[AF] Network does not match the [security protection Policies]
Problem Description
The user reported that a security protection policy of user protection type was Policies and the selected Zones was from trusted Zones to trusted Zones, but the Zones of the Network alarm Info was the untrusted Zones.
Warning Info
Botnet warning Info:

Policies:

solution
The Network alarm Info is normal. After AF7.3 version, the botnet protection object configured in [Policies] – [Security Policies] – [Security Protection Policies] is the source Zones. As long as the source Zones accesses a malicious domain name, it will be recorded.
Original Link
https://support.sangfor.com.cn/cases/list?product_id=13&type=1&category_id=707&isOpen=true