A municipal guest Wi-Fi portal must redirect unauthenticated client traffic into a captive-portal routing instance on the EVPN-VXLAN leaf. Which approach best matches a classic filter-based forwarding use case?
Select an answer to reveal the explanation.
Short Explanation
Picture the guest network as a lobby: unknowns get walked to the kiosk, not the elevators. FBF is that escort—match the guest traffic and hand it to the captive routing instance. Pure underlay defaults or DCI stretch do not build that portal detour.
Full Explanation
When a municipal guest Wi-Fi portal must redirect unauthenticated client traffic into a captive-portal routing instance on the EVPN-VXLAN leaf, the approach that best matches a classic filter-based forwarding use case is to apply FBF so matched guest flows are steered into a dedicated captive routing instance for portal handling. Captive portals, scrubbing, and IDS insertion are textbook FBF patterns: classify the unauthenticated guest packets, then forward them into a service VRF that presents the portal or security appliance path. Advertising a default route only in the underlay so guests hairpin through the spine does not classify unauthenticated clients into a captive instance and may merely change underlay next hops. Stretching the guest VLAN across DCI with EVPN Type-5 alone and skipping filters solves site stretch or L3 advertisement problems, not portal redirection. Relying on GBP group tags exclusively without any filter or alternate instance addresses microsegmentation intent but does not by itself implement classic captive-instance steering the way FBF does. Exam caveat: remember captive-portal and inspection redirection as canonical FBF use cases on civic leaves. Operational check: craft a guest match filter with an FBF routing-instance action toward the captive VRF, connect a test unauthenticated client on the municipal guest SSID, and verify HTTP redirects or captures show traffic in the captive instance rather than the production guest forwarding table.