[thirdparty/kernel/stable.git] / Documentation / networking / vrf.txt

Virtual Routing and Forwarding (VRF)
====================================
The VRF device combined with ip rules provides the ability to create virtual
routing and forwarding domains (aka VRFs, VRF-lite to be specific) in the
Linux network stack. One use case is the multi-tenancy problem where each
tenant has their own unique routing tables and in the very least need
different default gateways.

Processes can be "VRF aware" by binding a socket to the VRF device. Packets
through the socket then use the routing table associated with the VRF
device. An important feature of the VRF device implementation is that it
impacts only Layer 3 and above so L2 tools (e.g., LLDP) are not affected
(ie., they do not need to be run in each VRF). The design also allows
the use of higher priority ip rules (Policy Based Routing, PBR) to take
precedence over the VRF device rules directing specific traffic as desired.

In addition, VRF devices allow VRFs to be nested within namespaces. For
example network namespaces provide separation of network interfaces at the
device layer, VLANs on the interfaces within a namespace provide L2 separation
and then VRF devices provide L3 separation.

Design
------
A VRF device is created with an associated route table. Network interfaces
are then enslaved to a VRF device:

         +-----------------------------+
         |           vrf-blue          |  ===> route table 10
         +-----------------------------+
            |        |            |
         +------+ +------+     +-------------+
         | eth1 | | eth2 | ... |    bond1    |
         +------+ +------+     +-------------+
                                  |       |
                              +------+ +------+
                              | eth8 | | eth9 |
                              +------+ +------+

Packets received on an enslaved device and are switched to the VRF device
in the IPv4 and IPv6 processing stacks giving the impression that packets
flow through the VRF device. Similarly on egress routing rules are used to
send packets to the VRF device driver before getting sent out the actual
interface. This allows tcpdump on a VRF device to capture all packets into
and out of the VRF as a whole.[1] Similarly, netfilter[2] and tc rules can be
applied using the VRF device to specify rules that apply to the VRF domain
as a whole.

[1] Packets in the forwarded state do not flow through the device, so those
    packets are not seen by tcpdump. Will revisit this limitation in a
    future release.

[2] Iptables on ingress supports PREROUTING with skb->dev set to the real
    ingress device and both INPUT and PREROUTING rules with skb->dev set to
    the VRF device. For egress POSTROUTING and OUTPUT rules can be written
    using either the VRF device or real egress device.

Setup
-----
1. VRF device is created with an association to a FIB table.
   e.g, ip link add vrf-blue type vrf table 10
        ip link set dev vrf-blue up

2. An l3mdev FIB rule directs lookups to the table associated with the device.
   A single l3mdev rule is sufficient for all VRFs. The VRF device adds the
   l3mdev rule for IPv4 and IPv6 when the first device is created with a
   default preference of 1000. Users may delete the rule if desired and add
   with a different priority or install per-VRF rules.

   Prior to the v4.8 kernel iif and oif rules are needed for each VRF device:
       ip ru add oif vrf-blue table 10
       ip ru add iif vrf-blue table 10

3. Set the default route for the table (and hence default route for the VRF).
       ip route add table 10 unreachable default metric 4278198272

   This high metric value ensures that the default unreachable route can
   be overridden by a routing protocol suite.  FRRouting interprets
   kernel metrics as a combined admin distance (upper byte) and priority
   (lower 3 bytes).  Thus the above metric translates to [255/8192].

4. Enslave L3 interfaces to a VRF device.
       ip link set dev eth1 master vrf-blue

   Local and connected routes for enslaved devices are automatically moved to
   the table associated with VRF device. Any additional routes depending on
   the enslaved device are dropped and will need to be reinserted to the VRF
   FIB table following the enslavement.

   The IPv6 sysctl option keep_addr_on_down can be enabled to keep IPv6 global
   addresses as VRF enslavement changes.
       sysctl -w net.ipv6.conf.all.keep_addr_on_down=1

5. Additional VRF routes are added to associated table.
       ip route add table 10 ...


Applications
------------
Applications that are to work within a VRF need to bind their socket to the
VRF device:

    setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, dev, strlen(dev)+1);

or to specify the output device using cmsg and IP_PKTINFO.

By default the scope of the port bindings for unbound sockets is
limited to the default VRF. That is, it will not be matched by packets
arriving on interfaces enslaved to an l3mdev and processes may bind to
the same port if they bind to an l3mdev.

