A city data-center leaf must steer traffic from a permitting-office subnet into an inspection routing instance before it reaches tenant servers. Which Junos mechanism selects an alternate forwarding routing instance based on a packet filter match?

When a city data-center leaf must steer traffic from a permitting-office subnet into an inspection routing instance before it reaches tenant servers, the Junos mechanism that selects an alternate forwarding routing instance based on a packet filter match is filter-based forwarding (FBF) that applies a firewall filter with a routing-instance action. FBF evaluates match conditions on the packet and, on hit, performs a lookup in the designated routing instance so the permitting flows take the inspection path while other civic traffic continues on the normal tenant path. A static discard term that blackholes the subnet at the IRB drops packets instead of redirecting them to inspection, so it fails the steering requirement. A pure MAC VRF Type-2 advertisement with no filter attachment only distributes Layer 2 reachability and does not classify or redirect selected IP flows into another instance. Underlay EBGP multipath alone without any filter or routing-instance action may share underlay links but does not implement policy-based instance selection for a permitting subnet. Exam caveat: FBF is the describe-level tool for filter-selected alternate forwarding contexts on Junos DC leaves; do not confuse it with simple discard or underlay ECMP. Operational check: attach an FBF filter that matches the permitting subnet, confirm filter hit counters increment, verify the routing-instance action, and traceroute or capture to prove those packets enter the inspection VRF while unmatched tenant traffic stays on the original instance.