In an ERB EVPN-VXLAN design, tenant workloads attach through IRB interfaces in a tenant routing instance. Where should the city fabric typically attach filter-based forwarding to steer that tenant traffic?
Select an answer to reveal the explanation.
Short Explanation
Steer traffic where the tenant road actually is—the IRB or leaf interface that sees those packets. Putting the filter only on spines or bare underlay links is like posting the detour sign on a highway the city cars never drive.
Full Explanation
In an ERB EVPN-VXLAN design where tenant workloads attach through IRB interfaces in a tenant routing instance, the city fabric should typically attach filter-based forwarding on the appropriate IRB or tenant-facing interface attachment points where tenant traffic is forwarded. Edge-routed bridging means the leaf sees tenant IP traffic in the tenant context, so FBF classification and redirection belong where those packets are visible rather than on unrelated underlay-only points. Applying filters only on spine loopback addresses so leaves never see the filter misses the ERB traffic path and cannot steer municipal tenant flows at the edge. Attaching exclusively on underlay P2P links between spines with no tenant context classifies underlay packets, not agency workloads in their VRFs. Claiming FBF can live only inside the WAN PE because DC leaves cannot host FBF with EVPN is false for Junos data-center leaves, which routinely host filters and alternate routing instances alongside EVPN. Exam caveat: place FBF where tenant packets exist in ERB—commonly IRB or tenant attachment interfaces—not on underlay-only spine constructs. Operational check: on a civic ERB leaf, attach the FBF filter to the tenant IRB or access interface, send match traffic, confirm hits, and verify the alternate routing-instance lookup; repeat a negative test from an unmatched subnet that must remain unsteered.