. . "This isolation should be done using a stateful firewall configured to deny all traffic except for connections required between specific PCN nodes and corporate network nodes." . .