VRF-Lite provides the required Layer 3 separation by creating independent routing and forwarding instances on R1. Cisco documents that each VRF maintains its own IPv4 and IPv6 routing tables and makes routing decisions independently. Interfaces facing Department A and Department B are assigned to their respective VRFs, so a route learned or configured in one department is not automatically available to the other. The Department B VRF can contain a single default route with next hop 192.168.20.1, forcing its external traffic toward ISP-2. Department A can retain its existing routing policy and ISP reachability without exposing those paths to Department B. An MPLS VPN is unnecessary because the requirement concerns local virtualization on one router, not a provider MPLS backbone. Separate VLANs create Layer 2 broadcast-domain separation, but an ACL tied only to ISP-1 does not provide the clean, independent routing contexts required and can become difficult to maintain as routes change. Running separate routing protocols in the same global routing table also fails to guarantee isolation because installed routes still enter a common RIB and FIB unless VRFs are used. VRF-Lite therefore supplies both deterministic ISP selection and structural separation. Any intentional communication between departments would require explicit route leaking or an external policy-controlled service, preserving the default isolation specified in the design. Cisco Nexus Layer 3 virtualization guide

================