Application Policy Blocking

[HANDL_Eric]

Hello,

we're in the process of planning/implementing application policies and having a hard time understanding matching criteria and how a profile entry behaves with an application policy defined. 

Looking at a profile based policy and using DNS as an example, I could create an app policy with the block action set for DNS related application signatures and associate that to the LAN -> WAN policy entry which would then block devices in the LAN zone from reaching DNS servers in the public cloud. 

Is what I don't understand is what happens when you need to apply multiple policies? Say I need to block the entire LAN zone from using public DNS but then wanted to block TeamViewer for a specific network inside the LAN zone. The traffic would process down the list and match the first profile entry (Lets say that's the TeamViewer blocking entry) carrying a DNS payload and that policy isn't going to match application and then allow the traffic out to the internet and it wouldn't even proceed to that second policy entry, so DNS wouldn't be blocked right?

Assuming that's correct - is switching from profile to policy based the only way to factor application into the matching criteria so we could run sequential application based rules? We've been avoiding policy based firewall mode due to feedback we've received both from Fortinet support and some other people we've spoken with across the industry so wanted to open this thread and see if there's something simple we're missing.