A city security design must send suspicious Internet-facing flows into a scrubbing routing instance and then return cleaned traffic to the normal tenant forwarding path. Which pattern best describes this FBF role?
Select an answer to reveal the explanation.
Short Explanation
Treat scrubbing like a car wash on a side street: FBF turns suspect flows into the wash bay instance, then they rejoin the main road clean. Classification-plus-steer is the security pattern—not hoping telemetry alone washes packets.
Full Explanation
When a city security design must send suspicious Internet-facing flows into a scrubbing routing instance and then return cleaned traffic to the normal tenant forwarding path, the pattern that best describes this FBF role is steering matched traffic into a service instance as a data-center security pattern, then forwarding onward after scrubbing. That service-chain style uses classification to divert suspect civic flows into a scrubbing VRF or appliance path and later rejoins the production tenant context for legitimate traffic. Pure VRF route leaking without any packet classification shares prefixes between tables but does not select individual suspicious flows for scrubbing insertion. Replacing all tenant VNIs with a single Layer-2 stretch across sites expands broadcast domains and does not implement scrubbing redirection. Using only spine telemetry sampling instead of any forwarding change observes traffic without altering the path into a scrubbing instance. Exam caveat: FBF is commonly framed as the steering mechanism for scrubbing or inspection insertion on Junos DC fabrics, complementary to—but distinct from—simple route leaking. Operational check: match a lab “suspicious” flow into the scrubbing routing instance with FBF, verify packets arrive at the scrubber, confirm cleaned traffic returns to the tenant forwarding path, and ensure unmatched municipal traffic never enters the scrubbing VRF.