A technician at a regional ISP is building a firewall filter with three terms to protect a subscriber aggregation router: term one permits DNS to the resolver, term two permits established management sessions, and term three is a catch-all. When Junos evaluates this filter against an incoming packet, in what order does it check the terms?
Select an answer to reveal the explanation.
Short Explanation
Picture a checklist you read one line at a time, top to bottom, stopping the moment an item applies to you. A Junos firewall filter works the same way: terms are evaluated in configuration order, and the first term whose from conditions match decides the packet's fate. Order isn't cosmetic here — it's the whole logic of the filter.
Full Explanation
Each term in a Junos firewall filter has a name, an optional set of from match conditions, and a then clause specifying the action. Junos evaluates terms sequentially in the order they appear in the configuration, and as soon as a packet matches a term's from conditions and that term carries a terminating action, evaluation stops for that packet — later terms are never consulted. The 'simultaneous' and 'most restrictive wins' option is wrong because Junos performs no such conflict resolution across terms; it is strictly sequential, first-match. Evaluating bottom-to-top is also incorrect and would make catch-all terms fire before the specific permits ever get a chance, which is backwards from how filters are meant to work. Stopping after only the first term, regardless of match, misunderstands that every term is still checked in sequence until one actually matches. This is why term ordering is a design decision, not an afterthought: put specific, narrow terms — like the DNS and management permits here — ahead of the broad catch-all, or the catch-all will shadow them. To confirm the intended order is taking effect, run 'show firewall filter <name>' and check that per-term counters increment only for the traffic each term is meant to catch.