Since the question shows the catch-all as *.*, just confirming if you are indeed using the asterisk symbol "*" as catch-all? Also, how does your normal/default policy look for block and allow URLs?

Could you share the dashboard network link? What is the IP of the RDP gateway?

Agreeing with PhilipDath's answer. Typically you will be using different tags only if you want any of the PSK, phase-1 or phase-2 settings different for any of the MX68s. If that's the case, you can configure the same peer again and use different set...