Symptoms
In case a VE firewall is enabled in CCP, but all existing rules are disabled, any traffic is allowed to the VE, while it is expected that enabled FW prohibits any communication.
Cause
The behavior is planned to be improved in scope of CCU-19350.
Resolution
Create any dummy rule and enable it to have all other ports filtered.