An auditor asks how filter-based forwarding relates to VRF-based tenant isolation in the municipal fabric. Which statement best describes their complementary roles?
Select an answer to reveal the explanation.
Short Explanation
VRFs are the separate filing cabinets; FBF is the clerk who pulls one folder and walks it to the inspection room. Isolation and selective steering work together—they are not an either-or switch.
Full Explanation
When an auditor asks how filter-based forwarding relates to VRF-based tenant isolation in the municipal fabric, the statement that best describes their complementary roles is that VRFs isolate forwarding tables for tenants, while FBF selectively redirects specific flows among or into chosen forwarding contexts. Routing instances give Parks, Courts, and guest services separate RIBs and blast-radius boundaries; FBF then uses packet filters to move matched flows into an inspection, captive, or alternate exit instance without redesigning every isolation domain. VRFs and FBF are not mutually exclusive, and enabling one does not disable the other on Junos. FBF does not replace all routing instances because filters alone supposedly provide full multitenancy; filters steer, they do not substitute for table separation across civic agencies. VRFs are also not limited to isolating management traffic while FBF alone isolates data-plane tenants—that role split is fictional. Exam caveat: describe VRFs as the isolation tables and FBF as selective redirection among those tables. Operational check: show an auditor a tenant VRF with no FBF as the isolation baseline, then demonstrate an FBF term that redirects only a matched subnet into a security VRF while the remaining agency prefixes stay isolated in their original instance.