A healthcare group connects three campuses over MPLS with shared IT services in the data center. Guest traffic must stay isolated, clinical devices need separate routing tables, and shared services require controlled leaking between tables. Which VRF design achieves campus segmentation with shared services access?

The Multi-VRF design with route targets isolates campus routing tables and leaks only shared service prefixes. In an MPLS network, each campus and function can receive its own VRF, with a unique route distinguisher to support overlapping addresses; route targets control selective import and export between the data-center services VRF and campus clinical VRFs. This preserves campus segmentation, gives clinical devices dedicated tables, and keeps guest traffic in a strictly isolated VRF with no leaking. Full isolation without leaking is suitable when services are duplicated per enclave, but it blocks the requested centralized shared IT access and requires costly duplication and consistent management. Using ACLs to filter guests while isolating campus tables can conserve VRF state, but ACLs filter traffic within a shared control plane and forwarding table; they do not provide separate routing tables, leaving risks from misconfiguration, address overlap, and lateral movement. A single clinical VRF with route-target leaking and guest isolation can simplify policy, but merging clinical routing tables fails the separate-table and campus-segmentation requirement, complicating overlapping addresses and weakening per-campus containment and policy. Exam caveat: route distinguishers provide uniqueness, whereas route targets implement the leaking policy. In practice, check show ip vrf detail and show bgp vpnv4 unicast, verify import/export route-target maps, and test that clinical VRFs reach shared services while guest VRFs cannot reach internal prefixes.