I noticed that when I make a restrictive change to a firewall, the traffic keeps coming through.
Example:
Enable firewall (cluster,host,vm,network interface)
Create firewall entry for vm:
Line 0: dport TCP: 22 ACCEPT
Input policy: DROP
Connect to the host protected by this firewall on port...