I set edge bridge between logical switch and distributed portgroup. Then I made test L2 firewall rule to block the connection - source and destination "any" and applies to distributed portgroup. First I searched edges, but it shows only full edge firewalls, not edge bridge, so I then choosed exact portgroup as "applied to". But connection still accessible.
