Application Control and Web Filtering not working together.

[Ali84]

I want to keep Office apps open and also let the user browse to some specific URLs, but the web filtering works properly only if I apply alone, not with Application Control. 

Any advice on how I can do that? 

I have the 6.4.8 version

[gfleming]

How is it not working? please describe the issue. What are you expecting in terms of Fortigate behaviour and what are you experiencing?

Also is this policy getting hit? Or is another policy above it taking precedence?

[Ali84]

Let's talk about only this policy that I shared.

I expect that this policy blocks all the URLs and only Allows specific URLs in the list to open in the browser, but it's not working, and all the URLs are blocked.

We have a lot of policies, but I put this at the Top of the policy list. I also moved it to the end of the list, but nothing changed. 

It only keeps FB open for me. (that's the exciting part)

[funkylicious]

Try moving the *.* block rule at the end of the list

[gfleming]

I don't think you can accomplish what you want to do here using URL Filter. You cannot block all URLs in the filter and still expect some to be allowed. At least for this I am fairly sure.

For your case I would consider leveraging the ISDB, FGDN Address Objects or Customer Web Filter categories and Overrides:

https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/918943/overrides

[srajeswaran]

Can you share your firewall policy configuration as well?

[Ali84]

Hi, 

Sorry about the delay. It seems Web Filter is not working correctly. 

Please consider my firewall-config 

Regards

[Ali84]

Thanks for all your support. 

I fixed this, but I want to share some experiences that sometimes confused me. 

1 - I have to have a separate policy for YouTube, the *.* didn't block it, and I made Application Control for that. 

2 - Sometimes policies are affected right away but sometimes takes 10 to 15 min. 

Thanks from everyone.

[gfleming]

If you're creating a new policy, existing sessions may still be allowed. The info here might help you:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dirty-session/ta-p/197748