After deploying FBF toward a security VRF, a city auditor finds some matched flows still bypass inspection. What troubleshooting mindset should the engineer apply first?
Select an answer to reveal the explanation.
Short Explanation
Having a filter on paper is not the same as cars actually taking the inspection ramp. Trace whether matched packets truly land in the security instance. Route ads or entropy tweaks do not prove the FBF handoff happened.
Full Explanation
After deploying FBF toward a security VRF, when a city auditor finds some matched flows still bypass inspection, the engineer should first validate that matched traffic actually uses the intended forwarding instance end to end, not only that a filter exists. Presence of a filter stanza is insufficient if term order, match criteria, attachment point, or the routing-instance action is wrong, leaving packets in the default civic forwarding context. Assuming EVPN Type-2 presence proves FBF steering is working confuses overlay MAC/IP advertisement with filter-based instance redirection. Disabling all tenant VRFs so only the underlay remains reachable is a destructive non-diagnostic step that breaks municipal services without proving FBF. Increasing VXLAN UDP source-port entropy to force inspection may change ECMP spray but does not place flows into the security routing instance. Exam caveat: separate “filter configured” from “packets forward in the inspection instance,” especially under audit pressure. Operational check: generate known-match traffic from the audited subnet, watch filter hit counters and the FBF action, perform a lookup or traceroute that proves the security VRF path, and remediate shadowing terms or wrong attachment points until bypassed flows disappear from the auditor’s evidence.