This article addresses an issue related to filter-based forwarding where traffic intended to be forwarded through the secondary ISP was instead routed through the primary ISP. The behavior was observed despite the presence of firewall filter terms configured to direct specific traffic to different routing-instances. This article explains the cause of the issue and the configuration changes required to restore the expected forwarding behavior.

1. Investigation revealed that the firewall filter contained terms associated with two separate routing-instances, representing the primary and secondary ISPs. The term directing traffic to the secondary ISP, based on a specific source address match condition, was configured after the more general term associated with the primary ISP.
2. Because firewall filters are processed sequentially from top to bottom, traffic matched the primary ISP term before reaching the secondary ISP term. Consequently, all matching traffic was forwarded through the primary ISP.
3. To resolve the issue, the firewall filter terms were reordered so that the more specific term directing traffic to the secondary ISP was placed before the general primary ISP term. After committing the updated configuration, traffic matching the specified source address was correctly forwarded through the secondary ISP as intended.

For more information about filter-based forwarding, check the KB KB17223 [juniper.net]