TCP & UDP services running in the default VRF context (ie., not bound
to any VRF device) can work across all VRF domains by enabling the
tcp_l3mdev_accept and udp_l3mdev_accept sysctl options:

    sysctl -w net.ipv4.tcp_l3mdev_accept=1
    sysctl -w net.ipv4.udp_l3mdev_accept=1

These options are disabled by default so that a socket in a VRF is only
selected for packets in that VRF. There is a similar option for RAW
sockets, which is enabled by default for reasons of backwards compatibility.
This is so as to specify the output device with cmsg and IP_PKTINFO, but
using a socket not bound to the corresponding VRF. This allows e.g. older ping
implementations to be run with specifying the device but without executing it
in the VRF. This option can be disabled so that packets received in a VRF
context are only handled by a raw socket bound to the VRF, and packets in the
default VRF are only handled by a socket not bound to any VRF:

    sysctl -w net.ipv4.raw_l3mdev_accept=0

netfilter rules on the VRF device can be used to limit access to services
running in the default VRF context as well.

################################################################################

Using iproute2 for VRFs
=======================
iproute2 supports the vrf keyword as of v4.7. For backwards compatibility this
section lists both commands where appropriate -- with the vrf keyword and the
older form without it.

1. Create a VRF

   To instantiate a VRF device and associate it with a table:
       $ ip link add dev NAME type vrf table ID

   As of v4.8 the kernel supports the l3mdev FIB rule where a single rule
   covers all VRFs. The l3mdev rule is created for IPv4 and IPv6 on first
   device create.

2. List VRFs

   To list VRFs that have been created:
       $ ip [-d] link show type vrf
         NOTE: The -d option is needed to show the table id

   For example:
   $ ip -d link show type vrf
   11: mgmt: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
       link/ether 72:b3:ba:91:e2:24 brd ff:ff:ff:ff:ff:ff promiscuity 0
       vrf table 1 addrgenmode eui64
   12: red: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
       link/ether b6:6f:6e:f6:da:73 brd ff:ff:ff:ff:ff:ff promiscuity 0
       vrf table 10 addrgenmode eui64
   13: blue: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
       link/ether 36:62:e8:7d:bb:8c brd ff:ff:ff:ff:ff:ff promiscuity 0
       vrf table 66 addrgenmode eui64
   14: green: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
       link/ether e6:28:b8:63:70:bb brd ff:ff:ff:ff:ff:ff promiscuity 0
       vrf table 81 addrgenmode eui64


   Or in brief output:

   $ ip -br link show type vrf
   mgmt         UP             72:b3:ba:91:e2:24 <NOARP,MASTER,UP,LOWER_UP>
   red          UP             b6:6f:6e:f6:da:73 <NOARP,MASTER,UP,LOWER_UP>
   blue         UP             36:62:e8:7d:bb:8c <NOARP,MASTER,UP,LOWER_UP>
   green        UP             e6:28:b8:63:70:bb <NOARP,MASTER,UP,LOWER_UP>


3. Assign a Network Interface to a VRF

   Network interfaces are assigned to a VRF by enslaving the netdevice to a
   VRF device:
       $ ip link set dev NAME master NAME

   On enslavement connected and local routes are automatically moved to the
   table associated with the VRF device.

   For example:
   $ ip link set dev eth0 master mgmt


4. Show Devices Assigned to a VRF

   To show devices that have been assigned to a specific VRF add the master
   option to the ip command:
       $ ip link show vrf NAME
       $ ip link show master NAME

   For example:
   $ ip link show vrf red
   3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
       link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
   4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
       link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
   7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN mode DEFAULT group default qlen 1000
       link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff


   Or using the brief output:
   $ ip -br link show vrf red
   eth1             UP             02:00:00:00:02:02 <BROADCAST,MULTICAST,UP,LOWER_UP>
   eth2             UP             02:00:00:00:02:03 <BROADCAST,MULTICAST,UP,LOWER_UP>
   eth5             DOWN           02:00:00:00:02:06 <BROADCAST,MULTICAST>


5. Show Neighbor Entries for a VRF

   To list neighbor entries associated with devices enslaved to a VRF device
   add the master option to the ip command:
       $ ip [-6] neigh show vrf NAME
       $ ip [-6] neigh show master NAME

