A Layer 3 VRF, or Virtual Routing and Forwarding instance, is a separate routing table on the same device. It lets one router or switch keep multiple network paths isolated at the IP layer, so traffic in one VRF does not automatically mix with traffic in another. Administrators use VRFs to separate production, management, tenant, or service networks without needing separate hardware.
In cyber security, VRFs matter because they shape exposure. A service reachable in the default VRF may be reachable from a different trust zone than expected, and weak inter-VRF routing can create an internal pivot path for attackers. Defenders use VRFs to reduce blast radius, but they must still pair them with access controls, ACLs, and careful service placement. Misconfigured VRFs are a common way that “internal only” systems become reachable to an attacker moving east-west inside the network.