NetworkManager 1.24版本开始支持VRF，VRF对三层网络进行隔离，类似VLAN对二层网络进行隔离。每个VRF都拥有独立的路由表，每个在VRF中的接口都可以有自己的网关或默认路由。另外VRF功能可以在一台服务器的不同接口上使用相同的IP地址而不冲突，但这些地址不能属于同一个广播域（VLAN）。
[root@localhost ~]# nmcli -v nmcli tool, version 1.28.0-0.1.el8
首先查看一下LINUX默认的路由规则，默认有3个。
[root@localhost ~]# ip rule show 0: from all lookup local 32766: from all lookup main 32767: from all lookup default
创建VRF并分配FIB表。
nmcli connection add type vrf ifname vrf-a con-name vrf-a table 101 ipv4.method disabled ipv6.method disable
nmcli connection up vrf-a
[root@localhost ~]# ip rule show 0: from all lookup local 1000: from all lookup [l3mdev-table] 32766: from all lookup main 32767: from all lookup default
#l3mdev FIB规则将查找定向到与设备关联的表,一个l3mdev规则对于所有vrf来说就足够了,默认规则表为1000。
给VRF分配接口，并配置IP地址。
nmcli connection modify ens224 master vrf-a ipv4.method manual ipv4.addresses 192.168.12.100/24 ipv4.gateway 192.168.12.254 ipv4.dns 114.114.114.114,114.114.115.115
nmcli connection up ens224
[root@localhost ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens224 TYPE=Ethernet PROXY_METHOD=none BROWSER_ONLY=no BOOTPROTO=none DEFROUTE=yes IPV4_FAILURE_FATAL=no IPV6INIT=yes IPV6_AUTOCONF=yes IPV6_DEFROUTE=yes IPV6_FAILURE_FATAL=no IPV6_ADDR_GEN_MODE=stable-privacy NAME=ens224 UUID=16ea4107-ce52-4feb-9e1f-6204f12130fd DEVICE=ens224 ONBOOT=no IPADDR=192.168.12.100 PREFIX=24 GATEWAY=192.168.12.254 DNS1=114.114.114.114 DNS2=114.114.115.115 VRF=vrf-a
[root@localhost ~]# ip route show #全局路由表 default via 192.168.11.254 dev ens192 proto static metric 100 192.168.11.0/24 dev ens192 proto kernel scope link src 192.168.11.100 metric 100 192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1 linkdown
[root@localhost ~]# ip route show vrf vrf-a #VRF路由表 default via 192.168.12.254 dev ens224 proto static metric 101 192.168.12.0/24 dev ens224 proto kernel scope link src 192.168.12.100 metric 101
[root@localhost ~]# ping -I ens192 114.114.114.114 PING 114.114.114.114 (114.114.114.114) from 192.168.11.100 ens192: 56(84) bytes of data. 64 bytes from 114.114.114.114: icmp_seq=1 ttl=70 time=15.4 ms 64 bytes from 114.114.114.114: icmp_seq=2 ttl=67 time=15.4 ms ^C --- 114.114.114.114 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 15.386/15.393/15.401/0.124 ms [root@localhost ~]# ping -I ens224 114.114.114.114 PING 114.114.114.114 (114.114.114.114) from 192.168.12.100 ens224: 56(84) bytes of data. 64 bytes from 114.114.114.114: icmp_seq=1 ttl=88 time=16.2 ms 64 bytes from 114.114.114.114: icmp_seq=2 ttl=79 time=15.4 ms
https://www.kernel.org/doc/Documentation/networking/vrf.txt