Click the Exhibit button.

Junos OS firewall filters operate on a sequential, " first-match " logic, but their behavior is significantly influenced by the use of terminating versus non-terminating actions. In this exhibit, a packet with a source address of 10.0.0.0/8 is evaluated against the filter named test.

Evaluation begins with term 1 . The packet matches the source-address criteria, triggering the actions defined in the then statement. The first action is log, which sends the packet header information to the firewall task buffer for logging. The second action is next term . This is a critical non-terminating action ; it instructs the Packet Forwarding Engine (PFE) to continue the evaluation process using the subsequent term in the filter rather than stopping after the match.

Evaluation then moves to term 2 . Because term 2 contains no from match conditions, it acts as a " catch-all " for any traffic that reaches it. The action in this term is reject . This is a terminating action that discards the packet and sends an ICMP " destination unreachable " message back to the source. Therefore, the packet is first recorded by the logging process and is subsequently dropped by the rejection mechanism. If next term had not been present in term 1 , the packet would have been implicitly accepted (as any matched term without a terminating action like discard, reject, or accept defaults to an implicit accept in that specific term). However, the explicit instruction to move forward ensures the packet hits the reject statement.