How to tell which rule is passing traffic?

Check #1 in my guide here. Take packet capture based on source or destination host. This will give you a brief idea. 

Thanks

HI rfcat_vk, 

You may need to check which address is resolved on your system to access facebook, at my setup I have used XG as a DNS server for simplicity and also you may follow the steps as per the snaps provided. 

Hi and thank you for the answers.

I setup a rule using applications, then disabled my general access rule to see what worked and didn't work.

Facebook worked, most other applications didn't, but my weather station did which surprised me.

I think I have it under control.

Some mail inserts don't download. I expect to see lots of errors in today's logs.

Several years back with a sophos utm 100 something...

The boss's daughter was supposed to be working and she got caught her on facebook.  I ended up using an application rule to keep the peace.

Without the ability to block https traffic, the web blocking didn't work with facebook because when it blocked http://facebook.com facebook would re-direct to https://facebook.com 

I have facebook working, but not https scanned, that failed.

The trouble is how do I know the downloads from facebook are not polluted?

Hi,

Make sure necessary configuration is done in the Web Protection module to allow/block Facebook. Next, we have several FB application signature to block/allow. You just have to simply define the block on particular FB associated feature with microapp scanning enabled. NOTE: this will require the appliance CA installed on the local systems.

Hope that helps

Hi,

I had to remove the https scanning, too many things broke even after importing the CA. Maybe I need a real CA. FF worked, MAC mail and safari would not download all pages.

More investigative work to complete to find why the MAC will not obey the certificate?

is it me, or was https invented with the idea in mind NOT to have a man in the middle? ......like XG now is trying to be

It was originally as you point out, but now most if not all security devices are able to scan https for bad stuff. You do need a certificate for the scanning to work correctly.