Juniper Apstra's Security Policies define rules for traffic flow between different application groups or network zones. When these abstract policies are rendered and pushed to network devices, they are translated into platform-specific configurations. For Juniper Junos devices, these policies are implemented as firewall filters. For other vendors like Arista EOS or Cisco NX-OS, they are implemented as Access Control Lists (ACLs). Both firewall filters and ACLs are functionally equivalent in this context, serving as stateless packet filters to permit or deny traffic based on defined criteria.

A. Filter-based forwarding (FBF)

FBF is a routing feature that directs traffic to a specific next-hop based on filter criteria, which is different from the permit/deny function of a security policy.

C. Policy-based routing (PBR)

PBR is used to override default routing behavior based on policy, not for implementing the stateless firewall rules defined in Apstra Security Policies.

1. Juniper Apstra User Guide, "Policy". The documentation states, "Apstra policies are rendered as access control lists (ACLs) on the interface of the leaf devices."

2. Juniper TechLibrary, "Day One+: Deploying in the Data Center with Apstra", Chapter 5: Security Policies. This guide explains that Apstra policies are translated into device-specific ACLs or firewall filters to enforce the desired security posture.