A technician configures a POP router's firewall filter with term A first, which broadly discards all TCP traffic, followed by term B, which is meant to permit TCP port 22 from the NOC subnet. After committing, NOC staff can no longer reach the router by SSH. What is the most likely cause?
Select an answer to reveal the explanation.
Short Explanation
Order is everything in a firewall filter: a broad rule sitting ahead of a specific one will grab every matching packet first and never let the specific rule downstream have its turn. Here the blanket TCP discard runs before the NOC's SSH permit, so the NOC never gets through.
Full Explanation
Junos evaluates firewall-filter terms sequentially, top to bottom, stopping at the first term whose match conditions apply and whose action is terminating. Term A's broad discard-all-TCP condition matches SSH traffic too, since SSH runs over TCP, and discard is terminating, so every TCP packet — including the NOC's SSH attempts — is dropped by term A before term B, the specific NOC-SSH permit, is ever consulted. The fix is reordering the filter so the more specific permit term comes before the broad discard, a general design principle: specific terms belong ahead of broad ones, not after. Expecting Junos to prefer the more specific term imports longest-match routing intuition into a place it does not apply: filter terms are evaluated in configured order, not by specificity, so a broad term written first wins over a narrower one written later. The claim that Junos has a term-count ceiling causing a default-discard fallback is fabricated; there is no such behavior tied simply to having multiple terms in a filter. The idea that SSH is inherently exempt from firewall filters is also incorrect — firewall filters evaluate any traffic they are configured to match, including SSH, based purely on the from conditions written, with no built-in protocol exemptions. This scenario is a realistic and common authoring mistake: writing the intended exceptions after the broad rule that already consumes the traffic they were meant to carve out. To confirm this diagnosis, an engineer can check 'show firewall filter <name>' and see term A's counter incrementing for the NOC's SSH attempts while term B's counter stays at zero, then reorder the terms and retest.