2

In my Juniper Router MX480's firewall filter DENY-EMAIL-PORT:

dele@MX-RE0# show firewall filter DENY-EMAIL-PORT

term ALLOW-IP {
    from  {
        address {
            102.100.100.1/32;   
        }
    }
    then accept;
}

term DENY-EMAIL {
    from {
        port [ 25 109 110 143 465 587 993 994 995 ];
    }
    then {
        discard;
    }
}
term default {
    then accept;
}

You see I have disallow those email ports, such as 25, 143.

and I also inserted a ALLOW-IP term before the DENY-EMAIL term. So, my doubt is whether the 102.100.100.1/32's email ports will be still deny?

  • 2
    First match wins. – Ricky Mar 12 '20 at 4:06
2

Generally, the first matched term is applied or wins (@Ricky). The terms are tested from top to bottom and when a match is found, the corresponding action is applied.

Your current policy allows everything from 102.100.100.1/32. For all other source addresses, it blocks the email protocols listed but allows everything else.

If your intention was to block email access for the source 102.100.100.1/32 while allowing everything else, you'd need to put the specific criteria into one term.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.