how to Sophos firewall YouTube and Facebook access block specify users with static IP address

Hello Faizullah Mughal ,

Thank you for reaching out to the community, you can block the youtube and facebook with the application control, please refer the screenshot and a link below:
Application Control Rules - https://docs.sophos.com/nsg/sophos-utm/utm/9.708/help/en-us/Content/utm/utmAdminGuide/WebProtAppControlApplicationControlRules.htm

Vivek Jagad I'm not entirely sure if facebook uses ipv6, but youtube does. Assuming slaac is enabled for the ipv6 config, the above won't block youtube connections. Chrome appears to default to using ipv6 to connect to google services.

One can't define an ipv6 address for the host because it changes periodically.  For windows10;

Available options - "netsh interface ipv6 set privacy ?"

Not sure if it's possible to define a host object which identifies the temp ipv6 address. Probably have to use dhcpv6, but that defeats the benefits of slaac.

There's a setting under definition&users, network definitions, mac address definitions.  It would appear one could define the mac of the client in question, then apply it as an object in the web filter.  However, this appears broken. Objects defined here do not appear to be present in the list, nor are they present in the firewall source/destination lists.  In fact, since these objects can't be used, not sure why these definitions exist??

Vivek Jagad I'm not entirely sure if facebook uses ipv6, but youtube does. Assuming slaac is enabled for the ipv6 config, the above won't block youtube connections. Chrome appears to default to using ipv6 to connect to google services.

One can't define an ipv6 address for the host because it changes periodically.  For windows10;

Available options - "netsh interface ipv6 set privacy ?"

Not sure if it's possible to define a host object which identifies the temp ipv6 address. Probably have to use dhcpv6, but that defeats the benefits of slaac.

There's a setting under definition&users, network definitions, mac address definitions.  It would appear one could define the mac of the client in question, then apply it as an object in the web filter.  However, this appears broken. Objects defined here do not appear to be present in the list, nor are they present in the firewall source/destination lists.  In fact, since these objects can't be used, not sure why these definitions exist??

No besides  the firewall rule you can apply the mac address definitions else where. Jay Jay 

Thanks for clearing this up.  The OP's scenario would be a suitable use case for such.

Is there a solution to the op's scenario if ipv6 is involved?

Based on the list of IPv6 support  fully or partly [Application control is covered - https://docs.sophos.com/nsg/sophos-utm/utm/9.708/help/en-us/Content/utm/utmAdminGuide/InterfacesIPv6.htm]