Hello friends, welcome to Day 34 of my PCNSA series. In this lab I explain a very common real-world requirement: how to allow Facebook but block specific features inside it—like videos, chat, rooms, games, etc. In my previous video I covered blocking a specific URL and how External Dynamic List works, but today the focus is application control with sub-features and why SSL decryption is the key part. I start by creating a security policy to allow only the “facebook-base” application (plus DNS, because facebook.com must resolve). Without decryption, you’ll notice Facebook loads and even videos can still play, which confuses many people in production. Then I implement an SSL Forward Proxy decryption policy and retest—now only the base Facebook page works, and inner features like videos stop working because the firewall can finally see the sub-application properly. After that, I show how to selectively allow a sub-feature (example: facebook-video) and commit again, and you can see the video starts working. Finally, I verify everything from the Monitor logs to confirm what is allowed and what is getting blocked. The takeaway is simple: if you want to control sub-applications inside HTTPS apps, SSL decryption is mandatory.