$ 0 0 Can you collect "show security policies hit-count" couple of times and confirm there is traffic hitting deny policy?