€•žá      Œsphinx.addnodes”Œdocument”“”)”}”(Œ	rawsource”Œ ”Œchildren”]”(Œtranslations”ŒLanguagesNode”“”)”}”(hhh]”(h Œpending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ
attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ	refdomain”Œstd”Œreftype”Œdoc”Œ	reftarget”Œ"/translations/zh_CN/networking/vrf”Œmodname”NŒ	classname”NŒrefexplicit”ˆuŒtagname”hhhubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ"/translations/zh_TW/networking/vrf”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ"/translations/it_IT/networking/vrf”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ"/translations/ja_JP/networking/vrf”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ"/translations/ko_KR/networking/vrf”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒSpanish”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ"/translations/sp_SP/networking/vrf”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h
hhŒ	_document”hŒsource”NŒline”NubhŒcomment”“”)”}”(hŒ SPDX-License-Identifier: GPL-2.0”h]”hŒ SPDX-License-Identifier: GPL-2.0”…””}”hh£sbah}”(h]”h ]”h"]”h$]”h&]”Œ	xml:space”Œpreserve”uh1h¡hhhžhhŸŒ</var/lib/git/docbuild/linux/Documentation/networking/vrf.rst”h KubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒ$Virtual Routing and Forwarding (VRF)”h]”hŒ$Virtual Routing and Forwarding (VRF)”…””}”(hh»hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hh¶hžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒThe VRF Device”h]”hŒThe VRF Device”…””}”(hhÌhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hhÉhžhhŸh³h KubhŒ	paragraph”“”)”}”(hXB  The VRF device combined with ip rules provides the ability to create virtual
routing and forwarding domains (aka VRFs, VRF-lite to be specific) in the
Linux network stack. One use case is the multi-tenancy problem where each
tenant has their own unique routing tables and in the very least need
different default gateways.”h]”hXB  The VRF device combined with ip rules provides the ability to create virtual
routing and forwarding domains (aka VRFs, VRF-lite to be specific) in the
Linux network stack. One use case is the multi-tenancy problem where each
tenant has their own unique routing tables and in the very least need
different default gateways.”…””}”(hhÜhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K
hhÉhžhubhÛ)”}”(hXý  Processes can be "VRF aware" by binding a socket to the VRF device. Packets
through the socket then use the routing table associated with the VRF
device. An important feature of the VRF device implementation is that it
impacts only Layer 3 and above so L2 tools (e.g., LLDP) are not affected
(ie., they do not need to be run in each VRF). The design also allows
the use of higher priority ip rules (Policy Based Routing, PBR) to take
precedence over the VRF device rules directing specific traffic as desired.”h]”hX  Processes can be â€œVRF awareâ€ by binding a socket to the VRF device. Packets
through the socket then use the routing table associated with the VRF
device. An important feature of the VRF device implementation is that it
impacts only Layer 3 and above so L2 tools (e.g., LLDP) are not affected
(ie., they do not need to be run in each VRF). The design also allows
the use of higher priority ip rules (Policy Based Routing, PBR) to take
precedence over the VRF device rules directing specific traffic as desired.”…””}”(hhêhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KhhÉhžhubhÛ)”}”(hX  In addition, VRF devices allow VRFs to be nested within namespaces. For
example network namespaces provide separation of network interfaces at the
device layer, VLANs on the interfaces within a namespace provide L2 separation
and then VRF devices provide L3 separation.”h]”hX  In addition, VRF devices allow VRFs to be nested within namespaces. For
example network namespaces provide separation of network interfaces at the
device layer, VLANs on the interfaces within a namespace provide L2 separation
and then VRF devices provide L3 separation.”…””}”(hhøhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KhhÉhžhubhµ)”}”(hhh]”(hº)”}”(hŒDesign”h]”hŒDesign”…””}”(hj	  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj  hžhhŸh³h KubhÛ)”}”(hŒnA VRF device is created with an associated route table. Network interfaces
are then enslaved to a VRF device::”h]”hŒmA VRF device is created with an associated route table. Network interfaces
are then enslaved to a VRF device:”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Khj  hžhubhŒliteral_block”“”)”}”(hX™  +-----------------------------+
|           vrf-blue          |  ===> route table 10
+-----------------------------+
   |        |            |
+------+ +------+     +-------------+
| eth1 | | eth2 | ... |    bond1    |
+------+ +------+     +-------------+
                         |       |
                     +------+ +------+
                     | eth8 | | eth9 |
                     +------+ +------+”h]”hX™  +-----------------------------+
|           vrf-blue          |  ===> route table 10
+-----------------------------+
   |        |            |
+------+ +------+     +-------------+
| eth1 | | eth2 | ... |    bond1    |
+------+ +------+     +-------------+
                         |       |
                     +------+ +------+
                     | eth8 | | eth9 |
                     +------+ +------+”…””}”hj'  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h K"hj  hžhubhÛ)”}”(hX  Packets received on an enslaved device and are switched to the VRF device
in the IPv4 and IPv6 processing stacks giving the impression that packets
flow through the VRF device. Similarly on egress routing rules are used to
send packets to the VRF device driver before getting sent out the actual
interface. This allows tcpdump on a VRF device to capture all packets into
and out of the VRF as a whole\ [1]_. Similarly, netfilter\ [2]_ and tc rules
can be applied using the VRF device to specify rules that apply to the VRF
domain as a whole.”h]”(hX’  Packets received on an enslaved device and are switched to the VRF device
in the IPv4 and IPv6 processing stacks giving the impression that packets
flow through the VRF device. Similarly on egress routing rules are used to
send packets to the VRF device driver before getting sent out the actual
interface. This allows tcpdump on a VRF device to capture all packets into
and out of the VRF as a whole  ”…””}”(hj5  hžhhŸNh NubhŒfootnote_reference”“”)”}”(hŒ[1]_”h]”hŒ1”…””}”(hj?  hžhhŸNh Nubah}”(h]”Œid1”ah ]”h"]”h$]”h&]”Œrefid”Œid3”Œdocname”Œnetworking/vrf”uh1j=  hj5  Œresolved”KubhŒ. Similarly, netfilter  ”…””}”(hj5  hžhhŸNh Nubj>  )”}”(hŒ[2]_”h]”hŒ2”…””}”(hjW  hžhhŸNh Nubah}”(h]”Œid2”ah ]”h"]”h$]”h&]”jN  Œid4”jP  jQ  uh1j=  hj5  jR  KubhŒk and tc rules
can be applied using the VRF device to specify rules that apply to the VRF
domain as a whole.”…””}”(hj5  hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K.hj  hžhubhŒfootnote”“”)”}”(hŒ›Packets in the forwarded state do not flow through the device, so those
packets are not seen by tcpdump. Will revisit this limitation in a
future release.
”h]”(hŒlabel”“”)”}”(hŒ1”h]”hŒ1”…””}”(hjy  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jw  hjs  ubhÛ)”}”(hŒšPackets in the forwarded state do not flow through the device, so those
packets are not seen by tcpdump. Will revisit this limitation in a
future release.”h]”hŒšPackets in the forwarded state do not flow through the device, so those
packets are not seen by tcpdump. Will revisit this limitation in a
future release.”…””}”(hj‡  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K7hjs  ubeh}”(h]”jO  ah ]”h"]”Œ1”ah$]”h&]”jI  ajP  jQ  uh1jq  hŸh³h K7hj  hžhjR  Kubjr  )”}”(hX  Iptables on ingress supports PREROUTING with skb->dev set to the real
ingress device and both INPUT and PREROUTING rules with skb->dev set to
the VRF device. For egress POSTROUTING and OUTPUT rules can be written
using either the VRF device or real egress device.
”h]”(jx  )”}”(hŒ2”h]”hŒ2”…””}”(hj   hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jw  hjœ  ubhÛ)”}”(hX  Iptables on ingress supports PREROUTING with skb->dev set to the real
ingress device and both INPUT and PREROUTING rules with skb->dev set to
the VRF device. For egress POSTROUTING and OUTPUT rules can be written
using either the VRF device or real egress device.”h]”hX  Iptables on ingress supports PREROUTING with skb->dev set to the real
ingress device and both INPUT and PREROUTING rules with skb->dev set to
the VRF device. For egress POSTROUTING and OUTPUT rules can be written
using either the VRF device or real egress device.”…””}”(hj®  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K;hjœ  ubeh}”(h]”jf  ah ]”h"]”Œ2”ah$]”h&]”ja  ajP  jQ  uh1jq  hŸh³h K;hj  hžhjR  Kubeh}”(h]”Œdesign”ah ]”h"]”Œdesign”ah$]”h&]”uh1h´hhÉhžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒSetup”h]”hŒSetup”…””}”(hjÎ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjË  hžhhŸh³h KAubhŒenumerated_list”“”)”}”(hhh]”(hŒ	list_item”“”)”}”(hŒVRF device is created with an association to a FIB table.
e.g,::

