setting enables safe search functionality.
When enabled, the setting is stored in a browser cookie as
passed to the server each time the user performs a Google search.
a Google search query URL also enables the strictest safe search
Safe Search Enforcement for Google and YouTube Searches
using a Virtual IP Address
Google provides servers that Lock SafeSearch (forcesafesearch.google.com) settings
in every Google and YouTube search. By adding a DNS entry for
other relevant Google and YouTube country subdomains) that includes
a CNAME record pointing to
your DNS server configuration, you can ensure that all users on
your network are using strict safe search settings every time they
perform a Google or YouTube search. Keep in mind, however, that
this solution is not compatible with Safe Search Enforcement on
the firewall. Therefore, if you are using this option to force safe
search on Google, the best practice is to block access to other
search engines on the firewall by creating custom URL categories
and adding them to the block list in the URL Filtering profile.
PAN-OS supports safe search enforcement
for YouTube through HTTP header insertion. HTTP header insertion
is not currently supported for HTTP/2. To enforce safe search for YouTube, App-ID and HTTP/2 Inspection downgrade
HTTP/2 connections to HTTP/1.1 using the
in the appropriate decryption profile.
If you plan to use the Google Lock SafeSearch solution, consider
configuring DNS Proxy (
) and setting the
inheritance source as the Layer 3 interface on which the firewall
receives DNS settings from service provider via DHCP. You would
configure the DNS proxy with
www.google.com and www.youtube.com, using the local IP address for
the forcesafesearch.google.com server.