VRF: several routing tables, a single router

TL;DR

A VRF is a separate routing table, with its own interfaces, routes and protocols, on the same router: two VRFs can use the same addresses without conflict and don't see each other unless you link them explicitly. The interface the packet comes in on decides the table, which is why everything you configure or check for a VRF needs the word vrf. On one router or between routers over 802.1Q, it's VRF-Lite; over MPLS, the VRFs live on the PEs, the routes travel as VPNv4 with an RD (uniqueness) and an RT (import), and the packet carries two labels; in fabrics, the VRF is the tenant (L3VNI) or the Virtual Network (LISP). Most incidents come from a command given without vrf, a wrong RT, leaking done in one direction only, or a router service left in the global table.

How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms and standards. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.