     ip link add vrf-blue type vrf table 10
     ip link set dev vrf-blue up
”h]”(hÛ)”}”(hŒ@VRF device is created with an association to a FIB table.
e.g,::”h]”hŒ?VRF device is created with an association to a FIB table.
e.g,:”…””}”(hjç  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KBhjã  ubj&  )”}”(hŒBip link add vrf-blue type vrf table 10
ip link set dev vrf-blue up”h]”hŒBip link add vrf-blue type vrf table 10
ip link set dev vrf-blue up”…””}”hjõ  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h KEhjã  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjÞ  hžhhŸh³h Nubjâ  )”}”(hXî  An l3mdev FIB rule directs lookups to the table associated with the device.
A single l3mdev rule is sufficient for all VRFs. The VRF device adds the
l3mdev rule for IPv4 and IPv6 when the first device is created with a
default preference of 1000. Users may delete the rule if desired and add
with a different priority or install per-VRF rules.

Prior to the v4.8 kernel iif and oif rules are needed for each VRF device::

    ip ru add oif vrf-blue table 10
    ip ru add iif vrf-blue table 10
”h]”(hÛ)”}”(hXW  An l3mdev FIB rule directs lookups to the table associated with the device.
A single l3mdev rule is sufficient for all VRFs. The VRF device adds the
l3mdev rule for IPv4 and IPv6 when the first device is created with a
default preference of 1000. Users may delete the rule if desired and add
with a different priority or install per-VRF rules.”h]”hXW  An l3mdev FIB rule directs lookups to the table associated with the device.
A single l3mdev rule is sufficient for all VRFs. The VRF device adds the
l3mdev rule for IPv4 and IPv6 when the first device is created with a
default preference of 1000. Users may delete the rule if desired and add
with a different priority or install per-VRF rules.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KHhj	  ubhÛ)”}”(hŒKPrior to the v4.8 kernel iif and oif rules are needed for each VRF device::”h]”hŒJPrior to the v4.8 kernel iif and oif rules are needed for each VRF device:”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KNhj	  ubj&  )”}”(hŒ?ip ru add oif vrf-blue table 10
ip ru add iif vrf-blue table 10”h]”hŒ?ip ru add oif vrf-blue table 10
ip ru add iif vrf-blue table 10”…””}”hj)  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h KPhj	  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjÞ  hžhhŸh³h Nubjâ  )”}”(hX  Set the default route for the table (and hence default route for the VRF)::

    ip route add table 10 unreachable default metric 4278198272

This high metric value ensures that the default unreachable route can
be overridden by a routing protocol suite.  FRRouting interprets
kernel metrics as a combined admin distance (upper byte) and priority
(lower 3 bytes).  Thus the above metric translates to [255/8192].
”h]”(hÛ)”}”(hŒKSet the default route for the table (and hence default route for the VRF)::”h]”hŒJSet the default route for the table (and hence default route for the VRF):”…””}”(hjA  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KShj=  ubj&  )”}”(hŒ;ip route add table 10 unreachable default metric 4278198272”h]”hŒ;ip route add table 10 unreachable default metric 4278198272”…””}”hjO  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h KUhj=  ubhÛ)”}”(hX  This high metric value ensures that the default unreachable route can
be overridden by a routing protocol suite.  FRRouting interprets
kernel metrics as a combined admin distance (upper byte) and priority
(lower 3 bytes).  Thus the above metric translates to [255/8192].”h]”hX  This high metric value ensures that the default unreachable route can
be overridden by a routing protocol suite.  FRRouting interprets
kernel metrics as a combined admin distance (upper byte) and priority
(lower 3 bytes).  Thus the above metric translates to [255/8192].”…””}”(hj]  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KWhj=  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjÞ  hžhhŸh³h Nubjâ  )”}”(hXÿ  Enslave L3 interfaces to a VRF device::

    ip link set dev eth1 master vrf-blue

Local and connected routes for enslaved devices are automatically moved to
the table associated with VRF device. Any additional routes depending on
the enslaved device are dropped and will need to be reinserted to the VRF
FIB table following the enslavement.

