If an icon has on it, this means that the last attempt to update the protection configuration has failed. This does not mean that your API is no longer protected: the running API Firewall instances are using the last successful protection configuration from before the failed update attempt.