I'm finding that if I have a firewall rule: TCP/IP ALLOW, Source IP of Router, to ALL destinations....
and then do a Security Advisor Scan, where it first gets a new Update that it installs before doing it's scan.... that completes successfully: (Good)
and then I go back into Firewall.... I see...