The IPv6 sysctl option keep_addr_on_down can be enabled to keep IPv6 global
addresses as VRF enslavement changes::

    sysctl -w net.ipv6.conf.all.keep_addr_on_down=1
”h]”(hÛ)”}”(hŒ'Enslave L3 interfaces to a VRF device::”h]”hŒ&Enslave L3 interfaces to a VRF device:”…””}”(hju  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K\hjq  ubj&  )”}”(hŒ$ip link set dev eth1 master vrf-blue”h]”hŒ$ip link set dev eth1 master vrf-blue”…””}”hjƒ  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h K^hjq  ubhÛ)”}”(hX  Local and connected routes for enslaved devices are automatically moved to
the table associated with VRF device. Any additional routes depending on
the enslaved device are dropped and will need to be reinserted to the VRF
FIB table following the enslavement.”h]”hX  Local and connected routes for enslaved devices are automatically moved to
the table associated with VRF device. Any additional routes depending on
the enslaved device are dropped and will need to be reinserted to the VRF
FIB table following the enslavement.”…””}”(hj‘  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K`hjq  ubhÛ)”}”(hŒrThe IPv6 sysctl option keep_addr_on_down can be enabled to keep IPv6 global
addresses as VRF enslavement changes::”h]”hŒqThe IPv6 sysctl option keep_addr_on_down can be enabled to keep IPv6 global
addresses as VRF enslavement changes:”…””}”(hjŸ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kehjq  ubj&  )”}”(hŒ/sysctl -w net.ipv6.conf.all.keep_addr_on_down=1”h]”hŒ/sysctl -w net.ipv6.conf.all.keep_addr_on_down=1”…””}”hj­  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h Khhjq  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjÞ  hžhhŸh³h Nubjâ  )”}”(hŒVAdditional VRF routes are added to associated table::

    ip route add table 10 ...

”h]”(hÛ)”}”(hŒ5Additional VRF routes are added to associated table::”h]”hŒ4Additional VRF routes are added to associated table:”…””}”(hjÅ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KjhjÁ  ubj&  )”}”(hŒip route add table 10 ...”h]”hŒip route add table 10 ...”…””}”hjÓ  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h KlhjÁ  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjÞ  hžhhŸh³h Nubeh}”(h]”h ]”h"]”h$]”h&]”Œenumtype”Œarabic”Œprefix”hŒsuffix”Œ.”uh1jÜ  hjË  hžhhŸh³h KBubeh}”(h]”Œsetup”ah ]”h"]”Œsetup”ah$]”h&]”uh1h´hhÉhžhhŸh³h KAubhµ)”}”(hhh]”(hº)”}”(hŒApplications”h]”hŒApplications”…””}”(hjý  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjú  hžhhŸh³h KpubhÛ)”}”(hŒXApplications that are to work within a VRF need to bind their socket to the
VRF device::”h]”hŒWApplications that are to work within a VRF need to bind their socket to the
VRF device:”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kqhjú  hžhubj&  )”}”(hŒ@setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, dev, strlen(dev)+1);”h]”hŒ@setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, dev, strlen(dev)+1);”…””}”hj  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h Kthjú  hžhubhÛ)”}”(hŒ:or to specify the output device using cmsg and IP_PKTINFO.”h]”hŒ:or to specify the output device using cmsg and IP_PKTINFO.”…””}”(hj'  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kvhjú  hžhubhÛ)”}”(hŒ÷By default the scope of the port bindings for unbound sockets is
limited to the default VRF. That is, it will not be matched by packets
arriving on interfaces enslaved to an l3mdev and processes may bind to
the same port if they bind to an l3mdev.”h]”hŒ÷By default the scope of the port bindings for unbound sockets is
limited to the default VRF. That is, it will not be matched by packets
arriving on interfaces enslaved to an l3mdev and processes may bind to
the same port if they bind to an l3mdev.”…””}”(hj5  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kxhjú  hžhubhÛ)”}”(hŒÁTCP & UDP services running in the default VRF context (ie., not bound
to any VRF device) can work across all VRF domains by enabling the
tcp_l3mdev_accept and udp_l3mdev_accept sysctl options::”h]”hŒÀTCP & UDP services running in the default VRF context (ie., not bound
to any VRF device) can work across all VRF domains by enabling the
tcp_l3mdev_accept and udp_l3mdev_accept sysctl options:”…””}”(hjC  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K}hjú  hžhubj&  )”}”(hŒMsysctl -w net.ipv4.tcp_l3mdev_accept=1
sysctl -w net.ipv4.udp_l3mdev_accept=1”h]”hŒMsysctl -w net.ipv4.tcp_l3mdev_accept=1
sysctl -w net.ipv4.udp_l3mdev_accept=1”…””}”hjQ  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h Khjú  hžhubhÛ)”}”(hX–  These options are disabled by default so that a socket in a VRF is only
selected for packets in that VRF. There is a similar option for RAW
sockets, which is enabled by default for reasons of backwards compatibility.
This is so as to specify the output device with cmsg and IP_PKTINFO, but
using a socket not bound to the corresponding VRF. This allows e.g. older ping
implementations to be run with specifying the device but without executing it
in the VRF. This option can be disabled so that packets received in a VRF
context are only handled by a raw socket bound to the VRF, and packets in the
default VRF are only handled by a socket not bound to any VRF::”h]”hX•  These options are disabled by default so that a socket in a VRF is only
selected for packets in that VRF. There is a similar option for RAW
sockets, which is enabled by default for reasons of backwards compatibility.
This is so as to specify the output device with cmsg and IP_PKTINFO, but
using a socket not bound to the corresponding VRF. This allows e.g. older ping
implementations to be run with specifying the device but without executing it
in the VRF. This option can be disabled so that packets received in a VRF
context are only handled by a raw socket bound to the VRF, and packets in the
default VRF are only handled by a socket not bound to any VRF:”…””}”(hj_  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K„hjú  hžhubj&  )”}”(hŒ&sysctl -w net.ipv4.raw_l3mdev_accept=0”h]”hŒ&sysctl -w net.ipv4.raw_l3mdev_accept=0”…””}”hjm  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h KŽhjú  hžhubhÛ)”}”(hŒunetfilter rules on the VRF device can be used to limit access to services
running in the default VRF context as well.”h]”hŒunetfilter rules on the VRF device can be used to limit access to services
running in the default VRF context as well.”…””}”(hj{  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Khjú  hžhubhÛ)”}”(hX|  Using VRF-aware applications (applications which simultaneously create sockets
outside and inside VRFs) in conjunction with ``net.ipv4.tcp_l3mdev_accept=1``
is possible but may lead to problems in some situations. With that sysctl
value, it is unspecified which listening socket will be selected to handle
connections for VRF traffic; ie. either a socket bound to the VRF or an unbound
socket may be used to accept new connections from a VRF. This somewhat
unexpected behavior can lead to problems if sockets are configured with extra
options (ex. TCP MD5 keys) with the expectation that VRF traffic will
exclusively be handled by sockets bound to VRFs, as would be the case with
``net.ipv4.tcp_l3mdev_accept=0``. Finally and as a reminder, regardless of
which listening socket is selected, established sockets will be created in the
VRF based on the ingress interface, as documented earlier.”h]”(hŒ|Using VRF-aware applications (applications which simultaneously create sockets
outside and inside VRFs) in conjunction with ”…””}”(hj‰  hžhhŸNh NubhŒliteral”“”)”}”(hŒ ``net.ipv4.tcp_l3mdev_accept=1``”h]”hŒnet.ipv4.tcp_l3mdev_accept=1”…””}”(hj“  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j‘  hj‰  ubhX  
is possible but may lead to problems in some situations. With that sysctl
value, it is unspecified which listening socket will be selected to handle
connections for VRF traffic; ie. either a socket bound to the VRF or an unbound
socket may be used to accept new connections from a VRF. This somewhat
unexpected behavior can lead to problems if sockets are configured with extra
options (ex. TCP MD5 keys) with the expectation that VRF traffic will
exclusively be handled by sockets bound to VRFs, as would be the case with
”…””}”(hj‰  hžhhŸNh Nubj’  )”}”(hŒ ``net.ipv4.tcp_l3mdev_accept=0``”h]”hŒnet.ipv4.tcp_l3mdev_accept=0”…””}”(hj¥  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j‘  hj‰  ubhŒ´. Finally and as a reminder, regardless of
which listening socket is selected, established sockets will be created in the
VRF based on the ingress interface, as documented earlier.”…””}”(hj‰  hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K“hjú  hžhubeh}”(h]”Œapplications”ah ]”h"]”Œapplications”ah$]”h&]”uh1h´hhÉhžhhŸh³h Kpubeh}”(h]”Œthe-vrf-device”ah ]”h"]”Œthe vrf device”ah$]”h&]”uh1h´hh¶hžhhŸh³h KubhŒ
transition”“”)”}”(hŒP--------------------------------------------------------------------------------”h]”h}”(h]”h ]”h"]”h$]”h&]”uh1jÍ  hŸh³h K hh¶hžhubhµ)”}”(hhh]”(hº)”}”(hŒUsing iproute2 for VRFs”h]”hŒUsing iproute2 for VRFs”…””}”(hjÜ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjÙ  hžhhŸh³h K£ubhÛ)”}”(hŒ³iproute2 supports the vrf keyword as of v4.7. For backwards compatibility this
section lists both commands where appropriate -- with the vrf keyword and the
older form without it.”h]”hŒ³iproute2 supports the vrf keyword as of v4.7. For backwards compatibility this
section lists both commands where appropriate -- with the vrf keyword and the
older form without it.”…””}”(hjê  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K¤hjÙ  hžhubjÝ  )”}”(hhh]”(jâ  )”}”(hX  Create a VRF

