How to Create Virtual Routing & Forwarding (VRF) for Multiple Customer Groups in a FusionHub

Starting from Firmware 8, VRF is supported on FusionHub. In IP-based computer networks, virtual routing and forwarding (VRF) is a technology that allows multiple instances of a routing table to co-exist within the same router at the same time. Because the routing instances are independent, the same or overlapping IP addresses can be used without conflicting with each other.

Each VRF has its own SpeedFusion local ID acting independently from other VRF’s as illustrated in the network diagram below.

You can create multiple VRF in one FusionHub. In each VRF, you can create SpeedFusion peers where you can serve multiple customers using a single instance of FusionHub, and they will have their own isolated network.

For example, both customer A and customer B use subnet and need a Speedfusion VPN to the same FusionHub without causing the subnets to clash.

Customer A won’t be able to communicate with customer B, they both have isolated networks while connected to the same FusionHub.

Steps to configure VRF on FusionHub.

Create a new VFR for each customer group. For our example, we have created 3 customer VRF Groups, as shown in the screenshot below:

Go to the bottom of the browser window, you can choose the different VRF that you created in order to enter the selected VRF, so that you can create its own SpeedFusion profile for that particular VRF.

From inside the VRF, you can choose VRF “Customer-A”, and define the Local ID of Customer-A VFR

Create the SpeedFusion Profile for branches as usual.

Repeat the steps above to create multiple VRF, and SpeedFusion profiles for each VRF. Then from the Dashboard, you can see the status for all SpeedFusion tunnels for each different VRF.

Setting up the branch unit (Balance/MAX) of Customer A

Setup the Local ID

Setup the SpeedFusion Profile



This seems to work fine when configuring pepvpn’s manually in remote peers.

Will it be possible in a future ICA version to manage this with automatic pepvpn’s ?

Thank you in advance.



Hello @Lai,
We would like to test this with InControl2 & SD-WAN platforms, how is this configured using the InControl2 & also the SD-WAN platforms?
Happy to Help,
Marcus :slight_smile:

@mldowling “SD-WAN platforms”, do you mean SDWC ? :+1:

Hello @Venn,

To clarify

PlatformPeplink Forum Reference
InControl2 (for Everyone to access)
SDWC (for Peplink Partners Only)

Happy to Help,
Marcus :slight_smile:

Hello @Lai & @Jason,
Any updates on how to do this with InControl2 and SDWC platforms?
Happy to Help,
Marcus :slight_smile:

1 Like

@mldowling There are no immediate plans to implement VRF in the SDWC platform. If there is a large demand for this we will add it to our list of items to implement, but at this stage it will have a low priority (ie, dont expect it anytime soon) :slight_smile:
Our InControl developers will comment if tVRF is in the planning to be added to IC2, but I suspect the reply will be similar.

1 Like

I notice that the portforwarding setting is only avaible when “no VRF” is selected.
When you have multiple VRF with same ip ranges, how is Port- Forwarding managed ?
Customer A uses
Customer B uses

1 Like


if you have a look to the first picture in the First Post …

There a different tunnels, so the FusionHub knows what to do :wink:


1 Like


thanks for the answer Dennis (not sure if meant for my message, anyway :slight_smile: )
I get that subnets don’t clash (and it actually works well), but port forwarding is not working on my FH.
Actualy, only port forwarding to SpeedFusion outside VRF are working.
I just tested it again with subnets in and out a VRF.



Could you open a support ticket to allow us to check if this is a bug or a configuration issue?



1 Like

Hi Eric,

I created a lab and opened a ticket for this issue (ticket #9080611). In my opinion this would only be possible if we would be able to apply multiple Public IP’s on the FusionHub WAN but that’s not possible if I am not wrong. Any suggestion welcome. Thank you in advance.

What is the maximum number of VRF’s and VLANS a FusionHub can have on Firmware 8.0.0 RC4 ?

1 Like

Hi everyone, I’m a little confused with this. FusionHub would only have 1 public IP address, so when you are having multiple customers all connected to the same FusionHub instance, would that not mean any of their outbound traffic through SF would all be coming from the same IP address? I’m just trying to understand where this solution would be useful as if you have multiple customers bonding multiple SIMs all through the same FusionHub, that’s not an issue that multiple people are all routing traffic via the same public IP address?

1 Like