Customer has configured URL filtering in the application policy but the URL filtering is not working for sites like www.facebook.com or www.youtube.com.

The URL filtering configuration is as below.

URL Filtering is not blocking the sites related to the URL categories

Upon running a PCAP on the outgoing interface of the SSR, we found that the traffic was hitting the destination IP-Address 85.115.53.180 and the Info tab in Wireshark showed the below information.

When we checked the information about the IP-Address, it was found to be related to Forticlient. The customer had forticlient installed on their laptop due to which it was acting as the proxy as well as the firewall. So any traffic sent to the destination sites like www.facebook.com or www.youtube.com were being masked as Forticlient IP-Addresses. Below is the information about the Destination IP-Address seen in the packet capture.

Once forticlient was disabled on the customer's laptop, when we tried to access the sites like facebook.com or youtube.com, they were showing the proper public IP-Addresses for these sites and the URL filtering blocked them as expected.