To instantiate a VRF device and associate it with a table::

    $ ip link add dev NAME type vrf table ID

As of v4.8 the kernel supports the l3mdev FIB rule where a single rule
covers all VRFs. The l3mdev rule is created for IPv4 and IPv6 on first
device create.
”h]”(hÛ)”}”(hŒCreate a VRF”h]”hŒCreate a VRF”…””}”(hjÿ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K¨hjû  ubhÛ)”}”(hŒ;To instantiate a VRF device and associate it with a table::”h]”hŒ:To instantiate a VRF device and associate it with a table:”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kªhjû  ubj&  )”}”(hŒ($ ip link add dev NAME type vrf table ID”h]”hŒ($ ip link add dev NAME type vrf table ID”…””}”hj  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h K¬hjû  ubhÛ)”}”(hŒœAs of v4.8 the kernel supports the l3mdev FIB rule where a single rule
covers all VRFs. The l3mdev rule is created for IPv4 and IPv6 on first
device create.”h]”hŒœAs of v4.8 the kernel supports the l3mdev FIB rule where a single rule
covers all VRFs. The l3mdev rule is created for IPv4 and IPv6 on first
device create.”…””}”(hj)  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K®hjû  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjø  hžhhŸh³h Nubjâ  )”}”(hX«  List VRFs

To list VRFs that have been created::

    $ ip [-d] link show type vrf
      NOTE: The -d option is needed to show the table id

For example::

    $ ip -d link show type vrf
    11: mgmt: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
        link/ether 72:b3:ba:91:e2:24 brd ff:ff:ff:ff:ff:ff promiscuity 0
        vrf table 1 addrgenmode eui64
    12: red: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
        link/ether b6:6f:6e:f6:da:73 brd ff:ff:ff:ff:ff:ff promiscuity 0
        vrf table 10 addrgenmode eui64
    13: blue: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
        link/ether 36:62:e8:7d:bb:8c brd ff:ff:ff:ff:ff:ff promiscuity 0
        vrf table 66 addrgenmode eui64
    14: green: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
        link/ether e6:28:b8:63:70:bb brd ff:ff:ff:ff:ff:ff promiscuity 0
        vrf table 81 addrgenmode eui64


Or in brief output::

    $ ip -br link show type vrf
    mgmt         UP             72:b3:ba:91:e2:24 <NOARP,MASTER,UP,LOWER_UP>
    red          UP             b6:6f:6e:f6:da:73 <NOARP,MASTER,UP,LOWER_UP>
    blue         UP             36:62:e8:7d:bb:8c <NOARP,MASTER,UP,LOWER_UP>
    green        UP             e6:28:b8:63:70:bb <NOARP,MASTER,UP,LOWER_UP>

”h]”(hÛ)”}”(hŒ	List VRFs”h]”hŒ	List VRFs”…””}”(hjA  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K²hj=  ubhÛ)”}”(hŒ%To list VRFs that have been created::”h]”hŒ$To list VRFs that have been created:”…””}”(hjO  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K´hj=  ubj&  )”}”(hŒQ$ ip [-d] link show type vrf
  NOTE: The -d option is needed to show the table id”h]”hŒQ$ ip [-d] link show type vrf
  NOTE: The -d option is needed to show the table id”…””}”hj]  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h K¶hj=  ubhÛ)”}”(hŒFor example::”h]”hŒFor example:”…””}”(hjk  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K¹hj=  ubj&  )”}”(hXm  $ ip -d link show type vrf
11: mgmt: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 72:b3:ba:91:e2:24 brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 1 addrgenmode eui64
12: red: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether b6:6f:6e:f6:da:73 brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 10 addrgenmode eui64
13: blue: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 36:62:e8:7d:bb:8c brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 66 addrgenmode eui64
14: green: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether e6:28:b8:63:70:bb brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 81 addrgenmode eui64”h]”hXm  $ ip -d link show type vrf
11: mgmt: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 72:b3:ba:91:e2:24 brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 1 addrgenmode eui64
12: red: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether b6:6f:6e:f6:da:73 brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 10 addrgenmode eui64
13: blue: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 36:62:e8:7d:bb:8c brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 66 addrgenmode eui64
14: green: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether e6:28:b8:63:70:bb brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 81 addrgenmode eui64”…””}”hjy  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h K»hj=  ubhÛ)”}”(hŒOr in brief output::”h]”hŒOr in brief output:”…””}”(hj‡  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KÊhj=  ubj&  )”}”(hX?  $ ip -br link show type vrf
mgmt         UP             72:b3:ba:91:e2:24 <NOARP,MASTER,UP,LOWER_UP>
red          UP             b6:6f:6e:f6:da:73 <NOARP,MASTER,UP,LOWER_UP>
blue         UP             36:62:e8:7d:bb:8c <NOARP,MASTER,UP,LOWER_UP>
green        UP             e6:28:b8:63:70:bb <NOARP,MASTER,UP,LOWER_UP>”h]”hX?  $ ip -br link show type vrf
mgmt         UP             72:b3:ba:91:e2:24 <NOARP,MASTER,UP,LOWER_UP>
red          UP             b6:6f:6e:f6:da:73 <NOARP,MASTER,UP,LOWER_UP>
blue         UP             36:62:e8:7d:bb:8c <NOARP,MASTER,UP,LOWER_UP>
green        UP             e6:28:b8:63:70:bb <NOARP,MASTER,UP,LOWER_UP>”…””}”hj•  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h KÌhj=  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjø  hžhhŸh³h Nubjâ  )”}”(hXK  Assign a Network Interface to a VRF

Network interfaces are assigned to a VRF by enslaving the netdevice to a
VRF device::

    $ ip link set dev NAME master NAME

On enslavement connected and local routes are automatically moved to the
table associated with the VRF device.

