Network & Infrastructure / BGP Policy & Internet Edge
VRF route leaking: reachable destination, unreachable return path
A shared-service prefix is imported into a tenant VRF, but application connections time out. The forward lookup succeeds while the service's return lookup has no permitted tenant route.
Environment and inputs: BGP speakers and route reflectors; policy syntax, RPKI integration and address-family behavior depend on the implementation. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Trace both lookup contexts, route-target import/export policy, next-hop resolution and stateful boundary policy. Use exact source and destination prefixes rather than a generic reachability test.
Explain the result
Route leaking changes route visibility, not every security and forwarding dependency. A unidirectional import can create a believable forward path without an authorized reverse path.
Plan the fix
Design the minimum bidirectional prefix exchange and security policy for the service. Avoid importing entire tenant tables into shared services merely to repair one missing return route.
Check the result and rollback
Validate the intended flow and a forbidden cross-tenant flow, including failover. Revert if isolation tests fail, and preserve evidence of the routing context at every boundary.