6.2 Routing Instances and RIB Groups

Routing Instances and RIB Groups

Enterprise campus backbones and data center fabrics frequently demand strict traffic separation across departmental tenants, guest users, out-of-band management systems, and regulatory environments. Junos OS addresses these multi-tenancy requirements through Routing Instances, which virtualize routing tables and protocols on a single physical chassis. To facilitate controlled communication between isolated instances without deploying external physical loopback cables, Junos provides Routing Information Base (RIB) Groups to selectively replicate and leak routes between tables.

---

1. Virtualization of Routing & Instance Architecture

A routing instance is a collection of routing tables, interfaces, and routing protocol processes running inside an isolated administrative domain. In the default configuration, all physical and logical interfaces belong to the global default routing instance, whose primary IPv4 unicast routing table is inet.0.

Junos Standard Routing Tables

Junos OS organizes routes into distinct tables based on protocol family and forwarding purpose:

+---------------------------------------------------------------------------------------------------+
| JUNOS STANDARD ROUTING INFORMATION BASES (RIBS)                                                   |
+-----------------------+---------------------------------------------------------------------------+
| Routing Table Name    | Primary Protocol / Forwarding Purpose                                     |
+-----------------------+---------------------------------------------------------------------------+
| inet.0                | Default global IPv4 unicast routing table                                 |
| inet6.0               | Default global IPv6 unicast routing table                                 |
| inet.1                | IPv4 multicast forwarding cache (reverse-path forwarding checks)          |
| inet.2                | IPv4 multicast BGP (MBGP) routes used for RPF verification                |
| inet.3                | MPLS path calculation table storing RSVP/LDP Label Switched Paths (LSPs)  |
| mpls.0                | MPLS label switching and swap/pop operations                              |
| <instance>.inet.0     | Custom IPv4 unicast routing table for the specified user routing instance |
| <instance>.inet6.0    | Custom IPv6 unicast routing table for the specified user routing instance |
+-----------------------+---------------------------------------------------------------------------+

When a user creates a routing instance named corp-vr, Junos automatically instantiates a dedicated routing table named corp-vr.inet.0. Routes inside corp-vr.inet.0 are completely hidden from inet.0 and from any other custom routing instance, ensuring complete tenant isolation.

---

2. Routing Instance Types

Junos OS supports multiple routing instance types, each tailored to specific networking architectures. The three instance types tested heavily on the JNCIS-ENT examination are virtual-router, vrf, and forwarding:

Configuring a virtual-router Instance

In campus networks, virtual-router is the most common deployment model because it does not require configuring MPLS signaling, BGP Route Distinguishers (RD), or Route Targets (RT):

[edit routing-instances guest-network]
user@router# set instance-type virtual-router
user@router# set interface ge-0/0/2.0
user@router# set interface irb.200
user@router# set routing-options static route 0.0.0.0/0 next-hop 192.168.200.254
user@router# set protocols ospf area 0.0.0.0 interface irb.200

When ge-0/0/2.0 and irb.200 are bound to guest-network, their connected subnet routes are automatically placed into guest-network.inet.0 rather than the global inet.0. OSPF protocol packets received on irb.200 are processed strictly within the guest-network OSPF database.

---

3. RIB Groups: Architecture and Route Leaking Mechanics

While instance isolation provides strong network boundaries, real-world enterprise architectures often require controlled inter-instance communication. For instance, isolated departmental virtual routers may require access to shared corporate DNS, Active Directory, or central internet proxy services located in inet.0.

A RIB Group is a Junos configuration structure that intercepts routes learned by a protocol, static route definition, or interface discovery process and inserts copies of those routes into multiple routing tables simultaneously.

The import-rib Statement and The Golden Ordering Rule

A RIB group is declared under the [edit routing-options rib-groups] hierarchy:

[edit routing-options rib-groups share-internet]
user@router# set import-rib [ inet.0 corp-vr.inet.0 guest-network.inet.0 ]

The Mandatory Golden Ordering Rule: The first table declared in the import-rib list must strictly be the primary routing table where the routes originate! If you are leaking routes from inet.0 into corp-vr.inet.0, inet.0 must be the first element in the bracketed list. If you reverse the order, Junos will attempt to import routes from the secondary table into the primary table, resulting in commit failures or severe route propagation anomalies.

Controlling Leaked Routes with import-policy

Without an import policy, a RIB group duplicates all routes learned by the parent protocol into every listed table. To maintain the principle of least privilege, an import-policy should always be applied to filter specifically permitted prefixes:

[edit policy-options policy-statement permit-dns-proxy]
user@router# set term allow-shared from route-filter 192.168.100.0/24 exact
user@router# set term allow-shared then accept
user@router# set term reject-others then reject

[edit routing-options rib-groups share-internet]
user@router# set import-policy permit-dns-proxy

---

4. Leaking Interface Routes and Protocol Routes

A critical trap on the JNCIS-ENT exam involves interface routes (direct and local). When a static route is leaked from inet.0 into corp-vr.inet.0, the router in corp-vr may know the remote prefix, but it cannot resolve the next-hop IP address if the connected interface subnet resides only in inet.0.

Sharing Connected Subnets via interface-routes

To ensure next-hop ARP resolution succeeds across instances, interface routes must be added to the RIB group via the interface-routes hierarchy:

[edit routing-options]
user@router# set rib-groups leak-interfaces import-rib [ inet.0 corp-vr.inet.0 ]
user@router# set interface-routes rib-group inet leak-interfaces

This configuration ensures that all directly connected subnets in inet.0 are mirrored into corp-vr.inet.0, allowing the Packet Forwarding Engine to construct valid Layer 2 frame headers for leaked transit next-hops.

Applying RIB Groups to Dynamic Routing Protocols

RIB groups can also be attached directly to dynamic routing protocols to mirror protocol-learned routes into secondary tables:

[edit protocols ospf]
user@router# set rib-group ospf-to-corp

[edit protocols bgp group external-peers]
user@router# set family inet unicast rib-group bgp-to-corp

---

5. Architectural Gotchas & Troubleshooting

1. Asymmetric Routing and One-Way Leaking: Leaking routes from inet.0 into corp-vr.inet.0 allows hosts in corp-vr to send packets toward global servers. However, unless reverse routes pointing back to corp-vr subnets are leaked into inet.0 (or a default gateway is present), return traffic from the global servers will be discarded. A valid return route is required; it can be learned or configured without necessarily using a second leak in every design.
2. Hidden Routes: If a leaked route does not appear in show route table <instance>.inet.0, issue show route table <instance>.inet.0 hidden detail. An unresolved next-hop (due to missing interface routes) is the most frequent cause of hidden leaked routes.
3. Instance Deletion Traps: Removing an interface from a routing instance immediately returns that interface to the default global instance (inet.0), which may unintentionally expose sensitive networks to global traffic.

Operational Verification Commands

user@router> show route table corp-vr.inet.0
user@router> show route instance detail corp-vr
user@router> show configuration routing-options rib-groups share-internet
user@router> show interfaces terse routing-instance guest-network

Output note: Command output shown here is a schematic teaching example, not a captured device session. Field names and feature support depend on platform and Junos release.