category keyword block in URL not working

something tells me a clue may be Allowed (Not decrypted)

To block anything other than the TLD, i.e. google.com, you need to decrypt and scan so the firewall can read the whole URL.

do I need to decrypt?

As per my understanding keyword filter in web category can do that looks like its not working  ; 

When I test rule, its applied and worked with I do policy check, but does not work with firewall check 

Yes you need to decrypt and scan to achieve the result you're after

URL is never encrypted, and always visible to firewall 

Here is the link I have I have followed instructions 

support.sophos.com/.../KB-000036901

okay, good luck

okay, good luck