When the action is set to Allow in an application override, traffic matching this override is allowed without generating security logs because it bypasses deeper inspection and blocking.

The sniffer output shows that packets from the web client are reaching the FortiGate and being forwarded to the web server, but there is no indication that the web server is responding. To troubleshoot this issue, executing a debug flow will help analyze the traffic path and pinpoint where the problem might be occurring, such as a possible issue in firewall policy or route settings that is causing the server not to respond correctly.

To block Remote-User2's access to the Webserver, the deny policy must explicitly specify the Webserver as the destination address; otherwise, it denies traffic to all destinations, which is not the desired behavior.

Move up Google in the Application and Filter Overrides section to set its priority to 1.
The "Excessive-Bandwidth" filter has a higher priority (1) and is configured to Block. Because Google applications generate significant bandwidth, they match this rule first and get blocked.
Moving the "Google" filter to priority 1 ensures that the monitor action for Google is applied before the block rule.
Set SSL inspection to deep-content inspection.
Google applications use HTTPS encryption, so the FortiGate cannot identify or control them unless SSL traffic is decrypted. Changing from certificate-inspection (which only inspects certificates) to deep-inspection allows FortiGate to fully analyze encrypted application traffic and properly apply the Application Control rules.

According to the FortiOS 7.6 Study Guide and technical documentation regarding High Availability (HA), the FortiGate Clustering Protocol (FGCP) uses a specific set of rules to elect the primary unit in a cluster. By default, the election order follows: Connected Monitored Ports > HA Uptime > Priority > Serial Number.
However, when the HA override setting is enabled, the election logic is modified to prioritize the administrator-defined priority value over the uptime of the cluster members. In this specific configuration, the election process follows this sequence:
* Connected monitored ports: The unit with the most functioning monitored interfaces is preferred.
* Priority: The unit with the highest manually configured priority value (e.g., 255) is selected next.
* HA uptime: If monitored ports and priority are equal, the unit that has been up in the HA cluster the longest is chosen.
* FortiGate serial number: As a final tie-breaker, the unit with the higher serial number is elected.1 Statement A is correct because it reflects the shift where Priority is evaluated immediately after monitored ports, overriding the standard uptime advantage. Statements B and D are incorrect because the FGCP uses HA uptime, not system uptime, for its calculations.