Firewall rules hierarchy. How do they work?

The rule hierarchy works as any L3-L4 Firewall, the firewall will always match the Source/Destination Zone/IP/Port then apply the L7 features such as web filtering and application control.

To explain what happened in your setup, when you created a secondary rule to restrict access to Facebook in the top of the older web filtering, any traffic that matched that Destination IP/Port went over that rule (Rule on top), which means - since it probably had WAN/ANY as destination - all traffic went over the same web filtering policy.

In your case, if you want to apply multiple web filtering over a single user or network, you will need to do this either though a single firewall rule, or create two separate firewall rules with different IP/Port destinations.

The rule hierarchy works as any L3-L4 Firewall, the firewall will always match the Source/Destination Zone/IP/Port then apply the L7 features such as web filtering and application control.

To explain what happened in your setup, when you created a secondary rule to restrict access to Facebook in the top of the older web filtering, any traffic that matched that Destination IP/Port went over that rule (Rule on top), which means - since it probably had WAN/ANY as destination - all traffic went over the same web filtering policy.

In your case, if you want to apply multiple web filtering over a single user or network, you will need to do this either though a single firewall rule, or create two separate firewall rules with different IP/Port destinations.

Thanks for the reply. Everything's clear. Thanks again..