This article highlights the benefits of using next-policy when configuring multiple import policies in Firewall setups.

The firewall will not allow transit learning on import-policy 1 because the final term in this policy is set to "reject," effectively halting further evaluation and preventing the subsequent import-policy 2 from being processed.

For example, consider the following scenario:

You have multiple policies applied to a group: import_policies [ POLICY_NEW POLICY_1 POLICY_2 POLICY_3 ]

from {

                       instance POLICY_1 ;

                       route-filter 10.159.151.240/28 exact;

                   }

                   then accept;

               }

               term other {

                    then reject; >>> instead of reject, next policy.

Configuring the next policy statement in an import policy is beneficial because it ensures that all policy statements in a policy chain are processed. When multiple policies are chained together using instance-import or instance-export, all policy statements except the last one should not have a terminating action like accept or reject. Instead, they should use next policy as the action statement. This approach prevents the device from stopping the policy processing prematurely and ensures that all specified policies are evaluated.

Key Reference for Flow Control Actions: