IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

VRF fallback and redirect

Updated: September 8, 2026

Want to summarize with AI?

Log in

Describes how VRF fallback and redirect forward unmatched traffic through another VRF and use ABF rules to redirect IPv4 or IPv6 packets.

VRF fallback and redirect is a forwarding function that

  • uses a fallback VRF when a route lookup in the primary VRF does not find a match

  • uses ACL-based forwarding to redirect selected IPv4 and IPv6 packets, and

  • supports traffic steering across VRF boundaries when the configured restrictions are met.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

VRF Fallback and Redirect

Release 7.3.16

The VRF fallback functionality of this feature allows you to configure a fallback VRF route, which is a better alternative than a default route from the global routing table that requires an explicit next hop. If the destination prefix of a data packet does not have a match in the VRF table, the fallback VRF table is used.

The VRF redirect functionality of this feature allows the forwarding of IPv4 and IPv6 packets into a configured next hop VRF.

Fallback behavior

When a lookup in the primary VRF does not produce a route, the router can perform another lookup in the configured fallback VRF. The resolved route can then identify the next-hop VRF used for forwarding.

Redirect behavior

ACL-based forwarding can redirect IPv4 or IPv6 packets to a specified next-hop address in another VRF. The redirect behavior is configured in IPv4 or IPv6 access lists and applied to the ingress interface.

Restrictions of VRF fallback and redirect limits

These restrictions apply when you configure fallback VRF or ACL-based forwarding redirect behavior:

  • Configure only one fallback VRF route for each address family in each primary VRF.

  • Do not use ping, traceroute, or other slow-path applications with fallback VRF. LPTS receive trap support is not available for fallback VRF.

  • Use a maximum of 512 VRFs and one global table on the router.

  • If a static default route is configured for a VRF, the static default route takes precedence over the fallback VRF. The global routing table is used for route lookup, and the default route is always directed to the configured next hop.

  • If route lookup for a packet fails in the primary VRF, the router retries the lookup in the fallback VRF.

  • If both ABF VRF redirect and VRF fallback are configured for a packet, forwarding performance can have up to 25 percent PPS impact because both functions are processed at the full throughput rate of the system.

  • If a route for a packet is found in the fallback VRF, only Glean IPv4 and Glean IPv6 adjacency packets are punted successfully.

  • Avoid looped configurations. If a route for a packet is not found in both the primary VRF and fallback VRF, the packet loops in the recycle path and is eventually dropped in the recycle egress queue. Because the recycle queue has the highest priority, high-rate looped traffic can cause other valid recycled packets to be dropped.

Configure VRF fallback and redirect

Configure VRF fallback and redirect to forward selected traffic through another VRF when the configured lookup and ACL conditions are met.

Configure fallback VRF under the source VRF. Configure ACL-based forwarding redirect rules in IPv4 or IPv6 access lists and apply the access group to the ingress interface.

Procedure

  1. Configure a fallback VRF.

    Example:

    Router# configure
Router(config)# vrf vrf100
Router(config-vrf)# fallback-vrf vrf200
Router(config-vrf)# commit

  2. Verify that the lookup resolves through the fallback VRF.

    Example:

    Router# show cef vrf vrf100 192.0.2.1 detail

192.0.2.1/32, version 4, internal 0x5000001 0x0 (ptr 0xa147eab8) [1], 0x0 (0xa13e1b20), 0x0
 Updated Jun 25 10:05:53.930
 fallback VRF: vrf200
 Prefix Len 32, traffic index 0, precedence n/a, priority 4
 next hop VRF - 'vrf200', table - 0xe0000004

  3. Configure an IPv6 access list that redirects matching packets to a next-hop VRF.

    Example:

    Router# configure
Router(config)# ipv6 access-list tms-bypass-v6
Router(config-ipv6-acl)# 10 permit ipv6 any any nexthop1 vrf tms-bypass-l3vrf 2001:DB8:1:1::1
Router(config-ipv6-acl)# exit
Router(config)# commit

  4. Configure an IPv4 access list that redirects matching packets to a next-hop VRF.

    Example:

    Router# configure
Router(config)# ipv4 access-list tms-bypass-v4
Router(config-ipv4-acl)# 10 permit ipv4 any any nexthop1 vrf tms-bypass-l3vrf 192.0.2.1
Router(config-ipv4-acl)# exit
Router(config)# commit

  5. Apply the IPv4 and IPv6 access groups to the ingress interface.

    Example:

    Router# configure
Router(config)# interface Bundle-Ether 100.100
Router(config-subif)# ipv4 access-group tms-bypass-v4 ingress
Router(config-subif)# ipv6 access-group tms-bypass-v6 ingress
Router(config-subif)# commit

  6. Verify the route that is resolved through the selected next-hop VRF.

    Example:

    Router# show route vrf tms-bypass-l3vrf

B    198.51.100.0/24 [20/2219] via 203.0.113.1 (nexthop in vrf default)