VRF Assignment Planning

The Logic of Assignment: Where Does ip vrf forwarding Go?

The key to remember is that Virtual Routing and Forwarding (VRF) is a Layer 3 concept. The command that places an interface into a VRF, ip vrf forwarding <vrf-name>, is only applied to Layer 3 interfaces. In a multilayer switch environment like yours, this means two types of interfaces are relevant:

1. Switched Virtual Interfaces (SVIs): An SVI (e.g., interface Vlan10) is the virtual Layer 3 interface that acts as the default gateway for a VLAN. To place all devices within a VLAN into a specific VRF, you assign that VLAN's SVI to the VRF. All traffic being routed out of that VLAN will then use the VRF's unique routing table.

2. Physical Routed Ports: When you need a point-to-point Layer 3 link, such as an uplink to a firewall or an ISP router, you can convert a physical switch port into a routed port (using the no switchport command). This physical interface is then assigned directly to a VRF.

What about regular switch ports?
Standard Layer 2 ports, whether they are access ports (switchport mode access) or trunk ports (switchport mode trunk), are not directly assigned to a VRF. They operate at Layer 2 and are assigned to VLANs. The VRF association happens at Layer 3, via the SVI that serves the VLAN.

A Concrete Example: Intranet and Extranet

Let's look at a practical example that perfectly illustrates these assignment rules. The diagram below shows a common scenario where a single router (or L3 switch) uses VRF-Lite to isolate a corporate "Intranet" from a guest "Extranet."

Now, let's examine the configuration that builds this topology.

As you saw in the article, the ip vrf forwarding command is applied under both interface Vlan... and interface GigabitEthernet... configurations, cementing the idea that it's for L3 interfaces only. The user access ports are simply configured for Layer 2 access to their respective VLANs.

To reinforce this key point, let's review a quick video segment.

Practical Exercise: Creating Your Assignment Plan

Now it's time to apply this to your network. Let's create the definitive assignment plan that documents which interfaces belong to the CORP_INTERNAL and GUEST_INTERNET VRFs.

Given Information:
Imagine we've already created the following VLAN plan for your multi-building environment:

• VLAN Plan:
  • VLAN 10: Staff - Building A
  • VLAN 11: Staff - Building B
  • VLAN 20: Servers
  • VLAN 30: Printers
  • VLAN 99: Guest WiFi
  • VLAN 100: Network Management
• Physical L3 Connections:
  • GigabitEthernet1/0/1: Uplink to the corporate firewall.
  • GigabitEthernet1/0/2: Uplink to the dedicated guest ISP router.

Your Task:
Complete the following table to document your VRF assignment plan. For each Layer 3 interface, determine whether it belongs in the CORP_INTERNAL or GUEST_INTERNET VRF based on its purpose.

Conclusion

In this lesson, you created a concrete plan for implementing your VRF design. You now have a clear understanding of how to map different types of interfaces to their appropriate VRFs to achieve Layer 3 traffic isolation.

Key Takeaways:

• VRF assignment is a Layer 3 task. The ip vrf forwarding command is applied to SVIs and physical routed ports.
• The VRF of an SVI determines the routing context for all devices in that VLAN.
• The VRF of a routed port determines the routing context for the physical link it represents.
• Layer 2 access and trunk ports are not assigned to VRFs directly; they belong to VLANs.

You have now designed your VLANs, created a VLSM addressing plan, and detailed your VRF topology. You have all the core components of a modern, segmented network design.

Preview of the Next Lesson:
The next module marks the beginning of your Capstone Project. You will start by translating a realistic set of business requirements—locations, user counts, security policies—into a formal technical requirements document. This is the first step in bringing all the skills you've learned together to build a complete enterprise network design from the ground up.