Virtual-Router Routing Instances
A virtual-router routing instance, like a VRF (Layer 3 VPN) routing instance, maintains separate routing and forwarding tables for each instance. However, many configuration steps required for VRF routing instances are not required for virtual-router routing instances. Specifically, you do not need to configure a route distinguisher, a routing table policy (the vrf-export, vrf-import, and route-distinguisher statements), or MPLS between the provider routers.
However, you need to configure separate logical interfaces between each of the service provider routers participating in a virtual-router routing instance. You also need to configure separate logical interfaces between the service provider routers and the customer routers participating in each routing instance. Each virtual-router instance requires its own unique set of logical interfaces to all participating routers.
Figure 2 shows how this works. The provider routers G and H are configured for virtual-router routing instances Red and Green. Each provider router is directly connected to two local customer routers, one in each routing instance. The provider routers are also connected to each other over the service provider network. These routers need four logical interfaces: a logical interface to each of the locally connected customer routers and a logical interface to carry traffic between the two provider routers for each virtual-router instance.
Layer 3 VPNs do not have this configuration requirement. If you configure several Layer 3 VPN routing instances on a PE router, all the instances can use the same logical interface to reach another PE router. This is possible because Layer 3 VPNs use MPLS (VPN) labels that differentiate traffic going to and from various routing instances. Without MPLS and VPN labels, as in a virtual-router routing instance, you need separate logical interfaces to separate traffic from different instances.
One method of providing this logical interface between the provider routers is by configuring tunnels between them. You can configure IPSec, GRE, or IP-IP tunnels between the provider routers, terminating the tunnels at the virtual-router instance.