SRX

I wonder how to configure this:
Before all other security polices from zone A to zone B I want to place an IP blacklist to deny complete traffic. This can be done with dynamic address lists. How on the other hand can I exempt certain IP addresses from this list?

I thought of sth like (syntax incomplete)

policy pre-filter
term1 source-address adr-whitelist 
then next policy
term 2 source-address adr-blacklist
then reject

However the action "next policy" does not exist with security policies. How to achieve that whitelisted addresses are exempted from the blacklist rule? (I do not want a rule to accept whitelisted addresses completely, the more specific rules should nevertheless be checked).

Thx

I don't think that's possible, unfortunately ... You can negate source-address on a policy but that negates all the sources address so that won't work ... 

if you're using security zones, is this an SRX?  If so, that would be straightforward, at the TOP of the zone, the first policy  should did this operation.

Yeah, but what is "this operation" ?

Say, you have this:

[block these bad addresses]
[10 policies to allow various traffic, perhaps mostly based on the destination address]

OP aims to do something similar to a routing policy syntax without having to duplicate policies for the exceptions. In other words, NOT this:

[10 policies to allow various traffic from the exceptions to the bad address list]
[block these bad addresses]
[10 policies to allow various traffic, perhaps mostly based on the destination address]

which would then require to duplicate any changes to the 10 policies going forward.

Exactly. Blocking the bad guys is quite straightforward. But if you block say some class C networks but want to allow one or two addresses from that network. Of course you can fiddle out this beforehand and compile a handcrafted new blacklist without these addresses but that can make your blacklist finegrained, huge and slow. The idea is that the whitelist contains addresses that would otherwise be blocked by the blacklist.

Apparently Junos supports the necessary syntax for the rules with routing policies but not with security policies what's a bit strange.