What is VRF and how does it work on AOS-CX?

VRF stands for Virtual Routing and Forwarding.
It’s a feature that allows a switch or router to maintain multiple separate routing tables on the same physical device.

In simple terms, it lets you segregate network traffic logically, even if it uses the same physical interfaces — kind of like having multiple virtual routers inside one switch.

You use VRFs when you need to:

• Keep different tenants or departments isolated (multi-tenancy).

• Separate management traffic from user or data traffic.

• Connect overlapping IP networks without conflict.

• Improve security and simplify policy enforcement.

Example:

• VRF Mgmt → for switch management (SSH, SNMP, etc.)

• VRF Corp → for corporate LAN traffic

• VRF Guest → for guest Wi-Fi traffic

Each VRF has its own independent routing table — routes from one VRF are not visible to another unless explicitly leaked.

In AOS-CX, VRFs are fully supported and very flexible.
Here’s how it works conceptually:

Create a VRF

configure terminal
vrf MGMT
exit

Assing interfaces or VLANs to that VRF

interface vlan 10
   vrf attach MGMT
   ip address 192.168.10.1/24
exit

Enable routing (optional)

You can run routing protocols within that VRF:

router ospf vrf MGMT
   router-id 1.1.1.1
exit

Verify VRF and routes

show vrf
show ip route vrf MGMT