I have users trying to access a host that is showing up in FMC events with "red" computer icon which means compromised. The action is allowed in the event log. I have also added this host to bypass the sfr and i still the client getting tcp resets to...