It is some kind of this discussion ⚓ T3933 The firewall does not filter incoming traffic on the interface with vrf.