   For example:
   $  ip neigh show vrf red
   10.2.1.254 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE
   10.2.2.254 dev eth2 lladdr 5e:54:01:6a:ee:80 REACHABLE

   $ ip -6 neigh show vrf red
   2002:1::64 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE


6. Show Addresses for a VRF

   To show addresses for interfaces associated with a VRF add the master
   option to the ip command:
       $ ip addr show vrf NAME
       $ ip addr show master NAME

   For example:
   $ ip addr show vrf red
   3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
       link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
       inet 10.2.1.2/24 brd 10.2.1.255 scope global eth1
          valid_lft forever preferred_lft forever
       inet6 2002:1::2/120 scope global
          valid_lft forever preferred_lft forever
       inet6 fe80::ff:fe00:202/64 scope link
          valid_lft forever preferred_lft forever
   4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
       link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
       inet 10.2.2.2/24 brd 10.2.2.255 scope global eth2
          valid_lft forever preferred_lft forever
       inet6 2002:2::2/120 scope global
          valid_lft forever preferred_lft forever
       inet6 fe80::ff:fe00:203/64 scope link
          valid_lft forever preferred_lft forever
   7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN group default qlen 1000
       link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff

   Or in brief format:
   $ ip -br addr show vrf red
   eth1             UP             10.2.1.2/24 2002:1::2/120 fe80::ff:fe00:202/64
   eth2             UP             10.2.2.2/24 2002:2::2/120 fe80::ff:fe00:203/64
   eth5             DOWN


7. Show Routes for a VRF

   To show routes for a VRF use the ip command to display the table associated
   with the VRF device:
       $ ip [-6] route show vrf NAME
       $ ip [-6] route show table ID

   For example:
   $ ip route show vrf red
   unreachable default  metric 4278198272
   broadcast 10.2.1.0 dev eth1  proto kernel  scope link  src 10.2.1.2
   10.2.1.0/24 dev eth1  proto kernel  scope link  src 10.2.1.2
   local 10.2.1.2 dev eth1  proto kernel  scope host  src 10.2.1.2
   broadcast 10.2.1.255 dev eth1  proto kernel  scope link  src 10.2.1.2
   broadcast 10.2.2.0 dev eth2  proto kernel  scope link  src 10.2.2.2
   10.2.2.0/24 dev eth2  proto kernel  scope link  src 10.2.2.2
   local 10.2.2.2 dev eth2  proto kernel  scope host  src 10.2.2.2
   broadcast 10.2.2.255 dev eth2  proto kernel  scope link  src 10.2.2.2

   $ ip -6 route show vrf red
   local 2002:1:: dev lo  proto none  metric 0  pref medium
   local 2002:1::2 dev lo  proto none  metric 0  pref medium
   2002:1::/120 dev eth1  proto kernel  metric 256  pref medium
   local 2002:2:: dev lo  proto none  metric 0  pref medium
   local 2002:2::2 dev lo  proto none  metric 0  pref medium
   2002:2::/120 dev eth2  proto kernel  metric 256  pref medium
   local fe80:: dev lo  proto none  metric 0  pref medium
   local fe80:: dev lo  proto none  metric 0  pref medium
   local fe80::ff:fe00:202 dev lo  proto none  metric 0  pref medium
   local fe80::ff:fe00:203 dev lo  proto none  metric 0  pref medium
   fe80::/64 dev eth1  proto kernel  metric 256  pref medium
   fe80::/64 dev eth2  proto kernel  metric 256  pref medium
   ff00::/8 dev red  metric 256  pref medium
   ff00::/8 dev eth1  metric 256  pref medium
   ff00::/8 dev eth2  metric 256  pref medium
   unreachable default dev lo  metric 4278198272  error -101 pref medium

8. Route Lookup for a VRF

   A test route lookup can be done for a VRF:
       $ ip [-6] route get vrf NAME ADDRESS
       $ ip [-6] route get oif NAME ADDRESS

   For example:
   $ ip route get 10.2.1.40 vrf red
   10.2.1.40 dev eth1  table red  src 10.2.1.2
       cache

   $ ip -6 route get 2002:1::32 vrf red
   2002:1::32 from :: dev eth1  table red  proto kernel  src 2002:1::2  metric 256  pref medium


9. Removing Network Interface from a VRF

   Network interfaces are removed from a VRF by breaking the enslavement to
   the VRF device:
       $ ip link set dev NAME nomaster

   Connected routes are moved back to the default table and local entries are
   moved to the local table.

