Allow only certain sites and if do not match next policy

[Andenur]

I need all (all internal ip addresses: servers and workstations) open only certain sites for example apple.com, google.com over the HTTP and HTTPS protocol.

I also need all users (with authentication) who work on workstations to open access to the Internet, with the exception of for example audio/video (for example, Youtube).

I created a firewall policy with SSL Deep (ID1) inspection that allows access to all (without authentication) from the inside to the sites apple.com, google.com, using WEB filter, where I disabled the FortiGuard category based filter and added apple.com, google.com in Static URL Filter to ALLOW.

The following firewall policy with SSL Deep inspection (ID2) below allows internet access except for audio/video using application control also.

as a result, I have all the traffic going through the policy(ID1) where all sites are opened, even audio/video (for example, Youtube).

I understand that in Static URL Filter Allow is the default action and everything that is not specified in it is allowed.

How do I make sure that what is not specified in the Static URL Filter is not taken into account?

Or how do I implement my task?

[sw2090]

First you need one policy for each case. 

Policies are top down. First match wins.

so policy with authentication has to come before the other one.

then you must enable ssl deep inspection in both policies (because url filter cannot work for https without it).

then add a webfilter profile to both policies.

the 2nd policy should have a static url filter that allows access to what you wrote and blocks the rest. Beware that you url filter rules to allow something have to have action "exempt" then to have the filter stop once the rule matched. URL filter rules are top down just like policies.

So do e.g.

1. exempt *.apple.com type wildcard

2. exempt *.google.com type wildcard

3. block * type wildcard

if you want to allow/block specific urls you can also use a static entry or regular expressions.

[Andenur]

Thanks for the answer. In principle, this method works. But if this is a proxy policy for non-authenticated users, an authorization request pops up and does not go to the next policy.