VRF#

Network → VRF, at /vrf. A VRF is a routing table of its own: the interfaces bound to it route with it and not with the main table, so a management network, a guest network or a customer can have its own default route and cannot reach the others' networks unless a route says so.

The page#

Tile	Shows
VRFs	how many are configured, and how many are running
Bound interfaces	how many interfaces are in a VRF
Routes in VRF tables	how many routes the VRFs' tables hold, IPv4

The VRFs table lists each VRF with its description, its routing table number, its state — Up, Down, Disabled, or Not running for a VRF the configuration has and the router has not created — the interfaces bound to it, how many static routes it has, and how many routes its table holds.

The Static routes table lists every static route in every VRF, with whether its VRF's table has it installed. Settings has one switch, Router services in every VRF: the router's own services, such as SSH and this web interface, answer on interfaces in any VRF, and not only on those in the main table.

Adding a VRF#

Add VRF:

Field	What it takes
Name	up to 15 letters, digits, hyphens and underscores, starting with a letter. The router refuses a name that begins like an interface (`eth`, `br`, `wg` and the like) and a few reserved words (`default`, `all`)
Routing table	100 to 65535. When left empty, the lowest free table from 100 is used — one no other VRF and no policy-routing table has
Description	anything, up to 255 characters
Disabled	configure the VRF without bringing it up
Interfaces	the interfaces to bind to it. One already in another VRF is marked, and choosing it moves it

Add VRF asks the agent to plan the change and adds what it plans to the pending changes: the VRF, then each interface's binding. An interface that is a member of a bond or a bridge cannot be bound on its own; bind the bond or bridge.

Changing a VRF#

A row opens the VRF. Its name and routing table are fixed once it exists — the router does not change a VRF's table — and the rest can be changed: the description, Disabled, and which interfaces are bound. Unticking an interface releases it to the main table. The panel also shows the VRF's routing table.

Deleting a VRF#

Delete VRF, pressed twice, releases every interface bound to it and removes the VRF with its static routes. The router will not remove a VRF that a static route elsewhere sends traffic into, or that a policy route uses; the panel says which, and nothing is added to the pending changes until that is changed.

A VRF's static routes#

Add static route in the Static routes panel, or a row of it, opens the same form as the Static routes page, with the VRF to put a new route in: gateways, interfaces, discard or reject, each with its distance, for IPv4 and IPv6.

When a read fails#

The page reads the VRF configuration, the interface configuration, the VRFs' state and their routing tables. Each read that fails is named at the top of the page, and every count or column that depends on it says Not read rather than showing a number. If the interface configuration cannot be read, no VRF can be added and no binding can be changed, because the page cannot see which interfaces are already bound.

Advanced mode#

With Advanced mode on (Account → Preferences), the header shows the configuration path, vrf, a CLI view shows the configuration as the router's own commands, and the page shows the router's own table of VRFs.

What this page does not do#

A VRF's BGP, OSPF and other routing protocols, route leaking between VRFs, a VRF's VNI and its IPv6 routing table are not shown or edited here. A VRF that has them keeps them when it is edited.