For example::

    $ ip link set dev eth0 master mgmt

”h]”(hÛ)”}”(hŒ#Assign a Network Interface to a VRF”h]”hŒ#Assign a Network Interface to a VRF”…””}”(hj­  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KÓhj©  ubhÛ)”}”(hŒUNetwork interfaces are assigned to a VRF by enslaving the netdevice to a
VRF device::”h]”hŒTNetwork interfaces are assigned to a VRF by enslaving the netdevice to a
VRF device:”…””}”(hj»  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KÕhj©  ubj&  )”}”(hŒ"$ ip link set dev NAME master NAME”h]”hŒ"$ ip link set dev NAME master NAME”…””}”hjÉ  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h KØhj©  ubhÛ)”}”(hŒnOn enslavement connected and local routes are automatically moved to the
table associated with the VRF device.”h]”hŒnOn enslavement connected and local routes are automatically moved to the
table associated with the VRF device.”…””}”(hj×  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KÚhj©  ubhÛ)”}”(hŒFor example::”h]”hŒFor example:”…””}”(hjå  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KÝhj©  ubj&  )”}”(hŒ"$ ip link set dev eth0 master mgmt”h]”hŒ"$ ip link set dev eth0 master mgmt”…””}”hjó  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h Kßhj©  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjø  hžhhŸh³h Nubjâ  )”}”(hXM  Show Devices Assigned to a VRF

To show devices that have been assigned to a specific VRF add the master
option to the ip command::

    $ ip link show vrf NAME
    $ ip link show master NAME

For example::

    $ ip link show vrf red
    3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
        link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
    4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
        link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
    7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN mode DEFAULT group default qlen 1000
        link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff


Or using the brief output::

    $ ip -br link show vrf red
    eth1             UP             02:00:00:00:02:02 <BROADCAST,MULTICAST,UP,LOWER_UP>
    eth2             UP             02:00:00:00:02:03 <BROADCAST,MULTICAST,UP,LOWER_UP>
    eth5             DOWN           02:00:00:00:02:06 <BROADCAST,MULTICAST>

”h]”(hÛ)”}”(hŒShow Devices Assigned to a VRF”h]”hŒShow Devices Assigned to a VRF”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kâhj  ubhÛ)”}”(hŒcTo show devices that have been assigned to a specific VRF add the master
option to the ip command::”h]”hŒbTo show devices that have been assigned to a specific VRF add the master
option to the ip command:”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kähj  ubj&  )”}”(hŒ2$ ip link show vrf NAME
$ ip link show master NAME”h]”hŒ2$ ip link show vrf NAME
$ ip link show master NAME”…””}”hj'  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h Kçhj  ubhÛ)”}”(hŒFor example::”h]”hŒFor example:”…””}”(hj5  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kêhj  ubj&  )”}”(hX%  $ ip link show vrf red
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
    link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
    link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN mode DEFAULT group default qlen 1000
    link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff”h]”hX%  $ ip link show vrf red
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
    link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
    link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN mode DEFAULT group default qlen 1000
    link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff”…””}”hjC  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h Kìhj  ubhÛ)”}”(hŒOr using the brief output::”h]”hŒOr using the brief output:”…””}”(hjQ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kõhj  ubj&  )”}”(hX
  $ ip -br link show vrf red
eth1             UP             02:00:00:00:02:02 <BROADCAST,MULTICAST,UP,LOWER_UP>
eth2             UP             02:00:00:00:02:03 <BROADCAST,MULTICAST,UP,LOWER_UP>
eth5             DOWN           02:00:00:00:02:06 <BROADCAST,MULTICAST>”h]”hX
  $ ip -br link show vrf red
eth1             UP             02:00:00:00:02:02 <BROADCAST,MULTICAST,UP,LOWER_UP>
eth2             UP             02:00:00:00:02:03 <BROADCAST,MULTICAST,UP,LOWER_UP>
eth5             DOWN           02:00:00:00:02:06 <BROADCAST,MULTICAST>”…””}”hj_  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h K÷hj  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjø  hžhhŸh³h Nubjâ  )”}”(hXÜ  Show Neighbor Entries for a VRF

To list neighbor entries associated with devices enslaved to a VRF device
add the master option to the ip command::

    $ ip [-6] neigh show vrf NAME
    $ ip [-6] neigh show master NAME

For example::

    $  ip neigh show vrf red
    10.2.1.254 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE
    10.2.2.254 dev eth2 lladdr 5e:54:01:6a:ee:80 REACHABLE

    $ ip -6 neigh show vrf red
    2002:1::64 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE

”h]”(hÛ)”}”(hŒShow Neighbor Entries for a VRF”h]”hŒShow Neighbor Entries for a VRF”…””}”(hjw  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kýhjs  ubhÛ)”}”(hŒsTo list neighbor entries associated with devices enslaved to a VRF device
add the master option to the ip command::”h]”hŒrTo list neighbor entries associated with devices enslaved to a VRF device
add the master option to the ip command:”…””}”(hj…  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kÿhjs  ubj&  )”}”(hŒ>$ ip [-6] neigh show vrf NAME
$ ip [-6] neigh show master NAME”h]”hŒ>$ ip [-6] neigh show vrf NAME
$ ip [-6] neigh show master NAME”…””}”hj“  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h Mhjs  ubhÛ)”}”(hŒFor example::”h]”hŒFor example:”…””}”(hj¡  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Mhjs  ubj&  )”}”(hŒÙ$  ip neigh show vrf red
10.2.1.254 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE
10.2.2.254 dev eth2 lladdr 5e:54:01:6a:ee:80 REACHABLE

$ ip -6 neigh show vrf red
2002:1::64 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE”h]”hŒÙ$  ip neigh show vrf red
10.2.1.254 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE
10.2.2.254 dev eth2 lladdr 5e:54:01:6a:ee:80 REACHABLE

$ ip -6 neigh show vrf red
2002:1::64 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE”…””}”hj¯  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h Mhjs  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjø  hžhhŸh³h Nubjâ  )”}”(hXD  Show Addresses for a VRF

To show addresses for interfaces associated with a VRF add the master
option to the ip command::