   For example:
   $ ip link set dev eth0 nomaster

--------------------------------------------------------------------------------

Commands used in this example:

cat >> /etc/iproute2/rt_tables.d/vrf.conf <<EOF
1  mgmt
10 red
66 blue
81 green
EOF

function vrf_create
{
    VRF=$1
    TBID=$2

    # create VRF device
    ip link add ${VRF} type vrf table ${TBID}

    if [ "${VRF}" != "mgmt" ]; then
        ip route add table ${TBID} unreachable default metric 4278198272
    fi
    ip link set dev ${VRF} up
}

vrf_create mgmt 1
ip link set dev eth0 master mgmt

vrf_create red 10
ip link set dev eth1 master red
ip link set dev eth2 master red
ip link set dev eth5 master red

vrf_create blue 66
ip link set dev eth3 master blue

vrf_create green 81
ip link set dev eth4 master green


Interface addresses from /etc/network/interfaces:
auto eth0
iface eth0 inet static
      address 10.0.0.2
      netmask 255.255.255.0
      gateway 10.0.0.254

iface eth0 inet6 static
      address 2000:1::2
      netmask 120

auto eth1
iface eth1 inet static
      address 10.2.1.2
      netmask 255.255.255.0

iface eth1 inet6 static
      address 2002:1::2
      netmask 120

auto eth2
iface eth2 inet static
      address 10.2.2.2
      netmask 255.255.255.0

iface eth2 inet6 static
      address 2002:2::2
      netmask 120

auto eth3
iface eth3 inet static
      address 10.2.3.2
      netmask 255.255.255.0

iface eth3 inet6 static
      address 2002:3::2
      netmask 120

auto eth4
iface eth4 inet static
      address 10.2.4.2
      netmask 255.255.255.0

