PAN-OS

  1. Enable Safe Search Enforcement in a URL Filtering profile.
    1. Select
      Objects
      Security Profiles
      URL Filtering
      .
    2. Select an existing profile to modify or clone the default profile to create a new profile.
    3. On the
      URL Filtering Settings
      tab, select
      Safe Search Enforcement
      .
  2. (
    Optional
    ) Restrict the search engines that end users can access in the same URL Filtering profile.
    1. On the
      Categories
      tab,
      Search
      ( ) for the
      search-engines
      category.
    2. Set Site Access for the
      search-engines
      category to
      block
      .
      1. Add each search engine you want end users to access to a custom URL category of
        URL List
        type.
    3. Click
      OK
      to save the profile.
  3. Apply the URL Filtering profile to Security policy rules that allow traffic from clients in the trust zone to the internet.
    1. Select
      Policies
      Security
      . Then, click the rule to which you want to apply the URL Filtering profile.
    2. On the
      Actions
      tab, find Profile Setting. For
      Profile Type
      , select
      Profiles
      . A list of profiles appears.
    3. For
      URL Filtering
      profile, select the profile you created earlier.
    4. Click
      OK
      to save the Security policy rule.
  4. Create a custom URL category for the supported search engines.
    In the following step, you’ll specify that you want to decrypt traffic to the sites in the custom category.
    1. Select
      Objects
      Custom Objects
      URL Category
      and
      Add
      a custom category.
    2. Enter a
      Name
      for the category, such as
      SearchEngineDecryption
      .
    3. Add
      the following entries to the
      Sites
      list:
      • www.bing.*
      • search.yahoo.*
      • yandex.com.*
    4. Click
      OK
      to save the custom category.
  5. Configure Site Access for the new custom URL category.
    1. Go to
      Objects
      Security Profiles
      URL Filtering
      and select the URL Filtering profile you configured earlier.
    2. On the
      Category
      tab, select the new custom URL category. It appears in the Custom URL Categories section above External Dynamic URL Lists and Pre-defined Categories. Then, set
      Site Access
      to
      allow
      .
    3. Click
      OK
      to save your changes.
  6. Because most search engines encrypt their search results, you must enable SSL Forward Proxy decryption so the firewall can inspect the search traffic and detect the safe search settings.
    On the
    Service/URL Category
    tab of the Decryption policy rule,
    Add
    the custom URL category you created in a previous step. Then, click
    OK
    .
  7. Commit
    your changes.
  8. Verify the Safe Search Enforcement configuration.
    This verification step only works if you use block pages to enforce safe search. There is an alternative verification step if you enable safe search transparently.
    1. From a computer behind the firewall, disable the strict search settings for a supported search provider. For example, on bing.com, click the
      Preferences
      icon on the Bing menu bar.
    2. Set the
      SafeSearch
      option to
      Moderate
      or
      Off
      , and click
      Save
      .
    3. Perform a Bing search (or search using another provider) to see if the URL Filtering Safe Search Block page displays instead of search results:
    4. Use the link on the block page to update the safe search setting to the strictest setting (
      Strict
      in the case of Bing), and then click
      Save
      .
    5. Perform a search again from Bing and verify that the filtered search results display instead of the block page.

Recommended For You