Virtual routing and forwarding (VRF) is a technology included in IP (Internet Protocol) network routers that allows multiple instances of a routing table to exist in a router and work simultaneously. This increases functionality by allowing network paths to be segmented without using multiple devices. Because traffic is automatically segregated, VRF also increases network security and can eliminate the need for encryption and authentication. Internet service providers (ISPs) often take advantage of VRF to create separate virtual private networks (VPNs) for customers; thus the technology is also referred to as VPN routing and forwarding.

 VRF Diagrams

Just as with a VLAN based network using 802.1q trunks to extend the VLAN between switches, a VRF based design uses 802.1q trunks, GRE tunnels, or MPLS tags to extend and tie the VRFs together.

 

Logical Router

VRF acts like a logical router, but while a logical router may include many routing tables, a VRF instance uses only a single routing table. In addition, VRF requires a forwarding table that designates the next hop for each data packet, a list of devices that may be called upon to forward the packet and a set of rules and routing protocols that govern how the packet is forwarded. These tables prevent traffic from being forwarded outside a specific VRF path and also keep out traffic that should remain outside the VRF path.

How does this Impact NetFlow Traffic Analysis
I read that NetFlow is not VRF aware and because of this the VRF’s are not included in the NetFlow records.  However the subnets, hosts, protocols, applications, etc. etc. all show up fine in the NetFlow Reporting tool.

The long and short of this is, I have not yet to date seen any problems with VRF NetFlow environments.   However, if you are running MPLS VPN—L3VPN over GRE  by default Scrutinizer will drop all the GRE data. This can be modified by going to the Device View.

If however you are dealing with MPLS (e.g. service providers) they sometimes have overlapping IP addresses and there is nothing in NetFlow (other than ifindex) that would help keep the VRFs separate.  Using saved filters in our best at NetFlow Analysis software ‘Scrutinizer’ we can probably come up with the solution to help you.  Just give us a call.

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter Tags: Best at NetFlow, MPLS, NetFlow records, Netflow reporting tool, netflow traffic analysis, Virtual routing and forwarding

This entry was posted on Thursday, December 10th, 2009 at 8:49 am and is filed under NetFlow. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.