A co-op's NOC configures a filter term with the then action set to log, matching traffic from an unfamiliar address range hitting a POP router. After that term, the filter has two more terms: one permitting known partner traffic and a final explicit discard-all term. Does the log action by itself stop the matched packet from reaching the later terms?

The log action in a Junos firewall-filter term records information about a matching packet but does not itself decide accept or discard, and it is a non-terminating action — meaning that after the term with log is applied, evaluation of the packet continues on to the next term in the filter. So in this scenario, the packet matching the log term still reaches the partner-traffic permit term and, if it does not match that either, the final explicit discard-all term. This is different from discard, reject, or accept, which all terminate evaluation the moment they apply. The claim that log always terminates evaluation is simply the terminating/non-terminating distinction reversed. Making termination conditional on also matching a source-address condition misunderstands that terminating behavior is a property of the action itself, not of which match conditions happen to be present in the from statement. Tying the fall-through behavior to the filter having fewer than four terms is a fabricated rule; the number of terms in a filter has no bearing on whether a given action terminates evaluation. This behavior is precisely why log (and count) are useful for building visibility into traffic that a later term will ultimately accept or drop, without having to choose between observing it and enforcing a decision on it. To confirm, an operator can send matching traffic and check that the log term's entry appears while the packet's ultimate fate still reflects whichever later term actually matched it.