After deploying FBF toward a security VRF, a city auditor finds some matched flows still bypass inspection. What troubleshooting mindset should the engineer apply first?
Select an answer to reveal the explanation.
Short Explanation
Having a filter on paper is not the same as cars actually taking the inspection ramp. Trace whether matched packets truly land in the security instance. Route ads or entropy tweaks do not prove the FBF handoff happened.
Full Explanation
Incorrect or incomplete FBF configuration can leave traffic in the default forwarding context and bypass the security VRF. Effective troubleshooting confirms filter hits, the routing-instance action, and that forwarding lookups occur in the intended instance. EVPN MAC/IP advertisements or underlay entropy settings do not substitute for verifying FBF steering behavior.