Communication apparatus includes a plurality of interfaces and routing logic coupled between the interfaces. The routing logic includes a parser, which extracts header data from selected fields of each data packet received from the network through an ingress interface. At least one hash calculator computes a hash over a first set of the header data extracted by the parser from each received data packet. A virtual routing and forwarding (VRF) instance selector selects a VRF instance for each received data packet responsively to both an ingress indicator associated with the received data packet and a second set of the header data extracted by the parser from the received data packet. A lookup engine selects an egress interface responsively to the selected VRF instance and the computed hash. Forwarding and switching logic forwards the data packet to the selected egress interface for transmission to the network.