On 2/26/15 6:33 AM, Thomas Graf wrote:

E.g. A VRF in software would make use of net namespaces which holds
tenant specific ACLs, routes and QoS settings. A separate action
would fwd packets to the namespace. Easy and straight forward in
software.

namespace == L1 separation
VRF == L3 separation

Why is there an insistence that an L1 construct is appropriate for L3 
isolation? Has anyone other than 6wind actually done a 1000+ VRFs with 
the Linux stack?

David