Rule to allow HTTP/HTTPS traffic to a specific domain is allowing all HTTP/HTTPS traffic.

do you want to allow only canva.com?

or you want to allow http and https service only to specific domain canva.com and rest of the traffic should not match this policy?

he reason rule 143 grabs everything is that the webfilter has nothing to do with which traffic matches the policy. Policy selection is purely L3/L4: srcintf, dstintf, srcaddr, dstaddr, service, schedule. Security profiles (webfilter, AV, IPS) are applied AFTER the policy is already matched. They inspect the session, they do not narrow the match. With dstaddr "all" and service HTTP/HTTPS, this policy by definition matches every web session from LAN to INTERNET, and the geoblock below never sees it.

Two more things on your URL filter: action allow is an exemption (skip further webfilter checks), not a "whitelist this, block everything else" switch. So that whole approach cannot do what you want anyway.

To steer ONLY canva.com over the geoblock, the destination has to be expressed as an address object in the policy:

FQDN object:

config firewall address
    edit "canva.com"
        set type fqdn
        set fqdn "canva.com"
    next
end

config firewall policy
    edit 143
        set name "Allow-Canva-LAN"
        set srcintf "LAN_ZONE"
        set dstintf "INTERNET_ZONE"
        set srcaddr "all"
        set dstaddr "canva.com"
        set action accept
        set schedule "always"
        set service "HTTP" "HTTPS"
        set nat enable
    next
end

Caveat with FQDN: the FortiGate resolves it with its own DNS and builds a dynamic IP set. On a CDN-backed site with short TTLs and rotating IPs, the resolved set often differs from what the client gets, so matching is flaky. Canva also pulls assets from several other FQDNs, so a single object will not render the full site. Expect to add more FQDNs or a wildcard, and even then third-party assets stay outside it.

More reliable for a SaaS/CDN target is the Internet Service DB. Check config firewall internet-service-name for a Canva entry. If it exists:

config firewall policy
    edit 143
        set internet-service enable
        set internet-service-name "Canva-Web"   (use the exact name on your box)
        ...
    next
end

Note: with internet-service enable, dstaddr is replaced by the ISDB object and the service is derived from it.

One ordering point that will bite you: once a session matches this allow policy at the top, it is NOT re-evaluated by your scrubbing rules further down. So canva.com would bypass not just the geoblock but all your downstream inspection. If you want canva to keep getting your normal scrubbing, put your standard UTM profile set on this policy too, or instead exempt the Canva ISDB/FQDN inside the geoblock rule rather than punching a separate allow above it.

How can I configure a FortiGate 7.2.13 firewall policy to allow HTTP/HTTPS traffic only to a specific public domain or a small whitelist of domains without unintentionally permitting all web traffic? I created a policy using a URL Filter profile and expected only requests matching the approved domain names to hit that rule, while all other traffic would continue down to existing firewall policies. However, after enabling the rule, the logs show that traffic to many unrelated websites is also matching the policy. I've tested both Simple URL Filter and Wildcard Filter configurations, but the behavior remains the same. What is the correct way to restrict access to only specific domains and ensure non-matching HTTP/HTTPS traffic is processed by subsequent firewall rules instead of being allowed by the whitelist policy?