intext traffic. If you want your workload to reject plaintext traffic, create a <code>PeerAuthentication</code> policy with mTLS mode set to <code>STRICT</code> for your workload.</p><h2 id=validate-mtls-from-metrics>Validate mTLS from metrics</h2><p>If you have <a href=/v1.26/docs/ops/integrations/prometheus/#installation>installed Prometheus</a>, you can set up port-forwarding and open the Prometheus UI by using the following command:</p><pre><code class=language-bash data-expandlinks=true data-repo=istio