How to configure a network to block all website but just allow google apps mail?

Create a webfilter security profile (or use the defaut one that already exists if you want) and enable the static url filter in it. Then make three rules:

1. Allow https://mail.google.com/a/* by Exempt

2. Allow https://mail.google.com/mail by Exempt

3. Block everything else (i,e, block *)

Then keep the rules in this order (you may exchange 1. and 2. but the block everything rule must be the last one).

Also you have to use "exempt" and not "allow" because you want the filter to stop once one rule allowed access to the site. Without "exempt" it would block everything even though there is 1. and 2. because it won't stop.

Once you are done with that save your profile and apply it as webfilter profile to your wan policy(s) for that network.

then you are done :)

hth

Sebastian