How much of an Applcation Control profile includes urls?

[TheGorf]

I've been building some policies to control egress and I came across and interesting situation. I was building a policy for Apt (apt-get). And it works perfectly fine. Except for when a server has an additional repository installed. These are all Debian 12. And everything works except for when the Docker repos refresh. In which case Apt starts getting back 403's and 401s. Toggling the policy on and off directly affects whether Apt works correctly or not. 

So, I'm trying figure out if this is my outbound SSL inspection policy meddling with a pinned cert or something I need to modify in my policy. 

Thanks all for the thoughts on this.

[akutsage1]

I don't think there's any such thing as precedence. If you have both enabled then they must both permit the traffic for it to be allowed. If the WF permits but AC blocks then the session is blocked.

[AEK]

What do you see in the related FGT's deny traffic log? It should provide the detailed reason for which it has denied the traffic. Check also the security log in the related deny traffic log, to see which security profile has denied it and why.