A significant challenge with firewalls in industrial environments is deciding how they should be configured.
The complexity arises from needing to balance operational requirements (such as process data flow) with security needs (such as blocking unauthorized access). Misconfiguration can lead either to security gaps or to unnecessary operational disruptions. Firewalls can filter many types of traffic (not just HTTP) and while updates are important, configuration is the biggest ongoing challenge.
Reference: ISA/IEC 62443-3-3:2013, Section 4.2.3.3 (Firewalls and configuration management); ISA/IEC
62443-2-1:2009, Section 6.3.2.