    $ ip addr show vrf NAME
    $ ip addr show master NAME

For example::

     $ ip addr show vrf red
     3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
         link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
         inet 10.2.1.2/24 brd 10.2.1.255 scope global eth1
            valid_lft forever preferred_lft forever
         inet6 2002:1::2/120 scope global
            valid_lft forever preferred_lft forever
         inet6 fe80::ff:fe00:202/64 scope link
            valid_lft forever preferred_lft forever
     4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
         link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
         inet 10.2.2.2/24 brd 10.2.2.255 scope global eth2
            valid_lft forever preferred_lft forever
         inet6 2002:2::2/120 scope global
            valid_lft forever preferred_lft forever
         inet6 fe80::ff:fe00:203/64 scope link
            valid_lft forever preferred_lft forever
     7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN group default qlen 1000
         link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff

Or in brief format::

     $ ip -br addr show vrf red
     eth1             UP             10.2.1.2/24 2002:1::2/120 fe80::ff:fe00:202/64
     eth2             UP             10.2.2.2/24 2002:2::2/120 fe80::ff:fe00:203/64
     eth5             DOWN

”h]”(hÛ)”}”(hŒShow Addresses for a VRF”h]”hŒShow Addresses for a VRF”…””}”(hjÇ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h MhjÃ  ubhÛ)”}”(hŒ`To show addresses for interfaces associated with a VRF add the master
option to the ip command::”h]”hŒ_To show addresses for interfaces associated with a VRF add the master
option to the ip command:”…””}”(hjÕ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h MhjÃ  ubj&  )”}”(hŒ2$ ip addr show vrf NAME
$ ip addr show master NAME”h]”hŒ2$ ip addr show vrf NAME
$ ip addr show master NAME”…””}”hjã  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h MhjÃ  ubhÛ)”}”(hŒFor example::”h]”hŒFor example:”…””}”(hjñ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h MhjÃ  ubj&  )”}”(hX"  $ ip addr show vrf red
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
    link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
    inet 10.2.1.2/24 brd 10.2.1.255 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 2002:1::2/120 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::ff:fe00:202/64 scope link
       valid_lft forever preferred_lft forever
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
    link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
    inet 10.2.2.2/24 brd 10.2.2.255 scope global eth2
       valid_lft forever preferred_lft forever
    inet6 2002:2::2/120 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::ff:fe00:203/64 scope link
       valid_lft forever preferred_lft forever
7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN group default qlen 1000
    link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff”h]”hX"  $ ip addr show vrf red
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
    link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
    inet 10.2.1.2/24 brd 10.2.1.255 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 2002:1::2/120 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::ff:fe00:202/64 scope link
       valid_lft forever preferred_lft forever
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
    link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
    inet 10.2.2.2/24 brd 10.2.2.255 scope global eth2
       valid_lft forever preferred_lft forever
    inet6 2002:2::2/120 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::ff:fe00:203/64 scope link
       valid_lft forever preferred_lft forever
7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN group default qlen 1000
    link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff”…””}”hjÿ  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h MhjÃ  ubhÛ)”}”(hŒOr in brief format::”h]”hŒOr in brief format:”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h M-hjÃ  ubj&  )”}”(hŒÎ$ ip -br addr show vrf red
eth1             UP             10.2.1.2/24 2002:1::2/120 fe80::ff:fe00:202/64
eth2             UP             10.2.2.2/24 2002:2::2/120 fe80::ff:fe00:203/64
eth5             DOWN”h]”hŒÎ$ ip -br addr show vrf red
eth1             UP             10.2.1.2/24 2002:1::2/120 fe80::ff:fe00:202/64
eth2             UP             10.2.2.2/24 2002:2::2/120 fe80::ff:fe00:203/64
eth5             DOWN”…””}”hj  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h M/hjÃ  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjø  hžhhŸh³h Nubjâ  )”}”(hXJ  Show Routes for a VRF

To show routes for a VRF use the ip command to display the table associated
with the VRF device::

    $ ip [-6] route show vrf NAME
    $ ip [-6] route show table ID

For example::

     $ ip route show vrf red
     unreachable default  metric 4278198272
     broadcast 10.2.1.0 dev eth1  proto kernel  scope link  src 10.2.1.2
     10.2.1.0/24 dev eth1  proto kernel  scope link  src 10.2.1.2
     local 10.2.1.2 dev eth1  proto kernel  scope host  src 10.2.1.2
     broadcast 10.2.1.255 dev eth1  proto kernel  scope link  src 10.2.1.2
     broadcast 10.2.2.0 dev eth2  proto kernel  scope link  src 10.2.2.2
     10.2.2.0/24 dev eth2  proto kernel  scope link  src 10.2.2.2
     local 10.2.2.2 dev eth2  proto kernel  scope host  src 10.2.2.2
     broadcast 10.2.2.255 dev eth2  proto kernel  scope link  src 10.2.2.2

     $ ip -6 route show vrf red
     local 2002:1:: dev lo  proto none  metric 0  pref medium
     local 2002:1::2 dev lo  proto none  metric 0  pref medium
     2002:1::/120 dev eth1  proto kernel  metric 256  pref medium
     local 2002:2:: dev lo  proto none  metric 0  pref medium
     local 2002:2::2 dev lo  proto none  metric 0  pref medium
     2002:2::/120 dev eth2  proto kernel  metric 256  pref medium
     local fe80:: dev lo  proto none  metric 0  pref medium
     local fe80:: dev lo  proto none  metric 0  pref medium
     local fe80::ff:fe00:202 dev lo  proto none  metric 0  pref medium
     local fe80::ff:fe00:203 dev lo  proto none  metric 0  pref medium
     fe80::/64 dev eth1  proto kernel  metric 256  pref medium
     fe80::/64 dev eth2  proto kernel  metric 256  pref medium
     ff00::/8 dev red  metric 256  pref medium
     ff00::/8 dev eth1  metric 256  pref medium
     ff00::/8 dev eth2  metric 256  pref medium
     unreachable default dev lo  metric 4278198272  error -101 pref medium
”h]”(hÛ)”}”(hŒShow Routes for a VRF”h]”hŒShow Routes for a VRF”…””}”(hj3  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h M5hj/  ubhÛ)”}”(hŒaTo show routes for a VRF use the ip command to display the table associated
with the VRF device::”h]”hŒ`To show routes for a VRF use the ip command to display the table associated
with the VRF device:”…””}”(hjA  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h M7hj/  ubj&  )”}”(hŒ;$ ip [-6] route show vrf NAME
$ ip [-6] route show table ID”h]”hŒ;$ ip [-6] route show vrf NAME
$ ip [-6] route show table ID”…””}”hjO  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h M:hj/  ubhÛ)”}”(hŒFor example::”h]”hŒFor example:”…””}”(hj]  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h M=hj/  ubj&  )”}”(hXô  $ ip route show vrf red
unreachable default  metric 4278198272
broadcast 10.2.1.0 dev eth1  proto kernel  scope link  src 10.2.1.2
10.2.1.0/24 dev eth1  proto kernel  scope link  src 10.2.1.2
local 10.2.1.2 dev eth1  proto kernel  scope host  src 10.2.1.2
broadcast 10.2.1.255 dev eth1  proto kernel  scope link  src 10.2.1.2
broadcast 10.2.2.0 dev eth2  proto kernel  scope link  src 10.2.2.2
10.2.2.0/24 dev eth2  proto kernel  scope link  src 10.2.2.2
local 10.2.2.2 dev eth2  proto kernel  scope host  src 10.2.2.2
broadcast 10.2.2.255 dev eth2  proto kernel  scope link  src 10.2.2.2

