Juniper - Фильтрация трафика

gang@mx204-aiob.g50.ki# show dynamic-profiles svc-smtp        
variables {
    smtp-filter {
        default-value svc-smtp-allow;
        uid-reference;
    }
    svc-smtp-allow uid;
}
interfaces {
    demux0 {
        unit "$junos-interface-unit" {
            no-traps;
            family inet {
                filter {
                    input "$smtp-filter" precedence 50;
                }
            }
        }
    }
}
firewall {
    family inet {
        filter "$svc-smtp-allow" {
            interface-specific;
            term service {
                from {
                    service-filter-hit;
                }
                then accept;
            }
            term smtp-allow {
                from {
                    protocol tcp;
                    destination-port 25;
                }
                then {
                    policer pol-25M;
                    service-accounting;
                    service-filter-hit;
                    accept;
                }
            }
            term Other {
                then accept;
            }
        }
    }
}

term service {
                from {
                    service-filter-hit;
                }
                then accept;
            }

 
[edit dynamic-profiles svc-global-ipoe firewall family inet filter "$inet_out"]
        term service { ... }
       term smtp-default-denied {
           from {
               protocol tcp;
               destination-port 25;
           }
           then {
               service-filter-hit;
               discard;
           }