Apstra 5.1 Security Policies are intended to enforce permit/deny controls for traffic between defined endpoints such as routing zones, virtual networks, and IP endpoints. Apstra expresses this security intent in an implementation-independent way, then renders and deploys the equivalent enforcement configuration onto the appropriate devices and interfaces. In Apstra terminology, the outcome is an ACL applied at enforcement points, such as virtual network interfaces (SVIs/IRBs) for east-west controls and border leaf interfaces for external-to-internal controls.

Therefore, the two correct policy types in this context are access control lists (ACLs) and firewall filters. “ACL” is the abstract policy object Apstra compiles and applies, while on Junos v24.4 the concrete enforcement mechanism for stateless packet filtering on interfaces is typically implemented as a firewall filter. Apstra automatically places these rendered ACLs/filters where needed: when you add VXLAN endpoints (such as expanding a rack/leaf in a VN), the ACL is placed on the corresponding VN interface; when you add external connectivity points, relevant ACLs are placed on the border leaf enforcement points. This automation ensures that security intent remains consistent as the fabric scales or changes, reducing the risk of manual rule drift. In contrast, filter-based forwarding / policy-based routing changes forwarding decisions rather than expressing permit/deny security intent, and is not the primary mechanism used by Apstra Security Policies for reachability control.