I wish to segment a network consisting on 150 tenant using vrf lite on Cisco 6800. The vrf configuration will be standalone as only the 6800 will be configured with vrf. Tenant's CPE will be connected via VLAN on the 6800 and will be on a separate vrf. Are there limitations using vrf lite?

1 Answer 1


The new SUP-2T can support up to 4000 VRFs. This design has two main drawbacks which you need to consider:

  • You will introduce single point of failure.

  • Routing between two different VRFs in future ( it is possible but it will require static routes or running standalone BGP on the box)

  • Thanks Viktor for your answer. We'll eliminate single point of failure by introducing another 6800 and running vss. Also we have dual edge router and two ISPs. We plan to use BGP to route between VRFs but my major concern here is that we'll have to import 150 VRFs into the "service VRF" as all tenants need to access the service. Is there a service impact with this design? Thanks.
    – gnome247
    Jun 13, 2017 at 8:05
  • routing-bits.com/2010/09/13/vrf-lite-route-leaking Check option 1 this should work for you. Just ensure you have licence for BGP. Jun 13, 2017 at 11:16
  • I saw this post earlier and I was concerned after I read paragraph four which clearly states that vrf should not be considered in a design. I Just need confirmation that importing 150 VRFs into another VRF will not impact performance.
    – gnome247
    Jun 13, 2017 at 17:55
  • You would import single RT to multiple VRFs and that is not a problem. Jun 13, 2017 at 20:13
  • You mean on all vrf's RT export should be same value, e.g route-target export 101:1, while the service vrf should have a different RT export e.g Route-target export 201:2. When importing, the service VRF will import a single RT route-target import 111:1 and export route-target export 201.2 why all other VRFs will import RT 201.2. Please correct me if I'm wrong.
    – gnome247
    Jun 14, 2017 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.