So I am doing an allow / deny by doing this.   For example geo-blocked country let's say Russia as destination: Security policy set to allow for TCP 80/443 (SSL/Web-Browsing) for destination Russia URL Filtering policy with all categories are set to Block.  This policy is assigned to Security policy mentioned above. Security policy set to Deny any any for Russia, this will cover the rest of the TCP/UDP ports By doing this I create a Layer 3/4 Allow and a Layer 7 Deny.  I then can look at my URL Filtering logs and see exactly what URL's have been blocked for my Geo-Blocked country Russia.   ... View more

Not sure why they don't show on your page.  This is my view exact same screen:  ... View more

Do you have the URL license on your firewall? if you do you can create a custom URL category to only allow the required domains for updating with the AppID's.  If you don't have the URL license, you still need the domains that need to be allowed.  You could create a rule using fqdn address objects and AppID's, the only problem with this solution is that IP's are contantly changing.  I think the default timer for fqdn refresh are 30min. ... View more

Learning Happy Hour guys has a video on this you should check out: https://www.youtube.com/watch?v=ztu1Ql20bgw&list=PLD6FJ8WNiIqUCHEz5r8KDmFFtE37PlZT_&index=4&t=0s   ... View more