VRF can be used to enable multitenancy for several use cases. It enables data center operators to provide separate isolated networks for customers using existing switch infrastructure. VRF enables a top-of-rack or leaf switch to support more than one customer securely. Overlapping IP address space can exist in a L3 switch, where VRFs isolate them. Layer 3 path isolation with VRF is better than Layer 3 VLAN alone. The VRF enables route table isolation, and the VLAN provides data path isolation.

Public cloud repatriation use case

Consider how VRF can be used in a public cloud repatriation use case. The customer migrates servers, storage, and applications back into their data center from the public cloud. They have determined this move reduces total cost of ownership, improves performance, and gives them more control over their resources and data. They use Dell Technologies products to do so.

IT resources for the sales and marketing user groups are repatriated. They stand up a new server for each. There is an existing switch and server for the general corporate user group. A challenge is that cloud-based sales and marketing resources have IP addresses that overlap with each other and an existing corporate server. They prefer to not reassign the sales and marketing IP address ranges.

Consider two high-level designs that they can use for repatriation. With the first design, the company could purchase additional switches and add them to the data center along with the existing corporate server. The new sales and marketing servers would each be connected to their own switch. See Figure 1.

Figure 1.   Data center multitenancy by adding switches

Alternately the company could use their existing switch and rack (which has capacity) to host the new sales and marketing servers alongside the existing corporate server. They could use VRFs to segment the new servers. See Figure 2.

Figure 2.   Data center multitenancy with VRF

The customer has chosen the second option, to add the new servers to the existing switch and use VRFs to segment traffic. VRFs are configured in the switch for each server, creating separate routing tables to segment traffic between the existing and new servers. The corporate server already resides in the default VRF, colored in yellow in Figure 2. Two new VRFs are created for sales and marketing, which are colored in red and blue. The VRFs isolate the control and data planes for each set of resources using different routing tables for each. VLANs are also configured for each server to further isolate the data plane.

The example configurations in this guide are built around a single-switch VRF use case. The example use case shows a simple network and compute environment to communicate key VRF information. A more complex environment with a leaf-spine network and multiple ports that are used on each server is supported with VRF.

Another use case where VRF can be helpful is in virtualized environments leveraging Network Virtualization Overlay (NVO). Dell PowerSwitch switches can be used with VMware NSX-T. VRF is configured in the PowerSwitch switches to enable network multitenancy, and NSX-T enables network and compute multitenancy. See the related reference in the Technical Resources chapter.

VRF in Dell SmartFabric OS10

Some key facts to be aware of with VRF in OS10 include:

• VRF is a feature that enables multitenancy in a Dell PowerSwitch.
• VRF is a feature that separates data in a network by creating multiple logical routers (a routing table per VRF) within a physical L3 switch.
• VRF allows network paths to be segmented (per domain or customer) without using multiple devices. It does so by configuring multiple different routing tables that co-exist within the same L3 switch simultaneously.
• VRF increases network security and can eliminate specific needs for encryption and authentication by automatically separating traffic in each VRF.
• Each VRF must be assigned an ingress and egress interface. Interfaces can be physical or virtual.
• IP address space can be overlapped among different VRF instances as the control plane (routing tables) are isolated.
• Within a VRF instance, routing can be statically provisioned, or exchanged using dynamic routing protocols. All forwarding components are VRF-aware and provisioned within the context of a VRF instance.
• Route leaking is supported across VRF Instances using static routes, dynamic routing protocols, or both. Route leaking enables traffic to flow across VRFs in a controlled manner when wanted.
• VRF can also work smoothly in virtualized environments, such as with VMware NSX.
• The VRF feature is supported with the Dell Virtual Link Trunking (VLT) multipathing technology.
• VRFs are local to a physical switch. Note the following:

• The VRF IDs of VRs running on a physical switch are not exchanged with VRF VRs running on other physical switches.
• Yet VRFs can extend to other switches by assigning VLANs to VRFs and trunking the VLANs.
• This configuration requires specific VRF-to-VLAN mapping at each involved switch.
• VXLAN can also be used to stretch the VLANs.

• VRRP or Proxy ARP used with VLT can be configured on interfaces that belong to a VRF instance.
• There is no restriction on the number of VLANs that can be assigned to a VRF instance.
• The size of the IPv4 CAM limits the total number of routes that are supported in VRF.

Table 1 summarizes VRF support in OS10 software,

Table 1.      VRF support in OS10 software