← Problem Library
Network L6 NETWORK-039 · 27 min

VRF leak design misses the import policy for a shared services subnet

The route exists in the source VRF, but shared services remain unreachable because the target VRF never imports the right route target or policy match.

NetworkPlatform ReliabilityLevel 6Pro27 min
Scenario

The route exists in the source VRF, but shared services remain unreachable because the target VRF never imports the right route target or policy match.

What to check first
  • Identify the primary failure signal in the VRF Isolation scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Choose the smallest safe recovery action first, then record the prevention work that reduces repeat incidents.

Questions worth viewing together
Why are VRF leak problems easy to misdiagnose?

The source VRF can look perfect while the target import policy still hides the route from the real consumer path.