thank you @MerakiDave,   Agree, called support and found out endpoint issue. My bad, apologies for this one ... View more

If you install a second MX in concentrator mode at the DC plugged into the switch then this can work, we operate an SD-WAN similarly with the exception that the IPVPN at the Head Office (DC) is inside the internet firewall. ... View more

Well done! ... View more

Yes, you do need to use VLANs to define multiple subnets in the MX. ... View more

That's likely. The content filtering whitelist would just make sure that nothing is blocked based on the content filtering level. But the firewall will still block based on what it is setup to do. I'd just give it a short test to see if that is indeed the case. ... View more

@PhilipDAth is correct, you would not be able to create a whitelist exception when using L7 category blocking on the MR. You would need to create rules blocking the individual business management domains, as opposed to blocking the entire category. Luckily there are only 11 sites total in that category (including SalesForce) so you would just need to create 10 individual rules to block those sites. ... View more

yes, it gives server ip address but when using hostname.com.ph it gives DNS timeout, I'm currently troubleshooting   ... View more

@Rebry  @AjitKumar  @PhilipDAth    thank you so much for the inputs! ... View more

@AjitKumar has it right on Group Policies.   One question I have - are you leveraging content filtering at all, or just using L7 to accomplish these blocks? ... View more