$ ip -6 route show vrf red
local 2002:1:: dev lo  proto none  metric 0  pref medium
local 2002:1::2 dev lo  proto none  metric 0  pref medium
2002:1::/120 dev eth1  proto kernel  metric 256  pref medium
local 2002:2:: dev lo  proto none  metric 0  pref medium
local 2002:2::2 dev lo  proto none  metric 0  pref medium
2002:2::/120 dev eth2  proto kernel  metric 256  pref medium
local fe80:: dev lo  proto none  metric 0  pref medium
local fe80:: dev lo  proto none  metric 0  pref medium
local fe80::ff:fe00:202 dev lo  proto none  metric 0  pref medium
local fe80::ff:fe00:203 dev lo  proto none  metric 0  pref medium
fe80::/64 dev eth1  proto kernel  metric 256  pref medium
fe80::/64 dev eth2  proto kernel  metric 256  pref medium
ff00::/8 dev red  metric 256  pref medium
ff00::/8 dev eth1  metric 256  pref medium
ff00::/8 dev eth2  metric 256  pref medium
unreachable default dev lo  metric 4278198272  error -101 pref medium”h]”hXô  $ ip route show vrf red
unreachable default  metric 4278198272
broadcast 10.2.1.0 dev eth1  proto kernel  scope link  src 10.2.1.2
10.2.1.0/24 dev eth1  proto kernel  scope link  src 10.2.1.2
local 10.2.1.2 dev eth1  proto kernel  scope host  src 10.2.1.2
broadcast 10.2.1.255 dev eth1  proto kernel  scope link  src 10.2.1.2
broadcast 10.2.2.0 dev eth2  proto kernel  scope link  src 10.2.2.2
10.2.2.0/24 dev eth2  proto kernel  scope link  src 10.2.2.2
local 10.2.2.2 dev eth2  proto kernel  scope host  src 10.2.2.2
broadcast 10.2.2.255 dev eth2  proto kernel  scope link  src 10.2.2.2

$ ip -6 route show vrf red
local 2002:1:: dev lo  proto none  metric 0  pref medium
local 2002:1::2 dev lo  proto none  metric 0  pref medium
2002:1::/120 dev eth1  proto kernel  metric 256  pref medium
local 2002:2:: dev lo  proto none  metric 0  pref medium
local 2002:2::2 dev lo  proto none  metric 0  pref medium
2002:2::/120 dev eth2  proto kernel  metric 256  pref medium
local fe80:: dev lo  proto none  metric 0  pref medium
local fe80:: dev lo  proto none  metric 0  pref medium
local fe80::ff:fe00:202 dev lo  proto none  metric 0  pref medium
local fe80::ff:fe00:203 dev lo  proto none  metric 0  pref medium
fe80::/64 dev eth1  proto kernel  metric 256  pref medium
fe80::/64 dev eth2  proto kernel  metric 256  pref medium
ff00::/8 dev red  metric 256  pref medium
ff00::/8 dev eth1  metric 256  pref medium
ff00::/8 dev eth2  metric 256  pref medium
unreachable default dev lo  metric 4278198272  error -101 pref medium”…””}”hjk  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h M?hj/  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjø  hžhhŸh³h Nubjâ  )”}”(hX›  Route Lookup for a VRF

A test route lookup can be done for a VRF::

    $ ip [-6] route get vrf NAME ADDRESS
    $ ip [-6] route get oif NAME ADDRESS

For example::

     $ ip route get 10.2.1.40 vrf red
     10.2.1.40 dev eth1  table red  src 10.2.1.2
         cache

     $ ip -6 route get 2002:1::32 vrf red
     2002:1::32 from :: dev eth1  table red  proto kernel  src 2002:1::2  metric 256  pref medium

”h]”(hÛ)”}”(hŒRoute Lookup for a VRF”h]”hŒRoute Lookup for a VRF”…””}”(hjƒ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h M\hj  ubhÛ)”}”(hŒ+A test route lookup can be done for a VRF::”h]”hŒ*A test route lookup can be done for a VRF:”…””}”(hj‘  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h M^hj  ubj&  )”}”(hŒI$ ip [-6] route get vrf NAME ADDRESS
$ ip [-6] route get oif NAME ADDRESS”h]”hŒI$ ip [-6] route get vrf NAME ADDRESS
$ ip [-6] route get oif NAME ADDRESS”…””}”hjŸ  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h M`hj  ubhÛ)”}”(hŒFor example::”h]”hŒFor example:”…””}”(hj­  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Mchj  ubj&  )”}”(hŒÙ$ ip route get 10.2.1.40 vrf red
10.2.1.40 dev eth1  table red  src 10.2.1.2
    cache

$ ip -6 route get 2002:1::32 vrf red
2002:1::32 from :: dev eth1  table red  proto kernel  src 2002:1::2  metric 256  pref medium”h]”hŒÙ$ ip route get 10.2.1.40 vrf red
10.2.1.40 dev eth1  table red  src 10.2.1.2
    cache

$ ip -6 route get 2002:1::32 vrf red
2002:1::32 from :: dev eth1  table red  proto kernel  src 2002:1::2  metric 256  pref medium”…””}”hj»  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h Mehj  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjø  hžhhŸh³h Nubjâ  )”}”(hX=  Removing Network Interface from a VRF

Network interfaces are removed from a VRF by breaking the enslavement to
the VRF device::

    $ ip link set dev NAME nomaster

Connected routes are moved back to the default table and local entries are
moved to the local table.

