Web Filtering Policy Not Applying

Can you provide us with more information, like screenshots of Web Filtering settings and Web Filtering > Policies.

I see. So policies can't be applied strictly based on users' static IP?

Yes, they can...:)

You have to create additional Webfilter Profile and put only that host IP network object into "Allowed Network" section. Remove user object from "Strict Filtering" policy and enable it into new profile.

Ok, great. One more thing... what's the best way to apply SSL filtering only to specific users/groups? Ideally, I'd like to disable SSL scanning on the default profile and only enable it on a particular group. Is that possible?

I don't think so...SSL scanning can be enabled/disabled on Webfiltering Profile level, and it is related to the hosts and networks objects defined in "Allowed Networks" section.

Thanks for the suggestions. I got it to work by creating a new Network Definition of type "Network Group" and then added the users to that group. Then created a new Web Filter Profile with HTTPS scanning enabled and added the Network Group to the profile's Allowed Networks. This way, only the users in the Network Group get SSL scanning and anyone else who falls under the default profile does not.

Did you test it successfully ?
Because User (Network) object can be used only when user was previously authenticated using SAA (local authentication agent) or RADIUS (for VPN).

Yes it is working. The users for which SSL scanning is enabled are browsing without errors and their browsers are using the UTM's certificate. Search results from SSL Google, etc. are now showing up in the log.

Did you disable SSL scanning in Default profile ?

When you say "Users", do you mean Hosts network definitions for static IP addresses ?

I disabled SSL scanning in the default profile but enabled it in a new Filter Profile that I called "SSL Filtering". For the users, I created a new Network Definition called "Office Workstations" of the Type "Network Group" and added my office workstation users to this group (the users had previously been created under Users and Groups with static IP addresses). Then I added this Network Group to the allowed networks in the SSL Filtering profile.

I disabled SSL scanning in the default profile but enabled it in a new Filter Profile that I called "SSL Filtering". For the users, I created a new Network Definition called "Office Workstations" of the Type "Network Group" and added my office workstation users to this group (the users had previously been created under Users and Groups with static IP addresses). Then I added this Network Group to the allowed networks in the SSL Filtering profile.