Seems you should have a deeper look on your rule set and begin to use the features you paid for If you allow any application on port 80 and 443 and only apply an URL policy, you can not controll the traffic in your network. You allow anything that can use port 80 oer 443 (and thats more or less everything you might not want to allow) :smileyplain: The URL filter belongs to the content ID engine while the application "filter" belongs to the APP ID engine. URL filters only check the URL used in the traffic and nothing else. This is matched to traffic to websites accessed through HTTP and HTTPS. So SSH traffic will not be filtered because the SSH might only be used to tunnel other applications and there is no URL to match to. And SSH on 443 is decrypted so the firewall can not see what happens in the tunnel. You have to use decryption to look in the session and take action. If you only allow web-browsing, no one can use SSH to tunnel other application traffic. Maybe you should first try to use application "web-browsing" instead of "any" with service "application-default" or "service_http and service_https" (wit app default 443 is not allowed and needs a second rule but port 8080 is allowed). HTH
... View more
