All labs
First-match firewall rules
Reorder rules with stated default-deny. A shadowed deny does not protect you.
Simulator rule: first-match top to bottom, then deny traffic that matches no allow. Real platforms can differ. A deny below allow-all is shadowed.
1any any any allow
2guest → staff-files TCP 445 deny
3staff → web TCP 443 allow
Guest → staff files currently hits: any any any allow → allow