iface eth4 inet6 static
      address 2002:4::2
      netmask 120
Commit	Line	Data
562d897d DA	1	Virtual Routing and Forwarding (VRF)
	2	====================================
	3	The VRF device combined with ip rules provides the ability to create virtual
	4	routing and forwarding domains (aka VRFs, VRF-lite to be specific) in the
	5	Linux network stack. One use case is the multi-tenancy problem where each
	6	tenant has their own unique routing tables and in the very least need
	7	different default gateways.
	8
	9	Processes can be "VRF aware" by binding a socket to the VRF device. Packets
	10	through the socket then use the routing table associated with the VRF
	11	device. An important feature of the VRF device implementation is that it
	12	impacts only Layer 3 and above so L2 tools (e.g., LLDP) are not affected
	13	(ie., they do not need to be run in each VRF). The design also allows
	14	the use of higher priority ip rules (Policy Based Routing, PBR) to take
	15	precedence over the VRF device rules directing specific traffic as desired.
	16
	17	In addition, VRF devices allow VRFs to be nested within namespaces. For
6e076537 DA	18	example network namespaces provide separation of network interfaces at the
	19	device layer, VLANs on the interfaces within a namespace provide L2 separation
	20	and then VRF devices provide L3 separation.
562d897d DA	21
	22	Design
	23	------
	24	A VRF device is created with an associated route table. Network interfaces
	25	are then enslaved to a VRF device:
	26
	27	+-----------------------------+
	28	\| vrf-blue \| ===> route table 10
	29	+-----------------------------+
	30	\| \| \|
	31	+------+ +------+ +-------------+
	32	\| eth1 \| \| eth2 \| ... \| bond1 \|
	33	+------+ +------+ +-------------+
	34	\| \|
	35	+------+ +------+
	36	\| eth8 \| \| eth9 \|
	37	+------+ +------+
	38
	39	Packets received on an enslaved device and are switched to the VRF device
6e076537 DA	40	in the IPv4 and IPv6 processing stacks giving the impression that packets
	41	flow through the VRF device. Similarly on egress routing rules are used to
	42	send packets to the VRF device driver before getting sent out the actual
	43	interface. This allows tcpdump on a VRF device to capture all packets into
	44	and out of the VRF as a whole.[1] Similarly, netfilter[2] and tc rules can be
	45	applied using the VRF device to specify rules that apply to the VRF domain
	46	as a whole.
562d897d DA	47
	48	[1] Packets in the forwarded state do not flow through the device, so those
	49	packets are not seen by tcpdump. Will revisit this limitation in a
	50	future release.
	51
6e076537 DA	52	[2] Iptables on ingress supports PREROUTING with skb->dev set to the real
	53	ingress device and both INPUT and PREROUTING rules with skb->dev set to
	54	the VRF device. For egress POSTROUTING and OUTPUT rules can be written
	55	using either the VRF device or real egress device.
562d897d DA	56
	57	Setup
	58	-----
	59	1. VRF device is created with an association to a FIB table.
	60	e.g, ip link add vrf-blue type vrf table 10
	61	ip link set dev vrf-blue up
	62
6e076537 DA	63	2. An l3mdev FIB rule directs lookups to the table associated with the device.
	64	A single l3mdev rule is sufficient for all VRFs. The VRF device adds the
	65	l3mdev rule for IPv4 and IPv6 when the first device is created with a
	66	default preference of 1000. Users may delete the rule if desired and add
	67	with a different priority or install per-VRF rules.
	68
	69	Prior to the v4.8 kernel iif and oif rules are needed for each VRF device:
562d897d DA	70	ip ru add oif vrf-blue table 10
	71	ip ru add iif vrf-blue table 10
	72
6e076537	73	3. Set the default route for the table (and hence default route for the VRF).
17c91884 DS	74	ip route add table 10 unreachable default metric 4278198272
	75
	76	This high metric value ensures that the default unreachable route can
	77	be overridden by a routing protocol suite. FRRouting interprets
	78	kernel metrics as a combined admin distance (upper byte) and priority
	79	(lower 3 bytes). Thus the above metric translates to [255/8192].
562d897d	80
6e076537 DA	81	4. Enslave L3 interfaces to a VRF device.
6e076537 DA	82	ip link set dev eth1 master vrf-blue
562d897d DA	83
	84	Local and connected routes for enslaved devices are automatically moved to
