SEP 12.1 firewall - default deny rule?

Can anyone confirm that if a firewall policy has no rules there is an implied 'default deny' action?  (v12.1 RU2)

I was trying to use a firewall policy only for the purpose of "automatically block an attackers IP address" option.  But found that my Win7 client workstation couldn't even ping the defafult gateway.   The firewall policy initially had no rules.  After I added a single 'allow all' rule the client workstation is functioning normally.