An engineer at a small-town head-end facility writes a firewall-filter term intended to match only inbound TCP traffic destined for port 22 on the POP router from a specific NOC host address. Which part of the term should carry the source address, destination port, and protocol conditions that decide whether a packet matches?
Select an answer to reveal the explanation.
Short Explanation
Every filter term splits into two jobs: deciding what a packet has to look like to count as a match, and deciding what happens once it does. The from statement is entirely about that first job — source address, destination port, protocol — the recognizing part, not the acting part.
Full Explanation
A Junos firewall-filter term is built from an optional from statement and a then statement. The from statement is where match conditions live — source-address, destination-address, destination-port, protocol, and similar packet-header criteria — and a packet must satisfy all the conditions listed there for the term to be considered a match. In this scenario, source-address for the NOC host, destination-port 22, and protocol tcp all belong inside from. The term's name is purely a configuration label with no bearing on packet matching; it exists so administrators and counters can reference the term, nothing more. The then statement is where the action goes once a match has already been determined — accept, discard, reject, count, or a policer reference — so it is the wrong place for match conditions themselves, even though the earlier options each pointed at then in different phrasing, they all conflate matching with acting. Getting this distinction right matters because a common mistake is putting an address or port condition in the wrong clause, which either fails to commit or silently matches every packet because the intended condition was never actually applied. To confirm a term is matching as intended, an engineer can run 'show firewall filter <name>' after generating test traffic from the NOC host and verify the term's counter increments only for that source and port combination, not for unrelated traffic.