	85	the table associated with VRF device. Any additional routes depending on
6e076537 DA	86	the enslaved device are dropped and will need to be reinserted to the VRF
	87	FIB table following the enslavement.
	88
	89	The IPv6 sysctl option keep_addr_on_down can be enabled to keep IPv6 global
	90	addresses as VRF enslavement changes.
	91	sysctl -w net.ipv6.conf.all.keep_addr_on_down=1
562d897d	92
6e076537 DA	93	5. Additional VRF routes are added to associated table.
6e076537 DA	94	ip route add table 10 ...
562d897d DA	95
	96
	97	Applications
	98	------------
	99	Applications that are to work within a VRF need to bind their socket to the
	100	VRF device:
	101
	102	setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, dev, strlen(dev)+1);
	103
	104	or to specify the output device using cmsg and IP_PKTINFO.
	105
3c82a21f RS	106	By default the scope of the port bindings for unbound sockets is
	107	limited to the default VRF. That is, it will not be matched by packets
	108	arriving on interfaces enslaved to an l3mdev and processes may bind to
	109	the same port if they bind to an l3mdev.
	110
63a6fff3 RS	111	TCP & UDP services running in the default VRF context (ie., not bound
	112	to any VRF device) can work across all VRF domains by enabling the
	113	tcp_l3mdev_accept and udp_l3mdev_accept sysctl options:
6897445f	114
6e076537	115	sysctl -w net.ipv4.tcp_l3mdev_accept=1
63a6fff3	116	sysctl -w net.ipv4.udp_l3mdev_accept=1
562d897d	117
6897445f MM	118	These options are disabled by default so that a socket in a VRF is only
	119	selected for packets in that VRF. There is a similar option for RAW
	120	sockets, which is enabled by default for reasons of backwards compatibility.
	121	This is so as to specify the output device with cmsg and IP_PKTINFO, but
	122	using a socket not bound to the corresponding VRF. This allows e.g. older ping
	123	implementations to be run with specifying the device but without executing it
	124	in the VRF. This option can be disabled so that packets received in a VRF
	125	context are only handled by a raw socket bound to the VRF, and packets in the
	126	default VRF are only handled by a socket not bound to any VRF:
	127
	128	sysctl -w net.ipv4.raw_l3mdev_accept=0
	129
6e076537 DA	130	netfilter rules on the VRF device can be used to limit access to services
	131	running in the default VRF context as well.
	132
4b418bff DA	133	################################################################################
	134
	135	Using iproute2 for VRFs
	136	=======================
6e076537 DA	137	iproute2 supports the vrf keyword as of v4.7. For backwards compatibility this
	138	section lists both commands where appropriate -- with the vrf keyword and the
	139	older form without it.
4b418bff DA	140
	141	1. Create a VRF
	142
	143	To instantiate a VRF device and associate it with a table:
	144	$ ip link add dev NAME type vrf table ID
	145
6e076537 DA	146	As of v4.8 the kernel supports the l3mdev FIB rule where a single rule
	147	covers all VRFs. The l3mdev rule is created for IPv4 and IPv6 on first
	148	device create.
4b418bff DA	149
	150	2. List VRFs
	151
	152	To list VRFs that have been created:
	153	$ ip [-d] link show type vrf
	154	NOTE: The -d option is needed to show the table id
	155
	156	For example:
	157	$ ip -d link show type vrf
6e076537	158	11: mgmt: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
4b418bff DA	159	link/ether 72:b3:ba:91:e2:24 brd ff:ff:ff:ff:ff:ff promiscuity 0
4b418bff DA	160	vrf table 1 addrgenmode eui64
6e076537	161	12: red: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
4b418bff DA	162	link/ether b6:6f:6e:f6:da:73 brd ff:ff:ff:ff:ff:ff promiscuity 0
4b418bff DA	163	vrf table 10 addrgenmode eui64
6e076537	164	13: blue: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
4b418bff DA	165	link/ether 36:62:e8:7d:bb:8c brd ff:ff:ff:ff:ff:ff promiscuity 0
4b418bff DA	166	vrf table 66 addrgenmode eui64
6e076537	167	14: green: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
4b418bff DA	168	link/ether e6:28:b8:63:70:bb brd ff:ff:ff:ff:ff:ff promiscuity 0
	169	vrf table 81 addrgenmode eui64
	170
	171
	172	Or in brief output:
	173
	174	$ ip -br link show type vrf
6e076537 DA	175	mgmt UP 72:b3:ba:91:e2:24 <NOARP,MASTER,UP,LOWER_UP>
	176	red UP b6:6f:6e:f6:da:73 <NOARP,MASTER,UP,LOWER_UP>
	177	blue UP 36:62:e8:7d:bb:8c <NOARP,MASTER,UP,LOWER_UP>
