Firewall – Block YouTube from Fortinet firewall

You must construct your access list(s) in a a fashion which explicitly targets the traffic and / or hosts you wish to permit or deny, in this case, Host 1 and Host 2.

Example:

(config)# access-list 101 extended permit ip [host2] [host1] any
(config)# access-list 101 extended deny ip [host1] any log
(config)# access-list 101 extended permit ip any any

NOTE: The final line is required if you wish any other traffic from the same network as Host 2 to be allowed outside your firewall: a silent, implicit deny exists at the end of every Cisco ACL.

Then, on the interface which first receives this traffic initiated by Host 2 (inside):

(config-if): ip access-group 101 in

With regards to your request that Host1 may not communicate with Host2 unless Host2 has already begun a session with Host1, this is the default nature of the Cisco ASA: it is a stateful packet-filter: connections which were not initiated from the inside zone will not be accepted when coming from the outside, unless rules configured by the Administrator explicitly permit them.

See the following guide for more details:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/acl_overview.html

Though there are (as far as I know) no strict definitions, you say that policies are the abstract, high level definitions of what traffic should and shouldn't be allowed. Firewall rules are the translation of policies into practical configuration.

For example: the policy "allow only management traffic from trusted networks" is translated into rules which allow traffic from 192.2.0.0/24 to TCP/22 and from 192.2.100.0/24 to TCP/3389.