If accept IP address term before discard port term, will the IP's port still be discard?

Question

In my Juniper Router MX480's firewall filter DENY-EMAIL-PORT:

dele@MX-RE0# show firewall filter DENY-EMAIL-PORT

term ALLOW-IP {
    from  {
        address {
            102.100.100.1/32;   
        }
    }
    then accept;
}

term DENY-EMAIL {
    from {
        port [ 25 109 110 143 465 587 993 994 995 ];
    }
    then {
        discard;
    }
}
term default {
    then accept;
}

You see I have disallow those email ports, such as 25, 143.

and I also inserted a ALLOW-IP term before the DENY-EMAIL term. So, my doubt is whether the 102.100.100.1/32's email ports will be still deny?

Answer 1

Generally, the first matched term is applied or wins (@Ricky). The terms are tested from top to bottom and when a match is found, the corresponding action is applied.

Your current policy allows everything from 102.100.100.1/32. For all other source addresses, it blocks the email protocols listed but allows everything else.

If your intention was to block email access for the source 102.100.100.1/32 while allowing everything else, you'd need to put the specific criteria into one term.