An engineer adds an FBF term to steer finance-subnet traffic, yet counters show an earlier accept term always hits first. What principle explains why the FBF action never applies?
Select an answer to reveal the explanation.
Short Explanation
Filters read top to bottom like a checklist—first match wins. If an early accept already grabbed the finance packets, the later FBF term never gets a turn. Reorder or tighten matches so steering happens before the catch-all.
Full Explanation
Junos firewall filters evaluate terms sequentially; the first matching term’s action is applied. An earlier accept (or other terminating action) that matches the same traffic prevents a subsequent FBF routing-instance action from running. Attachment to an IRB does not disable term order, and it is not true that only the last term can match.