Technical Tip: How to block URL category and Application in policy based NGFW-mode

[sashish]

Description	This article describes how to block URL categories without using a Web filter profile in NGFW-mode.
Scope	FortiGate v7.2.x.
Solution	It is possible to directly block the URL category and Application in the firewall policy.  In policy-based NGFW mode, the Firewall policy would be seen as a 'Security Policy'.  By default, the FortiGate is in profile mode. In profile-based mode, security profiles (such as antivirus, web filter, and application control) are created and then attached to firewall policies. In policy-based NGFW-mode allows to use of the applications and URL categories directly into security policies. To change the FortiGate in policy-based, use the below command.  krypton-kvm27 # config system settings      set ngfw-mode policy-based  end Note: All the policies will be wiped off if select policy-based.  It is necessary to log out from GUI and log in again to see 'Security Policy' instead of 'Firewall Policy'.  Go to Policy & Objects -> Security Profile.  It will block all the Social Networking websites which will hit the rule. In this way, there is no need to apply a Web Filter profile.  Related documents: Technical Tip: Profile-based policies vs Policy-based policies  Profile-based NGFW vs policy-based NGFW