For example::

 $ ip link set dev eth0 nomaster
”h]”(hÛ)”}”(hŒ%Removing Network Interface from a VRF”h]”hŒ%Removing Network Interface from a VRF”…””}”(hjÓ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h MmhjÏ  ubhÛ)”}”(hŒYNetwork interfaces are removed from a VRF by breaking the enslavement to
the VRF device::”h]”hŒXNetwork interfaces are removed from a VRF by breaking the enslavement to
the VRF device:”…””}”(hjá  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h MohjÏ  ubj&  )”}”(hŒ$ ip link set dev NAME nomaster”h]”hŒ$ ip link set dev NAME nomaster”…””}”hjï  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h MrhjÏ  ubhÛ)”}”(hŒdConnected routes are moved back to the default table and local entries are
moved to the local table.”h]”hŒdConnected routes are moved back to the default table and local entries are
moved to the local table.”…””}”(hjý  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h MthjÏ  ubhÛ)”}”(hŒFor example::”h]”hŒFor example:”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h MwhjÏ  ubj&  )”}”(hŒ$ ip link set dev eth0 nomaster”h]”hŒ$ ip link set dev eth0 nomaster”…””}”hj  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h MyhjÏ  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1já  hjø  hžhhŸh³h Nubeh}”(h]”h ]”h"]”h$]”h&]”jí  jî  jï  hjð  jñ  uh1jÜ  hjÙ  hžhhŸh³h K¨ubjÎ  )”}”(hŒP--------------------------------------------------------------------------------”h]”h}”(h]”h ]”h"]”h$]”h&]”uh1jÍ  hŸh³h M{hjÙ  hžhubhÛ)”}”(hŒCommands used in this example::”h]”hŒCommands used in this example:”…””}”(hj=  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h M}hjÙ  hžhubj&  )”}”(hX´  cat >> /etc/iproute2/rt_tables.d/vrf.conf <<EOF
1  mgmt
10 red
66 blue
81 green
EOF

function vrf_create
{
    VRF=$1
    TBID=$2

    # create VRF device
    ip link add ${VRF} type vrf table ${TBID}

    if [ "${VRF}" != "mgmt" ]; then
        ip route add table ${TBID} unreachable default metric 4278198272
    fi
    ip link set dev ${VRF} up
}

vrf_create mgmt 1
ip link set dev eth0 master mgmt

vrf_create red 10
ip link set dev eth1 master red
ip link set dev eth2 master red
ip link set dev eth5 master red

vrf_create blue 66
ip link set dev eth3 master blue

vrf_create green 81
ip link set dev eth4 master green


Interface addresses from /etc/network/interfaces:
auto eth0
iface eth0 inet static
      address 10.0.0.2
      netmask 255.255.255.0
      gateway 10.0.0.254

iface eth0 inet6 static
      address 2000:1::2
      netmask 120

auto eth1
iface eth1 inet static
      address 10.2.1.2
      netmask 255.255.255.0

iface eth1 inet6 static
      address 2002:1::2
      netmask 120

auto eth2
iface eth2 inet static
      address 10.2.2.2
      netmask 255.255.255.0

iface eth2 inet6 static
      address 2002:2::2
      netmask 120

auto eth3
iface eth3 inet static
      address 10.2.3.2
      netmask 255.255.255.0

iface eth3 inet6 static
      address 2002:3::2
      netmask 120

auto eth4
iface eth4 inet static
      address 10.2.4.2
      netmask 255.255.255.0

iface eth4 inet6 static
      address 2002:4::2
      netmask 120”h]”hX´  cat >> /etc/iproute2/rt_tables.d/vrf.conf <<EOF
1  mgmt
10 red
66 blue
81 green
EOF

function vrf_create
{
    VRF=$1
    TBID=$2

    # create VRF device
    ip link add ${VRF} type vrf table ${TBID}

    if [ "${VRF}" != "mgmt" ]; then
        ip route add table ${TBID} unreachable default metric 4278198272
    fi
    ip link set dev ${VRF} up
}

vrf_create mgmt 1
ip link set dev eth0 master mgmt

vrf_create red 10
ip link set dev eth1 master red
ip link set dev eth2 master red
ip link set dev eth5 master red

vrf_create blue 66
ip link set dev eth3 master blue

vrf_create green 81
ip link set dev eth4 master green


Interface addresses from /etc/network/interfaces:
auto eth0
iface eth0 inet static
      address 10.0.0.2
      netmask 255.255.255.0
      gateway 10.0.0.254

iface eth0 inet6 static
      address 2000:1::2
      netmask 120

auto eth1
iface eth1 inet static
      address 10.2.1.2
      netmask 255.255.255.0

iface eth1 inet6 static
      address 2002:1::2
      netmask 120

auto eth2
iface eth2 inet static
      address 10.2.2.2
      netmask 255.255.255.0

iface eth2 inet6 static
      address 2002:2::2
      netmask 120

auto eth3
iface eth3 inet static
      address 10.2.3.2
      netmask 255.255.255.0

iface eth3 inet6 static
      address 2002:3::2
      netmask 120

auto eth4
iface eth4 inet static
      address 10.2.4.2
      netmask 255.255.255.0

iface eth4 inet6 static
      address 2002:4::2
      netmask 120”…””}”hjK  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j%  hŸh³h MhjÙ  hžhubeh}”(h]”Œusing-iproute2-for-vrfs”ah ]”h"]”Œusing iproute2 for vrfs”ah$]”h&]”uh1h´hh¶hžhhŸh³h K£ubeh}”(h]”Œ"virtual-routing-and-forwarding-vrf”ah ]”h"]”Œ$virtual routing and forwarding (vrf)”ah$]”h&]”uh1h´hhhžhhŸh³h Kubeh}”(h]”h ]”h"]”h$]”h&]”Œsource”h³uh1hŒcurrent_source”NŒcurrent_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(h¹NŒ	generator”NŒ	datestamp”NŒsource_link”NŒ
source_url”NŒtoc_backlinks”Œentry”Œfootnote_backlinks”KŒsectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒstrip_classes”NŒreport_level”KŒ
halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ	traceback”ˆŒinput_encoding”Œ	utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”jŒ  Œerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œlanguage_code”Œen”Œrecord_dependencies”NŒconfig”NŒ	id_prefix”hŒauto_id_prefix”Œid”Œdump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”h³Œ_destination”NŒ_config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒraw_enabled”KŒline_length_limit”M'Œpep_references”NŒpep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒrfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ	tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œsmart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œdocinfo_xform”KŒsectsubtitle_xform”‰Œimage_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”(Œ1”]”j?  aŒ2”]”jW  auŒrefids”}”Œnameids”}”(jf  jc  jÊ  jÇ  jÈ  jÅ  j™  jO  jÀ  jf  j÷  jô  jÂ  j¿  j^  j[  uŒ	nametypes”}”(jf  ‰jÊ  ‰jÈ  ‰j™  ˆjÀ  ˆj÷  ‰jÂ  ‰j^  ‰uh}”(jc  h¶jÇ  hÉjÅ  j  jI  j?  ja  jW  jO  js  jf  jœ  jô  jË  j¿  jú  j[  jÙ  uŒfootnote_refs”}”(jÌ  ]”j?  ajÎ  ]”jW  auŒcitation_refs”}”Œautofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ	footnotes”]”(js  jœ  eŒ	citations”]”Œautofootnote_start”KŒsymbol_footnote_start”K Œ
id_counter”Œcollections”ŒCounter”“”}”jš  Ks…”R”Œparse_messages”]”Œtransform_messages”]”Œtransformer”NŒinclude_log”]”Œ
decoration”Nhžhub.