TECHNICAL BACKGROUND

In computing environments, virtual routing and forwarding (VRF) is used to allow multiple instances of a routing table on a single logical or physical router. This permits multiple network paths without the need for multiple routers or switches. For example, a first group of computing elements, such as physical computers or virtual machines, may be allocated to a first VRF, while a second group of computing elements may be allocated to a second VRF. Each of the VRFs may be associated with rules or policies that can be used to manage the communications by the computing elements allocated to the VRF.

While VRFs provide a mechanism to permit multiple network paths on a single routing device, difficulties can arise in managing the policies and rules for the different VRFs. The difficulties may be associated with allocating the rules, which may require static modification or deletion to the rules, may be associated with managing what communications are encrypted or what encryption should be used, or some other difficulty associated with configuring and maintaining VRFs across routing gateways in a computing environment.

SUMMARY

The technology described herein manages policy configurations for virtual routing and forwarding (VRF) using route targets (RTs) and unique VRF identifiers. In one implementation, a management service may identify one or more virtual routing and forwarding (VRFs) for a computing environment and may allocate a unique identifier to each of the one or more VRFs. The management service may further identify a registration of a route target (RT) to communicate with a VRF of the one or more VRFs and identify a unique identifier of the one or more unique identifiers associated with the RT. Once identified, the management service may determine whether communications associated with the RT in the VRF require intra-VRF encryption or inter-VRF encryption based on the unique identifier. If communications associated with the RT require intra-VRF encryption, the management service determines one or more intra-VRF encryption keys to an edge gateway associated with the RT. In contrast, if the management service determines that communications associated with the RT require inter-VRF encryption, the management service communicates one or more inter-VRF encryption keys to an edge gateway associated with the RT.

