This KB explains how the firewall filter is evaluated sequentially when it consists of more than one term.

1. The packet is evaluated against the conditions in the from statement in the first term.

2. If the packet matches all the conditions in the term, the action in the then statement is taken and the evaluation ends. Subsequent terms in the filter are not evaluated.

3. If the packet does not match all the conditions in the term, the packet is evaluated against the conditions in the from statement in the second term.This process continues until either the packet matches the conditions in the from statement in one of the subsequent terms or there are no more terms in the filter.

4. If a packet passes through all the terms in the filter without a match, the packet is discarded.

5. If a term does not contain a from statement, the packet is considered to match and the action in the then statement of the term is taken. If a term does not contain a then statement, or if an action has not been configured in the then statement, and the packet matches the conditions in the from statement of the term, the packet is accepted.

6. Every firewall filter contains an implicit deny statement at the end of the filter. Consequently, if a packet passes through all the terms in a filter without matching any conditions, the packet is discarded. If you configure a firewall filter that has no terms, all packets that pass through the filter are discarded.