I just had Juniper support back on. They have resolved the problem. Apparently there are ways that users can get round it, but they're beyond most people's IT skills.
I hope this information helps...
a) Create an Address Group called
Blockedsites (or whatever).
b) Create a Policy like this:
Then for each website you want to block just do the following. No need to repeat the above steps.
1. BLOCK THE PURE DOMAIN NAME
2. Go to Policy > Policy Elements > Addresses > List
3. The drop-down should be Untrust, then click New.
4. Address Name – name the address the same as the domain name (e.g aaa.com)
5. Click Domain Name and enter the full domain (e.g
www.aaa.com)
6. OK this.
7. BLOCK ANY SUB-DOMAIN
8. Back in Policy > Policy Elements > Addresses > List , the drop-down should be Untrust, then click New.
9. Address Name – name the address the same as the domain name but with an asterisk (e.g aaa.com *)
10. Click Domain Name and enter the domain with an asterisk before it(e.g *.aaa.com)
11. OK this.
12. BLOCK ANY SUB-FOLDERS
13. Back in Policy > Policy Elements > Addresses > List , the drop-down should be Untrust, then click New.
14. Address Name – name the address the same as the domain name but with two asterisks (e.g aaa.com **)
15. Click Domain Name and enter the full domain with a forward slash and an asterisk after it(e.g
www.aaa.com/*)
16. OK this.
17. BLOCK THE IP ADDRESSES
18. Open a Command Prompt and enter (for example) ping aaa.com
19. Back in Policy > Policy Elements > Addresses > List , the drop-down should be Untrust, then click New.
20. Address Name – name the address the same as the domain name then add ‘IP’ to differentiate it from the other address(e.g aaa.com IP)
21. Click IP Address/Netmask (wildcard mask) and enter the IP address from the ping, with a 32 after the slash.
22. OK this.
23. Repeat for each IP you receive.
24. Go to Policy > Policy Elements > Addresses > Groups and Edit the Blockedsites Group.
25. On the right, multiple-click the new Addresses and click the << button to add them to the Group to be blocked (on the left).
26. Click OK.
27.
