you to inject incoming traffic matching ACEs in the ABF to a VRF network and helps with load balancing and cost saving.

How VRF redirect in ABF works

ACL-based forwarding (ABF) supports VRF redirect for IPv4 and IPv6 addresses. When you configure a VRF as the next hop in an ABF ACE, the router forwards the matching traffic to the VRF for further route lookup instead of using the global routing table.

Summary

The following components take part in this process:

Router: Evaluates incoming packets against the ABF ACL and forwards the matching traffic to the specified VRF next hop.
Permit ACE with VRF redirect: Specifies up to three VRFs as next hops for matching traffic.
VRF: Provides a separate routing instance in which the router performs route lookup for the redirected traffic.
Global routing table: Provides the fallback route lookup when a default route in the VRF redirects the traffic back.

These stages describe how the router forwards packets that match a permit ACE with VRF redirect and how it handles the outcome of the VRF route lookup.

Workflow

These stages describe how VRF redirect in ABF processes an incoming packet:

The router matches the incoming packet against the ABF ACL and identifies a permit ACE with VRF redirect.
The router forwards the matching traffic to the first available VRF specified in the ACE as the next hop.

The router performs a route lookup for the redirected traffic in the selected VRF and handles the outcome as follows:


When...	Then...
The redirected traffic matches a route available in the VRF.	The router forwards the traffic by using the matched route in the VRF.
The redirected traffic fails to match any route available in the VRF.	A default route redirects the traffic back to the global routing table for lookup and forwarding.
The VRFs in any ACEs with VRF are down.	The router drops the traffic matching such ACEs immediately.

Configure ABF with VRF-select

Use this procedure to configure ABF with VRF-select by adding ACEs that redirect matched traffic to one or more VRFs as next hops.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```
Create an IPv4 access list abf-vrf-select.
Example:
```
Router(config)# ipv4 access-list abf-vrf-select
```

Add ACEs that redirect matched traffic to one or more VRFs as next hops.

Example:

Router(config-ipv4-acl)# 10 permit ipv4 60.1.1.5 0.0.0.255 any nexthop1 vrf VRF1 nexthop2 vrf VRF2 nexthop3 vrf VRF3
Router(config-ipv4-acl)# 11 permit tcp 30.0.10.1 0.0.0.255 30.0.20.1 0.0.0.255 nexthop1 vrf vrf3 nexthop2 vrf vrf2
Router(config-ipv4-acl)# 12 permit tcp host 30.0.10.1 host 30.0.20.1 match-all +ack +psh +syn nexthop1 vrf vrf2 nexthop2 vrf vrf3 nexthop3 vrf vrf1
Router(config-ipv4-acl)# 13 permit tcp host 30.0.10.1 host 30.0.20.1 precedence priority nexthop1 vrf vrf1 nexthop2 vrf vrf2 nexthop3 vrf vrf3

Commit the configuration.
Example:
```
Router(config-ipv4-acl)# commit
```
You have successfully configured ABF with VRF-select.

Verify the ABF-VRF configurations by using the show access-lists ipv4 command for abf-vrf-select access lists.

Example:

Router# show access-lists ipv4 abf-vrf-select
10 permit ipv4 60.1.1.5 0.0.0.255 any nexthop1 vrf VRF1 nexthop2 vrf VRF2 nexthop3 vrf VRF3
11 permit tcp 30.0.10.1 0.0.0.255 30.0.20.1 0.0.0.255 dscp af22 nexthop1 vrf vrf3 nexthop2 vrf vrf2
12 permit tcp host 30.0.10.1 host 30.0.20.1 match-all +ack +psh +syn set nexthop1 vrf vrf2 nexthop2 vrf vrf3 nexthop3 vrf vrf1
13 permit tcp host 30.0.10.1 host 30.0.20.1 precedence priority nexthop1 vrf vrf1 nexthop2 vrf vrf2 nexthop3 vrf vrf3

You have successfully configured ABF with VRF-select and verified the ABF-VRF configurations on the router.

Configure ABF with VRF-aware

Use this procedure to configure ABF with VRF-aware by adding ACEs that redirect matched traffic to one or more VRF and IPv4 next-hop combinations.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```
Create an IPv4 access list abf-vrf-aware.
Example:
```
Router(config)# ipv4 access-list abf-vrf-aware
```

Add ACEs that redirect matched traffic to one or more VRF and IPv4 address combinations as next hops.

Example:

Router(config-ipv4-acl)# 10 permit tcp net-group network_object_group_host net-group network_object_group_host precedence priority nexthop1 vrf vrf1 ipv4 40.1.5.2 nexthop2 vrf vrf2 ipv4 50.1.5.2 nexthop3 vrf vrf3 ipv4 60.1.5.2
Router(config-ipv4-acl)# 11 permit tcp 30.0.10.1 0.0.0.255 net-group network_object_group dscp af22 nexthop1 vrf vrf3 ipv4 60.1.5.2 nexthop2 vrf vrf2 ipv4 50.1.5.2

Commit the configuration.
Example:
```
Router(config-ipv4-acl)# commit
```

Verify the ABF-VRF configurations by using the show access-lists ipv4 command for abf-vrf-aware access lists.

Example:


Router# show access-lists ipv4 abf-vrf-aware
10 permit tcp net-group network_object_group_host net-group network_object_group_host precedence priority nexthop1 vrf vrf1 ipv4 40.1.5.2 nexthop2 vrf vrf2 ipv4 50.1.5.2 nexthop3 vrf vrf3 ipv4 60.1.5.2
11 permit tcp 30.0.10.1 0.0.0.255 net-group network_object_group dscp af22 nexthop1 vrf vrf3 ipv4 60.1.5.2 nexthop2 vrf vrf2 ipv4 50.1.5.2

You have successfully configured ABF with VRF-aware and verified the ABF-VRF configurations on the router.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.