Security rule for url filtering - best practices?

[Borgiani]

I would like to know what is the impact, if any, when configuring a security policy with allow action and associate with a url filtering profile if we use application as any or application set to web-browsing.

I understand the url filtering is only applicable to web-browser traffic by default, but i want to understand what is the best thing to do and what impact come from a wrong choice.

Note that this rule goal is not to allow or block traffic. It is goal is to only select traffic from a specific source address (or group) and apply a previous defined url filtering profile to it.

[tasonibare]

Hello Vladimir,

URL filtering is triggered when there is a web-browsing or SSL traffic traversing the device, regardless of what you specify in the Application section of the security policy.

I would argue that it is best practice to specify web-browsing (and/or SSL) as the permitted application(s), but this only helps to lock down that security policy further; it is not a requirement for the URL filtering to be triggered.

Hope this helps.

tasonibare