What is the difference between an RD and an RT?

A route distinguisher makes a route unique when routes from many VRFs are carried together. A route target decides which VRFs import a route. Only the RT affects reachability, and confusing the two produces designs where changing an RD is expected to change where traffic goes.

Can two VRFs use the same subnet?

Yes — that is the point of a VRF. It stops being safe the moment those two VRFs can import each other's routes, which is why the tool only flags an overlap when the matrix shows they can reach each other.

Why can my spokes not reach each other?

In hub and spoke, each spoke imports only the hub's route target, so spoke routes never reach another spoke. That is usually intentional. If you want spoke-to-spoke, either import each other's targets or route through the hub.

What does a warning about an export nobody imports mean?

That VRF is tagging its routes with a target no other VRF here asks for, so the routes reach nothing. Sometimes correct — another device may import it — and sometimes a typo in a target.

Does this configure anything?

No. It is a design model, and the syntax of real configuration varies by platform. Nothing is sent anywhere and nothing is pushed to any device.

Home › Networking › VRF Planner

VRF Planner & Route-Leak Simulator

Separate routing tables on one device. Define what each VRF holds and which route targets it imports and exports, then see which VRFs can actually reach which — including the ones you did not intend.

Local toolYour network plan stays in your browser. Nothing you enter is uploaded, logged, or sent to any server.

Who can reach whom

A row imports routes from a column when it imports a route target that column exports.

Findings

Route distinguishers, route targets, and why they are not the same thing

A VRF gives a device more than one routing table. Two customers can both use 10.0.0.0/24 on the same router because the routes live in separate tables and never meet.

A route distinguisher makes a route unique. When routes from many VRFs are carried in one BGP session they would collide, so each is prefixed with an RD — turning 10.0.0.0/24 into 65000:100:10.0.0.0/24. That is all it does. An RD does not decide where a route goes, and giving two VRFs the same RD is a problem of uniqueness rather than of policy.

A route target decides where a route goes. Each VRF exports its routes tagged with one or more RTs, and imports any route carrying an RT in its import list. Reachability is the intersection of those lists and nothing else.

Conflating the two is the classic confusion, and it produces designs where somebody changes an RD expecting the traffic to change. The tool keeps them separate: RDs are checked for uniqueness, RTs decide the matrix.

Reachability is not symmetric. A spoke importing the hub's RT while the hub imports every spoke's gives a hub-and-spoke topology. Spokes reach the hub, the hub reaches everything, and spokes cannot reach each other — which is usually the intention, and worth checking rather than assuming.

Related tools

IPAM Lite records addressing per VRF. VLAN + Subnet Designer allocates the subnets that go in them.