A township steers client-to-server traffic toward an inspection service with FBF but leaves the return path on the normal tenant instance. What pitfall should the designer anticipate?
Select an answer to reveal the explanation.
Short Explanation
Steering only half the conversation is like sending the outbound truck through security and letting the reply sneak in the back gate. Stateful boxes and return routing get confused. Plan both directions when you care about inspection symmetry.
Full Explanation
When a township steers client-to-server traffic toward an inspection service with FBF but leaves the return path on the normal tenant instance, the designer should anticipate that one-direction FBF can create asymmetric paths that break stateful inspection or confuse return routing expectations. Filter-based forwarding is directional based on where filters and actions are applied, so steering only the forward civic flow into a security VRF while replies take the ordinary tenant table can desynchronize firewall state and complicate traceroute evidence. EVPN will not automatically mirror the FBF action on the reverse direction without configuration; reverse-path policy must be designed explicitly if symmetry is required. Asymmetry is not impossible merely because VXLAN supposedly pins both directions to one VTEP path—overlay encapsulation does not remove the need to design bidirectional steering for stateful services. Return traffic is not dropped by default unless GBP tags are removed from all servers; that distractor mixes unrelated microsegmentation knobs with FBF path design. Exam caveat: always evaluate both directions when FBF inserts a municipal inspection or scrubbing service. Operational check: capture or flow-record both client-to-server and server-to-client legs after FBF enablement, confirm whether the inspection appliance sees symmetric sessions, and add reverse FBF or routing adjustments if the security design requires stateful symmetry.