Cloud Managed

Enable Safe Search Enforcement in a URL Access Management profile.
Select
Manage
Configuration
Security Services
URL Access Management
.
Under URL Access Management Profiles, select an existing profile or
Add Profile
to create a new one. Configuration options appear.
Under
Settings
, select
Safe Search Enforcement
.
Save
the profile.
(
Optional
) Restrict the search engines that end users can access.
Select
Manage
Configuration
Security Services
URL Access Management
.
Under
Access Control
,
Search
( ) for the
search-engines
category.
Set Site Access for the
search-engines
category to
block
.
In a later step, you’ll create a custom URL category (URL List type) with the search engines you want to allow.
Save
the profile.
Apply the URL Access Management profile to Security policy rules that allow traffic from clients in the trust zone to the internet.
To activate a URL Access Management profile (and any Security profile), add it to
profile group
and reference the profile group in a Security policy rule.
Create a custom URL category for the supported search engines.
In the next step, you’ll configure the firewall to decrypt traffic to this custom category.
Select
Manage
Configuration
Security Services
URL Access Management
.
Under
Access Control
, for Custom URL Categories,
Add Category
.
Enter a
Name
for the category, such as
SearchEngineDecryption
.
For
Type
of custom URL category, select
URL List
.
Under
Items
,
Add
the following entries to the URL list:
www.bing.*
search.yahoo.*
yandex.com.*
Save
the custom category.
Configure Site Access for the new custom URL category.
Under URL Access Management Profiles, select the profile you configured earlier.
Under Access Control, select the new custom URL category. It appears in the Custom URL Categories section above External Dynamic URL Lists and Pre-Defined Categories.
Set
Site Access
to
allow
.
Save
your changes.
Configure SSL Forward Proxy decryption.
Because most search engines encrypt their search results, you must enable SSL Forward Proxy decryption so the firewall can inspect the search traffic and detect the safe search settings.
Under the
Services and URLs
section of the Decryption policy rule, click
Add URL Categories
. Then, select the custom URL category you created earlier. New custom categories sit at the top of the list.
Save
the Decryption policy rule.
Select
Push Config
to activate your changes.
Verify the Safe Search Enforcement configuration.
This verification step only works if you use block pages to enforce safe search. There is an alternative verification step if you enable safe search transparently.
From a computer behind the firewall, disable the strict search settings for a supported search provider. For example, on bing.com, click the
Preferences
icon on the Bing menu bar.

Set the
SafeSearch
option to
Moderate
or
Off
, and click
Save
.
Perform a Bing search (or search using another provider) to see if the URL Access Management safe search block page displays instead of search results:

Use the link on the block page to update the safe search setting to the strictest setting (
Strict
in the case of Bing), and then click
Save
.
Perform a search again from Bing and verify that filtered search results display instead of the block page.