Delete the broad rules and deny by default
Deleting the broad legacy firewall rules and setting the default policy to deny: the flows that must stay closed turn green.
Try this in the lab: Firewall rules: the minimum, then deny by defaultAbout the OT security lab
Transcript
The two broad legacy rules are deleted from the firewall table and the default policy is set to deny. The flows that must stay closed turn green, and the flows the plant needs show as blocked until they are allowed one by one.