Firewall rules baseline
Well, sounds like you just need to get a good read on what sort of traffic is crossing your network. For that, set up a mirrored port on one of your switches, connect a PC to it, and fire up Wireshark. After getting a packet capture, you'll be able to very easily see what's going on.
When doing this sort of work, I typically start from a "deny all" perspective. Assume that you're going to block everything, and then make a list of what applications need to be accessible through the firewall, and what allow rules you'll need for each of them.