Hi,
Are you looking into blocking access to the specific instance of that service, rather than all instances?
If so, I think that the value to the path leaf in your rule should be a little different.
If you log into ncs_cli and display the xpath to your service instance, you'd see something like this:
show run services fw_acl_03 bk-app-1 | display xpath
/services/fw_acl_03[name='bk-app-1']
...
...
...
Note that instead of 'name' you'll see that actual name of the key leaf (which might be 'name', or something different).
You need to have that path in your rule instead of the one you have at the moment.
Yftach