	178	green UP e6:28:b8:63:70:bb <NOARP,MASTER,UP,LOWER_UP>
4b418bff DA	179
	180
	181	3. Assign a Network Interface to a VRF
	182
	183	Network interfaces are assigned to a VRF by enslaving the netdevice to a
	184	VRF device:
6e076537	185	$ ip link set dev NAME master NAME
4b418bff DA	186
	187	On enslavement connected and local routes are automatically moved to the
	188	table associated with the VRF device.
	189
	190	For example:
6e076537	191	$ ip link set dev eth0 master mgmt
4b418bff DA	192
	193
	194	4. Show Devices Assigned to a VRF
	195
	196	To show devices that have been assigned to a specific VRF add the master
	197	option to the ip command:
6e076537 DA	198	$ ip link show vrf NAME
6e076537 DA	199	$ ip link show master NAME
4b418bff DA	200
4b418bff DA	201	For example:
6e076537 DA	202	$ ip link show vrf red
6e076537 DA	203	3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
4b418bff	204	link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
6e076537	205	4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
4b418bff	206	link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
6e076537	207	7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN mode DEFAULT group default qlen 1000
4b418bff DA	208	link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff
	209
	210
	211	Or using the brief output:
484f674b	212	$ ip -br link show vrf red
4b418bff DA	213	eth1 UP 02:00:00:00:02:02 <BROADCAST,MULTICAST,UP,LOWER_UP>
	214	eth2 UP 02:00:00:00:02:03 <BROADCAST,MULTICAST,UP,LOWER_UP>
	215	eth5 DOWN 02:00:00:00:02:06 <BROADCAST,MULTICAST>
	216
	217
	218	5. Show Neighbor Entries for a VRF
	219
	220	To list neighbor entries associated with devices enslaved to a VRF device
	221	add the master option to the ip command:
6e076537 DA	222	$ ip [-6] neigh show vrf NAME
6e076537 DA	223	$ ip [-6] neigh show master NAME
4b418bff DA	224
4b418bff DA	225	For example:
6e076537	226	$ ip neigh show vrf red
4b418bff DA	227	10.2.1.254 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE
	228	10.2.2.254 dev eth2 lladdr 5e:54:01:6a:ee:80 REACHABLE
	229
484f674b DA	230	$ ip -6 neigh show vrf red
484f674b DA	231	2002:1::64 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE
4b418bff DA	232
	233
	234	6. Show Addresses for a VRF
	235
	236	To show addresses for interfaces associated with a VRF add the master
	237	option to the ip command:
6e076537 DA	238	$ ip addr show vrf NAME
6e076537 DA	239	$ ip addr show master NAME
4b418bff DA	240
4b418bff DA	241	For example:
6e076537 DA	242	$ ip addr show vrf red
6e076537 DA	243	3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
4b418bff DA	244	link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
	245	inet 10.2.1.2/24 brd 10.2.1.255 scope global eth1
	246	valid_lft forever preferred_lft forever
	247	inet6 2002:1::2/120 scope global
	248	valid_lft forever preferred_lft forever
	249	inet6 fe80::ff:fe00:202/64 scope link
	250	valid_lft forever preferred_lft forever
6e076537	251	4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
4b418bff DA	252	link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
	253	inet 10.2.2.2/24 brd 10.2.2.255 scope global eth2
	254	valid_lft forever preferred_lft forever
	255	inet6 2002:2::2/120 scope global
	256	valid_lft forever preferred_lft forever
	257	inet6 fe80::ff:fe00:203/64 scope link
	258	valid_lft forever preferred_lft forever
6e076537	259	7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN group default qlen 1000
4b418bff DA	260	link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff
	261
	262	Or in brief format:
6e076537	263	$ ip -br addr show vrf red
4b418bff DA	264	eth1 UP 10.2.1.2/24 2002:1::2/120 fe80::ff:fe00:202/64
	265	eth2 UP 10.2.2.2/24 2002:2::2/120 fe80::ff:fe00:203/64
	266	eth5 DOWN
	267
	268
	269	7. Show Routes for a VRF
	270
	271	To show routes for a VRF use the ip command to display the table associated
	272	with the VRF device:
6e076537	273	$ ip [-6] route show vrf NAME
4b418bff DA	274	$ ip [-6] route show table ID
	275
	276	For example:
6e076537	277	$ ip route show vrf red
17c91884	278	unreachable default metric 4278198272
4b418bff DA	279	broadcast 10.2.1.0 dev eth1 proto kernel scope link src 10.2.1.2
	280	10.2.1.0/24 dev eth1 proto kernel scope link src 10.2.1.2
	281	local 10.2.1.2 dev eth1 proto kernel scope host src 10.2.1.2
