A network engineer at a rural broadband cooperative wants to drop management traffic addressed to a POP router unless it comes from the NOC subnet, without changing which routes the router installs in its routing table. Which Junos OS mechanism inspects individual packets against match conditions to make that permit-or-deny decision, rather than influencing route selection?
Select an answer to reveal the explanation.
Short Explanation
Think of a firewall filter as a bouncer checking IDs at the door: it looks at each packet's headers and decides pass or drop, term by term. Routing policy is a different job entirely — it decides which routes get into or out of the routing table, not whether a packet is forwarded. Filters act on packets; policy acts on routes.
Full Explanation
A Junos stateless firewall filter evaluates each packet against ordered terms built from match conditions (source address, destination address, protocol, and so on) and applies an action such as accept or discard. Applying a filter to an interface — for example the POP router's management-facing interface — lets the cooperative permit traffic only from the NOC subnet and drop everything else, with no bearing on the routing table. Export and import routing policies solve a different problem: they filter which routes are advertised to or accepted from a routing protocol, shaping the contents of the routing table itself, not per-packet forwarding decisions. A default routing policy likewise only governs implicit route acceptance and advertisement behavior when no explicit policy term matches, so it cannot enforce a source-address restriction on management traffic. The operational distinction matters because misapplying a routing policy where a filter belongs leaves the management plane wide open even though routing looks correct. To verify a filter is doing this job, run 'show firewall filter <name>' and confirm term counters increment for both the permitted NOC traffic and the traffic being dropped from elsewhere.