If you are using the Deep Security Agent version 11.2 or later to protect containers that communicate over an overlay network, you may need to add a number of firewall rules to allow network traffic for the Swarm services because the default firewall rules block that traffic.