default web policy "NO GAMES ADS OR EXPLICITI CONTENTS" didn't deny access to porn web sites

Question

Dear 
 i have problem that all porn sites working and SOPHOS didnt deny it, please let me know how i can use defoult web policy "NO GAMES ADS OR EXPLICITI CONTENTS" to deny access to porn web sites

thanks in advance

Ashen1 · Accepted Answer

Hi, 
 
 can you try changing one of your XG's DNS servers to 8.8.8.8 ? 
 
 Let us know how it goes. 
 
 Regards, 
 Rap

rfcat_vk · Answer

Hi, 
 I think you are trying to achieve too much with one rule. You should have a seperate rule at the top for your VoIP with limited destinations to stop strange connections. 
 Your rule looks okay from what I can see of it and the micro site check is on by default from mr5 if I remember correctly. 
 I can now see all you screen shots a lot better, not sure why. Your DNS is the issue not the rule itself. If you look at your logs you will see all the sites are unclassified which is what xlr8 was getting at. 
 I am not sure why you are using the internal interfaces of the XG as a DNS because the XG doe not have a DNS proxy, trying using the DNS provided by your ISP. 
 Ian

rfcat_vk · Answer

Hi, 
 while you suggestion will add an extra layer to the blocking process, none of that will work until he fixes the DNS issue. The sites are failing the XG checking process because he is not contacting the classification server. All the sites are showing unclassified in his logs. 
 Ian

Hani Omar · Answer

Dears 
 frist i need to give special thank you for xlr8 and rfcat_vk and another thank you for how trying to help me, actualy my problem solved right now after couble of days of trying find where the issue and based on xlr8 and rfcat_vk replays i focused on the DNS and the issue solved after reconfigure my local domain DNS and speciaiily DNS FORWARDERS, so i configure DNS forworders to redirect any unknown query to 8.8.8.8 and once i configure it the rule working fine without adding any extra configuration on the SHOPHS firewall even i didn't change the rule to be in the top i keep its arrangement as it is, also didn't make any reset or any extra configuration than i sent in my screenshoots. 
 
 really thank you very much for all. 
 
 Yours 
 HaniOmar