Managing virtual routing and forwarding (VRF) tables

Expand all | Collapse all

Kaspersky SD-WAN supports the Virtual Routing and Forwarding (VRF) technology for creating up to 200 virtual routing and forwarding tables on CPE devices.

When creating a virtual routing and forwarding table, you must select network interfaces that you want to add to it. Network interfaces for connecting the CPE device to the controller and orchestrator are automatically added to the default virtual routing and forwarding table and you cannot add them to other tables. You cannot add the same network interface to multiple virtual routing and forwarding tables.

If two network interfaces are in different virtual routing and forwarding tables, the networks connected to them do not have access to each other. In this situation, network interfaces can have IP addresses from identical or overlapping subnets.

You can place BGP routes and static routes in virtual routing and forwarding tables. To place BGP routes into a virtual routing and forwarding table, specify that table when editing basic BGP settings. To place a static route in a virtual routing and forwarding table, specify that table when creating or editing the static route.

You can use virtual routing and forwarding tables in the following scenarios:

• Network segmentation using virtual routing and forwarding tables

  You can create virtual routing and forwarding tables to segment your network. In the figure below, Network 1 is built between the 'overlay1' network interface and user PCs, and Network 2 is built between the 'overlay2' network interface and ATMs. Both network interfaces are in the default virtual routing and forwarding table (Default VRF), so the networks have access to each other and are insecure.

  

  Network interfaces connected to different networks in the virtual default routing and forwarding table

  To isolate Network 1 and Network 2, the overlay1 and overlay2 network interfaces must be added to separate virtual routing and forwarding tables, which creates two segments (see the figure below).

  

  Network interfaces connected to different networks are in separate virtual default routing and forwarding tables

• Sending the 0.0.0.0/0 over BGP.

  You can create a separate virtual routing and forwarding table for sending the 0.0.0.0/0 route between devices over BGP. The figure below shows a CPE device with the gateway (GW) role and a standard device. All CPE devices in the network are added to the default virtual routing and forwarding table.

  If a gateway sends the 0.0.0.0/0 BGP route from overlay network interface 10.10.10.254/24 to overlay network interface 10.10.10.1/24, such a route cannot be used. This is the case because the default virtual routing and forwarding table already has 0.0.0.0/0 routes with a lower administrative distance for connecting to the controller and orchestrator.

  

  Sending the 0.0.0.0/0 route to a CPE device with the default virtual routing and forwarding table

  To send route 0.0.0.0/0 over BGP through the overlay 10.10.10.254/24 network interface to overlay 10.10.10.1/24, you must create a separate table for the overlay 10.10.10.1/24 network interface and place BGP routes in it (see the figure below).

  

  Sending the 0.0.0.0/0 route to a CPE device with a separate virtual routing and forwarding table for BGP routes

The table of virtual routing and forwarding tables is displayed in the CPE template and on the device:

• To display the table of virtual routing and forwarding tables in a CPE template, go to the SD-WAN → CPE templates menu section, click the template, and in the displayed settings area, select the VRF tab.
• To display the table of virtual routing and forwarding tables on a CPE device, go to the SD-WAN → CPE menu section, click the device, and in the displayed settings area, select the VRF tab.

Information about virtual routing and forwarding tables is displayed in the following columns of the table:

• Name is the name of the virtual routing and forwarding table.
• Table is the ID of the virtual routing and forwarding table.
• Interfaces are network interfaces added to the virtual routing and forwarding table.