Measure how much route leaking between VRFs amplifies the routing table under hub, mesh or selective policy.
Leaking is implemented by importing route targets, and every imported prefix is a real FIB entry in the receiving VRF. A shared-services hub adds a fixed number of routes per VRF, while mutual full-mesh import multiplies the table by the VRF count. Route leaking is also the mechanism that quietly defeats the isolation the VRFs were built for, so the entry count is both a capacity number and a security review item.
VRF Route Leaking
Hub leaking adds VRFs × shared routes; full-mesh leaking adds n(n − 1) × routes per VRF; selective leaking adds pairs × routes per VRF.
Table amplification
amplification = (own routes + leaked routes) ÷ own routes.
Hub leaking adds VRFs × shared routes; full-mesh leaking adds n(n − 1) × routes per VRF; selective leaking adds pairs × routes per VRF. Leaking is implemented by importing route targets, and every imported prefix is a real FIB entry in the receiving VRF. A shared-services hub adds a fixed number of routes per VRF, while mutual full-mesh import multiplies the table by the VRF count.
Route leaking is also the mechanism that quietly defeats the isolation the VRFs were built for, so the entry count is both a capacity number and a security review item.
This calculator takes 5 inputs: VRFs, Routes originated per VRF, Shared-services routes each VRF imports, Leaking policy, Leaking VRF pairs (selective only). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Route the traffic through a firewall or fusion router when policy matters. Leaking gives any-to-any reachability between the leaked prefixes with no inspection point, which is rarely what a segmented design intended.