Operations staff propose a firewall discard term to “secure” guest VLAN traffic the same way filter-based forwarding would. What is the key difference they must understand?
Select an answer to reveal the explanation.
Short Explanation
Same clipboard, different job. A discard term stamps “rejected” and throws the packet away. FBF uses that match to escort the flow into another routing table—like sending a visitor to a check-in desk instead of locking the door.
Full Explanation
When operations staff propose a firewall discard term to secure guest VLAN traffic the same way filter-based forwarding would, the key difference they must understand is that FBF steers matched traffic into another forwarding table or routing instance, whereas a discard term only drops it. Both features may evaluate firewall filters on ingress, but their outcomes diverge: discard terminates the packet, while FBF continues forwarding after a lookup in the alternate civic context such as a captive portal or scrubbing VRF. Discard and FBF are therefore not identical merely because both can use filters. Discard does not automatically mirror packets into an IDS VRF before dropping them; mirroring or steering into an inspection instance requires an explicit redirect-style action, not an assumption baked into discard. FBF is also not limited to destination MAC matches—it commonly matches Layer 3 and Layer 4 fields such as addresses, ports, and DSCP on municipal guest and agency traffic. Exam caveat: on the JNCIP-DC describe level, equate discard with drop and FBF with selective instance redirection. Operational check: compare filter actions on a lab leaf by sending guest test flows through a discard term versus an FBF routing-instance action, then confirm discard yields no captive-path delivery while FBF places packets in the intended alternate routing table.