	282	broadcast 10.2.1.255 dev eth1 proto kernel scope link src 10.2.1.2
	283	broadcast 10.2.2.0 dev eth2 proto kernel scope link src 10.2.2.2
	284	10.2.2.0/24 dev eth2 proto kernel scope link src 10.2.2.2
	285	local 10.2.2.2 dev eth2 proto kernel scope host src 10.2.2.2
	286	broadcast 10.2.2.255 dev eth2 proto kernel scope link src 10.2.2.2
	287
6e076537	288	$ ip -6 route show vrf red
4b418bff DA	289	local 2002:1:: dev lo proto none metric 0 pref medium
	290	local 2002:1::2 dev lo proto none metric 0 pref medium
	291	2002:1::/120 dev eth1 proto kernel metric 256 pref medium
	292	local 2002:2:: dev lo proto none metric 0 pref medium
	293	local 2002:2::2 dev lo proto none metric 0 pref medium
	294	2002:2::/120 dev eth2 proto kernel metric 256 pref medium
	295	local fe80:: dev lo proto none metric 0 pref medium
	296	local fe80:: dev lo proto none metric 0 pref medium
	297	local fe80::ff:fe00:202 dev lo proto none metric 0 pref medium
	298	local fe80::ff:fe00:203 dev lo proto none metric 0 pref medium
	299	fe80::/64 dev eth1 proto kernel metric 256 pref medium
	300	fe80::/64 dev eth2 proto kernel metric 256 pref medium
6e076537	301	ff00::/8 dev red metric 256 pref medium
4b418bff DA	302	ff00::/8 dev eth1 metric 256 pref medium
4b418bff DA	303	ff00::/8 dev eth2 metric 256 pref medium
17c91884	304	unreachable default dev lo metric 4278198272 error -101 pref medium
4b418bff DA	305
	306	8. Route Lookup for a VRF
	307
6e076537 DA	308	A test route lookup can be done for a VRF:
	309	$ ip [-6] route get vrf NAME ADDRESS
	310	$ ip [-6] route get oif NAME ADDRESS
4b418bff DA	311
4b418bff DA	312	For example:
6e076537 DA	313	$ ip route get 10.2.1.40 vrf red
6e076537 DA	314	10.2.1.40 dev eth1 table red src 10.2.1.2
4b418bff DA	315	cache
4b418bff DA	316
6e076537 DA	317	$ ip -6 route get 2002:1::32 vrf red
6e076537 DA	318	2002:1::32 from :: dev eth1 table red proto kernel src 2002:1::2 metric 256 pref medium
4b418bff DA	319
	320
	321	9. Removing Network Interface from a VRF
	322
	323	Network interfaces are removed from a VRF by breaking the enslavement to
	324	the VRF device:
	325	$ ip link set dev NAME nomaster
	326
	327	Connected routes are moved back to the default table and local entries are
	328	moved to the local table.
	329
	330	For example:
	331	$ ip link set dev eth0 nomaster
	332
	333	--------------------------------------------------------------------------------
	334
	335	Commands used in this example:
	336
6e076537 DA	337	cat >> /etc/iproute2/rt_tables.d/vrf.conf <<EOF
	338	1 mgmt
	339	10 red
	340	66 blue
	341	81 green
4b418bff DA	342	EOF
	343
	344	function vrf_create
	345	{
	346	VRF=$1
	347	TBID=$2
4b418bff	348
6e076537 DA	349	# create VRF device
6e076537 DA	350	ip link add ${VRF} type vrf table ${TBID}
4b418bff DA	351
4b418bff DA	352	if [ "${VRF}" != "mgmt" ]; then
17c91884	353	ip route add table ${TBID} unreachable default metric 4278198272
4b418bff	354	fi
6e076537	355	ip link set dev ${VRF} up
4b418bff DA	356	}
	357
	358	vrf_create mgmt 1
6e076537	359	ip link set dev eth0 master mgmt
4b418bff DA	360
4b418bff DA	361	vrf_create red 10
6e076537 DA	362	ip link set dev eth1 master red
	363	ip link set dev eth2 master red
	364	ip link set dev eth5 master red
4b418bff DA	365
4b418bff DA	366	vrf_create blue 66
6e076537	367	ip link set dev eth3 master blue
4b418bff DA	368
4b418bff DA	369	vrf_create green 81
6e076537	370	ip link set dev eth4 master green
4b418bff DA	371
	372
	373	Interface addresses from /etc/network/interfaces:
	374	auto eth0
	375	iface eth0 inet static
	376	address 10.0.0.2
	377	netmask 255.255.255.0
	378	gateway 10.0.0.254
	379
	380	iface eth0 inet6 static
	381	address 2000:1::2
	382	netmask 120
	383
	384	auto eth1
	385	iface eth1 inet static
	386	address 10.2.1.2
	387	netmask 255.255.255.0
	388
	389	iface eth1 inet6 static
	390	address 2002:1::2
	391	netmask 120
	392
	393	auto eth2
	394	iface eth2 inet static
	395	address 10.2.2.2
	396	netmask 255.255.255.0
	397
	398	iface eth2 inet6 static
	399	address 2002:2::2
	400	netmask 120
	401
	402	auto eth3
	403	iface eth3 inet static
	404	address 10.2.3.2
	405	netmask 255.255.255.0
	406
	407	iface eth3 inet6 static
	408	address 2002:3::2
	409	netmask 120
	410
	411	auto eth4
	412	iface eth4 inet static
	413	address 10.2.4.2
	414	netmask 255.255.255.0
	415
	416	iface eth4 inet6 static
	417	address 2002:4::2
	418	netmask 120