Introduction to VRouter

Virtual Router (VRouter) is known as VR. VR acts as a router, and different VRs have their own independent routing tables. A VR named “trust-vr” is bundled with the system, and by default all the Layer 3 security zones are bound to trust-vr automatically. System supports multiple VRs, and the max amount of supported VRs may vary from different hardware platforms. Multiple VRs divide a device into multiple virtual routers, and each of the routers utilizes and maintains their completely independent routing table. In such a case one single device is acting as multiple routers. Multiple VRs allow a device to achieve the effects of the address isolation between different route zones and address overlapping between different VRs, as well as to avoid route leaking to some extent, enhancing route security of network. For more information about the relationship between interface, security zone, VSwitch and VRouter, see the following diagram:

As shown above, the binding relationship between them are:

• Interfaces are bound to security zones. Those that are bound to Layer 2 security zones and Layer 3 security zones are known as Layer 2 interfaces and Layer 3 interfaces respectively. One interface can be only bound to one security zone; the primary interface and sub interface can belong to different security zones.
• Security zones are bound to a VSwitch or VRouter. Layer 2 security zones are bound to a VSwitch (by default the pre-defined Layer 2 security zone is bound to the default VSwitch1), and Layer 3 security zones are bound to a VRouter (by default the pre-defined Layer 3 security zone is bound to the default trust-vr), thus realizing the binding between the interfaces and VSwitch or VR. One security zone can be only bound to one VSwtich or VR.