Allow only certain sites and if do not match next policy
I need all (all internal ip addresses: servers and workstations) open only certain sites for example apple.com, google.com over the HTTP and HTTPS protocol.
I also need all users (with authentication) who work on workstations to open access to the Internet, with the exception of for example audio/video (for example, Youtube).
I created a firewall policy with SSL Deep (ID1) inspection that allows access to all (without authentication) from the inside to the sites apple.com, google.com, using WEB filter, where I disabled the FortiGuard category based filter and added apple.com, google.com in Static URL Filter to ALLOW.
The following firewall policy with SSL Deep inspection (ID2) below allows internet access except for audio/video using application control also.
as a result, I have all the traffic going through the policy(ID1) where all sites are opened, even audio/video (for example, Youtube).
I understand that in Static URL Filter Allow is the default action and everything that is not specified in it is allowed.
How do I make sure that what is not specified in the Static URL Filter is not taken into account?
so policy with authentication has to come before the other one.
then you must enable ssl deep inspection in both policies (because url filter cannot work for https without it).
then add a webfilter profile to both policies.
the 2nd policy should have a static url filter that allows access to what you wrote and blocks the rest. Beware that you url filter rules to allow something have to have action "exempt" then to have the filter stop once the rule matched. URL filter rules are top down just like policies.
So do e.g.
1. exempt *.apple.com type wildcard
2. exempt *.google.com type wildcard
3. block * type wildcard
if you want to allow/block specific urls you can also use a static entry or regular expressions.
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.