How can I get two profiles to work in conjunction with each other?

Question

I have two web filter policies (both set up by Sophos support). They are not interacting with each other. Here is my setup: 
 Profile One 
 
 Operation Mode: Transparent 
 Default Authentication: AD SSO 
 Policies=three starting with most restrictive 
 "Block access on authentication failure" is unchecked 
 
 Profile Two 
 
 Operation Mode: Transparent 
 Default Authentication: None 
 Policies=single policy (most restrictive policy listed in profile one) 
 "Block access on authentication failure" is unchecked 
 
 If I leave the profiles as listed above, unauthenticated users (such as my smartphone or guests) get blocked. I can't even open Google.com. If I invert the profiles, everyone is filtered by the same base policy and the SSO policies don't take effect. 
 Is there anyway to get these policies to work on an "if-then" relationship? Specifically, I need to use SSO unless the user is not part of my AD to which a default existing policy should be applied. No matter what I do (again, these were set up by Sophos support) I can't get this to work. 
 TIA.

sachingurung · Answer

Hi Mark, 
 Greetings. 
 You cannot use two Web Protection profile in conjunction. Firewall will always prioritize the profile in TOP-BOTTOM approach. Hence, the profile placed on TOP will be applied to the configured "Allowed Networks". 
 I think you are trying to achieve a setup where a group of users on AD, has to authenticate through UTM and has limited access, alongside the user which is not a part of AD, should pass through without authentication, again with limited access ? 
 This is not feasible if you are configuring similar Allowed Network in both the profile. 
 
 You must either define a separate network for non AD users or Define a particular range of IP address out of DHCP Range, which can be statically defined on devices for internet access without Authentication. 
 The configuration will be, set of allowed IP address which needs Authentication in profile 1. Next, configure set of IP address with None Authentication selected in profile 2. 
 
 Thanks