L3VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

L3VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

VRF-lite

Updated: September 11, 2026

Want to summarize with AI?

Log in

Explains VRF-lite fundamentals, covering interface requirements, BGP label allocation principles, and configuration tasks for deploying lightweight VPN segmentation without a full MPLS core.

VRF-lite is a VRF deployment model that

  • uses VRFs without MPLS

  • supports two or more VPNs with overlapping IP addresses, and

  • places Layer 3 interfaces into one VRF at a time.

Additional reference information

VRF-lite is the deployment of VRFs without MPLS. VRF-lite allows a service provider to support two or more VPNs with overlapping IP addresses. With this feature, multiple VRF instances can be supported in customer edge devices.

VRF-lite interface and BGP label allocation

To ensure proper VRF-lite operation when using BGP:

  • Use only Layer 3 interfaces for VRF-lite configurations.

  • Never assign an interface to more than one VRF at any time.

  • You may configure multiple interfaces to be part of the same VRF, but all interfaces must participate in the same VPN.

  • If you use the BGP protocol with VRF-lite, change the BGP label allocation mode to per-VRF.

Configure VRF-lite

Set up VRF-lite on a router so each customer's traffic and routing are kept separate using virtual routing tables.

Customers often use VRF-lite to isolate traffic and routing information between different customers or departments when connecting multiple VPN sites to the same PE router. Each VRF represents a separate customer or use case, ensuring their routing and interfaces remain independent.

To summarize, VRF-lite configuration involves these main tasks:

  • Create VRF

  • Configure VRF under the interface

  • Configure VRF under routing protocol

Before you begin

  • Plan customer VRFs, route targets, interfaces, subinterfaces, and routing protocols.

  • Ensure required route-policy (such as pass-all) exists.

  • Have interface and IP details ready for each VRF.

Procedure

  1. Create each customer VRF.

    Example:

    Router#configure
Router(config)#vrf vrf1
Router(config-vrf)#address-family ipv4 unicast
You must create route-policy pass-all before this configuration
Router(config-vrf-af)#import from default-vrf route-policy pass-all
Router(config-vrf-af)#import route-target
Router(config-vrf-import-rt)#100:100
Router(config-vrf-import-rt)#exit
Router(config-vrf-af)#export route-target
Router(config-vrf-import-rt)#100:100
Router(config-vrf-import-rt)#exit
Router(config-vrf-import-rt)#commit

    Repeat for VRF 'vrf2' or any additional VRFs.

  2. Assign interfaces to VRFs

    Example:

    Router#configure
Router(config-subif)#interface TenGigE0/0/0/0.2001
Router(config-subif)#ipv4 address 192.0.2.2 255.255.255.252
Router(config-subif)#encapsulation dot1q 2001
Router(config-subif)#exit

Router(config)#interface TenGigE0/0/0/0.2000
Router(config-subif)#vrf vrf2
Router(config-subif)#ipv4 address 192.0.2.5/30 255.255.255.252
Router(config-subif)#encapsulation dot1q 2000
Router(config-vrf-import-rt)#commit

    Repeat for other interfaces and VRFs as needed.

    Similarly configure vrf1 under interface TenGigE0/0/0/1.2001 and vrf2 under interface TenGigE0/0/0/1.2000

  3. Configure routing protocols under VRF instances.

    Example:

    Router#configure
Router(config)#router ospf 100 area 0
Router(config-ospf-ar)#interface loopback 0
Router(config-ospf-ar-if)#exit
Router(config-ospf-ar)#interface TenGigE0/0/0/1
Router(config-ospf-ar-if)#exit
Router(config-ospf-ar)#interface TenGigE0/0/0/1.2001
Router(config-ospf-ar-if)#vrf vrf1
Router(config-ospf-vrf)#default-information originate
Router(config-ospf-vrf)#exit
Router(config-ospf)#exit
Router(config)#router ospf 100 area 0
Router(config-ospf-ar)#interface TenGigE0/0/0/1.2000
Router(config-ospf-ar-if)#vrf vrf2
Router(config-ospf-vrf)#default-information originate
Router(config-ospf-vrf)#commit

    Repeat for each VRF and associated interface.

  4. Review the running configuration.

    Example:

    VRF Configuration

vrf vrf1
address-family ipv4 unicast
  import route-target
   100:100
  !
  export route-target
   100:100
  !
!
!
vrf vrf2
address-family ipv4 unicast
  import route-target
   100:100
  !
  export route-target
   100:100
  !
!
!


Interface Configuration

interface TenGigE0/0/0/0.2001
vrf vrf1
ipv4 address 192.0.2.2 255.255.255.252
encapsulation dot1q 2001
!

interface TenGigE0/0/0/0.2000
vrf vrf2
ipv4 address 192.0.2.5/30 255.255.255.252
encapsulation dot1q 2000
!

interface TenGigE0/0/0/1.2001
vrf vrf1
ipv4 address 203.0.113.2 255.255.255.252
encapsulation dot1q 2001
!

interface TenGigE0/0/0/1.2000
vrf vrf2
ipv4 address 203.0.113.5 255.255.255.252
encapsulation dot1q 2000
!

Routing Protocol Configuration
router ospf 100 area 0
interface Loopback0
!

interface TenGigE0/0/0/1
!
interface TenGigE0/0/0/1.20001
 vrf vrf1
 default-information originate
  !

interface TenGigE0/0/0/1.2000
 vrf vrf2
 default-information originate
 !

  5. Verify VRF route tables.

    Example:

    Router# show route vrf vrf1
Mon Jul  4 19:12:54.739 UTC

Codes: C - connected, S - static, B - BGP, (>) - Diversion path
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - ISIS, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, su - IS-IS summary null, * - candidate default
       U - per-user static route, o - ODR, L - local, G  - DAGR, l - LISP
       A - access/subscriber, a - Application route
       M - mobile route, r - RPL, (!) - FRR Backup path

Gateway of last resort is not set

C    203.0.113.0/24 is directly connected, 00:07:01, TenGigE0/0/0/1.2001
L    203.0.113.2/30 is directly connected, 00:07:01, TenGigE0/0/0/1.2001
C    192.0.2.0/24 is directly connected, 00:05:51, TenGigE0/0/0/1.2001
L    192.0.2.2/30 is directly connected, 00:05:51, TenGigE0/0/0/1.2001

    Example:

    Router# show route vrf vrf2
Mon Jul  4 19:12:59.121 UTC

Codes: C - connected, S - static, B - BGP, (>) - Diversion path
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - ISIS, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, su - IS-IS summary null, * - candidate default
       U - per-user static route, o - ODR, L - local, G  - DAGR, l - LISP
       A - access/subscriber, a - Application route
       M - mobile route, r - RPL, (!) - FRR Backup path

Gateway of last resort is not set

R    198.51.100.53/30 [120/1] via 192.0.2.1, 00:01:42, TenGigE0/0/0/0.2000
C    203.0.113.0/24 is directly connected, 00:08:43, TenGigE0/0/0/1.2000
L    203.0.113.5/30 is directly connected, 00:08:43, TenGigE0/0/0/1.2000
C    192.0.2.0/24 is directly connected, 00:06:17, TenGigE0/0/0/0.2000
L    192.0.2.5/30 is directly connected, 00:06:17, TenGigE0/0/0/0.2000

VRF-lite is successfully configured when each VRF contains the expected interfaces and routes in its own routing table, and customer traffic remains isolated.