VRFs, VLANs and subnets: difference

Question

I have a basic understanding of VRFs, VLANs and subnets. I understand that VLANs operate on L2, and subnets and VRFs (lite) on L3. What I don't understand, is why you would choose one over the other when you mostly care about segmentation.

---

Imagine I have only 2 devices, and I don't want them to be able to talk to each other, but I do want them to be able to access the internet.

VLANs

Imagine I have only one switch and one router in my network. I could do as follows:

• device 1 => VLAN 1
• device 2 => VLAN 2
• Internet => VLAN 3

Then, to prevent them from talking, I could allow traffic between vlan 1 and vlan 3, as well as traffic between vlan 2 and vlan 3. I would, however, drop all traffic flowing between vlan 1 and vlan 2. => Segmentation OK.

Subnets

Imagine I have two switches and one router in my network. I could do as follows:

• subnet 1 => switch 1 => device 1
• subnet 2 => switch 2 => device 2

Then, like I did with the VLANs, I could drop all packets flowing between subnet 1 and subnet 2. => Segmentation OK.

VRFs

Imagine I have multiple switches and one router. I could do as follows:

• VRF 1 => Device 1
• VRF 2 => Device 2

I do not explicitly have to prevent anything. By default, the two VRF's won't be able to talk to each other. => Segmentation OK.

---

Is there any other advantage to any of the three? What is the preferred method? Why would I combine the three? What else did I miss?

edit I'm really looking for an answer which compares the three options, especially VLAN (which might be using separate subnets) vs VRF segmentation.

Answer 1

Each fills a different purpose, and all three may be part of an overall solution. Let's start with the oldest concept first.

Subnets are the IP world's way of determining what devices are "assumed to be on-link". Devices within the same subnet will send unicast traffic directly to each other by default, while devices in different subnets will send unicast traffic via a router by default.

You could put each subnet on a separate physical network. This forces traffic to go via the router, which can act as a firewall. That works fine if your isolation domains match up with your physical network layout, but gets to be a PITA if they don't.

You can have multiple subnets on the same "link", but doing so does not provide a high degree of isolation between the devices. IPv4 unicast traffic between different subnets will by default flow via your router where it can be filtered, but broadcasts, IPv6 link local traffic, and non-IP protocols will flow directly between the hosts. IPv6 global unicast traffic may or may not flow via the router, depending on how the hosts are configured. Furthermore, if someone wants to bypass the router, they can trivially do so by adding an extra IP address to their NIC.

VLANs take an Ethernet network and split it up into multiple separate Virtual Ethernet networks. This lets you ensure that traffic goes via the router without constraining your physical network layout.

VRFs let you build multiple virtual routers in one box. They are a relatively recent idea, and are mostly useful in large complex networks. Essentially, while VLANs let you build multiple independent virtual Ethernet networks on the same infrastructure, VRFs (used in conjunction with an appropriate virtual link layer such as VLANs or MPLS) let you build multiple independent IP networks on the same infrastructure. Some examples of where they might be useful:

• If you are running a multi-tenant datacenter scenario, each customer may have their own (possibly overlapping) set of subnets and want different routing and filtering rules.
• In a large network you may want to route between subnets/VLANs in the same security domain locally while sending cross security domain traffic to a central firewall.
• If you are doing DDOS scrubbing you may want to separate unscrubbed traffic from scrubbed traffic.
• If you have multiple classes of customer, you may want to apply different routing rules to their traffic. For example, you could route "economy" traffic on the cheapest path, while routing "premium" traffic on the fastest path.

Answer 2

IP subnets and VLANs are not mutually exclusive -- you don't choose one or the other. It most cases, there is a one-to-one correspondence between VLANs and subnets.

In your first example, assuming you're using IP, you are still going to have to assign IP subnets to the VLANs. So you would assign a separate IP subnet to VLAN 1 and 2. It is up to you whether to filter by VLAN or IP address, although you'll find that since you have to route between the VLANs, filtering by IP is easier.

If the VRF example, you have the problem of the Internet connection. When traffic is received from the Internet, which VRF do you place it into? To make it work as you've described, you would need two Internet connections.

EDIT: The "R" in VRF stands for Routing. A VRF gives you, in effect, separate independent routers, and they can have overlapping addresses and different routes. The reason for VRFs is not segmentation, per se, but to allow separate routing calculations. As an example, in your VRF 1, the default route may point to the Internet, but in VRF 2, it may point somewhere else. You can't do that (easily) with a single router, and it's near impossible in a larger network.

Answer 3

• VLAN's are said to isolate broadcast and failure domains.
• A single subnet is typically configured per VLAN and sets the IP (layer3) addressing.
• VRF separates route tables on the same device.

Answer 4

What you described is correct to some extend range from small network to medium scale network but when it comes to very big networks where all traffic is routing to single centralised core switch to avoid overlapping of ip routing VRF concept plays it's significance role to avoid overlapping of ip routing by creating virtual routing instances.

Let discussed first about VRF and VLANS .. VLANS primary function is to logical segmentation of network . Like example we are having supernet 10.240.0.0/19 subnet this sunet can divide in small division and allocate each subnet to each VLAN and further we can control traffic among vlans by configuring access -list .or we can take advantage of vlans and logically segregate network according to our business requirements..

VRF (Virtual Routing and Forwarding) is a technology which allows to have more than one routing table on a single router. The concept of VRFs on routers is similar to VLANs on switches. VRFs are typically used in combination with MPLS VPNs. VRFs without MPLS is called VRF lite .With help of VRF technology – Network administrator can create multiple routing table under one router.VRF manage multiple routing table in the same time and keep them isolated and running them independently. The other advantage of VFR is – Subnet overlapping , where service provider can use same IP address range for multiple customer without conflicting with each other.For example – you can use that same IP address assigned to two different interfaces on a router at the same time. Generally in basic small networks routing is configured at layer3 devices to destine packet to its destination location on onother network . But VRF is introduced for large to very large network were logically routing tables are created in layer3 devices as per requirement and hight end layer3 switch has feasibility to create more than 4 VRF table in layer3 devices as per our requirements