Make Whitelisting IP addresses easier

I imagine you are referring to whitelisting IP addresses in regards to web filtering? That is already very possible and easy to implement. In short- you create a policy above your "main" web filtering policy with the IPs you want to whitelist as the destination.

The firewall processes traffic according to the policies from top down, so you need to make sure your policies are set from most specific to least in order to properly handle traffic without causing shadowed or redundant rules. In a simple example, you have a policy for web access with the source as all internal IPs, destination all external IPs, services HTTP and HTTPS, with a web filter security profile inspecting traffic. Create an address group called "web filter exempt destinations" or whatever you want to call it. Add address objects to that group with the IP addresses of the destinations you want to exempt. Create a new policy above your main web filter policy with the source as all internal IPs (or whichever internal address objects are allowed to get exempted), destination as web filter exempt destinations, services HTTP and HTTPS, and no web filter policy (or a different web filter that only monitors). When you find you need an IP whitelisted, just create an address object for it and add it to the exempt address group.

The traffic flow will be that your client will hit the first rule when browsing to a page hosted on exempted IPs and not get web filter blocked, but when they browse to other sites they will get the second more broad policy with standard filtering.

The first caveat to this is if your exempt list starts to contain many addresses, it may affect firewall performance (especially on smaller models) as the system needs to parse through a much larger and more complex ruleset. In general, pure firewalling performance is much faster than traffic inspection and it might not realistically become noticeable in most cases, but probably avoid hundreds or thousands of individual address objects.

You want to be very careful about whitelisting external IPs, especially if they are on shared hosting. If something bad is hosted at the same IP address as something you originally whitelisted, the firewall will not really be able to tell and will let that traffic through. This is less of an issue for trusted vendors or internal or DMZ web pages.

If you do web filter based usage reporting, you may want to create a separate web filter that does monitor only to keep visibility into the web traffic for these addresses. We do periodic reviews of web usage to find things out of the ordinary- exempting a bunch of traffic from web filtering altogether would skew some of this data since it would not be picked up. This would also help with the previous issue as it would pick up the URL being requested and if someone notices a bad URL passing through the exemption rule, you could perform some tweaking to stop it.