>
    PAN-OS & Panorama
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced URL Filtering
    3. URL Filtering Features
    4. Safe Search Enforcement
    5. Force Strict Safe Search
    6. PAN-OS & Panorama
    Download PDF
    Advanced URL Filtering

    PAN-OS & Panorama

    Table of Contents

    PAN-OS & Panorama

    Configure the strictest Bing and Yahoo SafeSearch settings for end users without requiring manual adjustment of the search engine settings.
    1. Make sure the firewall is running Content Release version 475 or later.
      1. Select
        Device
        Dynamic Updates
        .
      2. Check the
        Applications and Threats
         section to determine what update is currently running.
      3. If the firewall is not running the required update or later, click
        Check Now
         to retrieve a list of available updates.
      4. Locate the required update and click
        Download
        .
      5. After the download completes, click
        Install
        .
    2. Enable Safe Search Enforcement in a URL Filtering profile.
      1. Select
        Objects
        Security Profiles
        URL Filtering
        .
      2. Select an existing profile to modify or clone the default profile to create a new profile.
      3. On the
        URL Filtering Settings
         tab, select
        Safe Search Enforcement
        .
    3. (
      Optional
      ) Restrict the search engines that end users can access in the same URL Filtering profile.
      1. On the
        Categories
         tab,
        Search
         ( ) for the
        search-engines
         category.
      2. Set Site Access for the
        search-engines
         category to
        block
        .
        In a later step, you’ll create a custom URL category (URL List type) with the search engines you want to allow.
      3. Click
        OK
         to save the profile.
    4. Apply the URL Filtering profile to Security policy rules that allow traffic from clients in the trust zone to the internet.
      1. Select
        Policies
        Security
        . Then, click the rule to which you want to apply the URL Filtering profile.
      2. On the
        Actions
         tab, find Profile Setting. For
        Profile Type
        , select
        Profiles
        . A list of profiles appears.
      3. For the
        URL Filtering
         profile, select the profile you created earlier.
      4. Click
        OK
         to save the Security policy rule.
    5. Edit the URL filtering safe search block page, replacing the existing code with JavaScript for rewriting search query URLs.
      1. Select
        Device
        Response Pages
        URL Filtering Safe Search Block Page
        .
      2. Select
        Predefined
         and then click
        Export
         to save the file locally.
      3. Use an HTML editor and replace all of the existing block page text with the following text. Then, save the file.
        <html>
  <head>
    <title>Search Blocked</title>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
    <meta http-equiv="pragma" content="no-cache">
    <meta name="viewport" content="initial-scale=1.0">
    <style>
      #content {
      border:3px solid#aaa;
      background-color:#fff;
      margin:1.5em;
      padding:1.5em;
      font-family:Tahoma,Helvetica,Arial,sans-serif;
      font-size:1em;
      }
      h1 {
      font-size:1.3em;
      font-weight:bold;
      color:#196390;
      }
      b {
      font-weight:normal;
      color:#196390;
      }
    </style>
  </head>
  <body bgcolor="#e7e8e9">
    <div id="content">
      <h1>Search Blocked</h1>
      <p>
        <b>User:</b> 
        <user/>
      </p>
      <p>Your search results have been blocked because your search settings are not in accordance with company policy.  In order to continue, please update your search settings so that Safe Search is set to the strictest setting. If you are currently logged into your account, please also lock Safe Search and try your search again.</p>
      <p>
        For more information, please refer to: 
        <a href="<ssurl/>">
          <ssurl/>
        </a>
      </p>
      <p id="java_off"> Please enable JavaScript in your browser.<br></p>
      <p><b>Please contact your system administrator if you believe this message is in error.</b></p>
    </div>
  </body>
  <script>
    // Grab the URL that's in the browser.
    var s_u = location.href;
    //bing
    // Matches the forward slashes in the beginning, anything, then ".bing." then anything followed by a non greedy slash. Hopefully the first forward slash.
    var b_a = /^.*\/\/(.+\.bing\..+?)\//.exec(s_u);
    if (b_a) {
       s_u = s_u + "&adlt=strict";
        window.location.replace(s_u);
        document.getElementById("java_off").innerHTML = 'You are being redirected to a safer search!';
    }
    //yahoo   
    // Matches the forward slashes in the beginning, anything, then ".yahoo."" then anything followed by a non greedy slash. Hopefully the first forward slash.   
    var y_a = /^.*\/\/(.+\.yahoo\..+?)\//.exec(s_u);    
    if (y_a) {
        s_u = s_u.replace(/&vm=p/ig,"");
        s_u = s_u + "&vm=r";
        window.location.replace(s_u);
        document.getElementById("java_off").innerHTML = 'You are being redirected to a safer search!';
    }   
    document.getElementById("java_off").innerHTML = ' ';
  </script>
</html>
    6. Import the edited URL filtering safe search block page onto the firewall.
      1. Select
        Device
        Response Pages
        URL Filtering Safe Search Block Page
        .
      2. Click
        Import
        . Then,
        Browse
         for the block page file or enter the path and filename in the
        Import File
         field.
      3. (
        Optional
        ) For
        Destination
        , select either the virtual system on which the login page will be used or
        shared
         to make it available to all virtual systems.
      4. Click
        OK
         to import the file.
    7. Create a custom URL category for the supported search engines.
      In the next step, you’ll configure the firewall to decrypt traffic to this custom category.
      1. Select
        Objects
        Custom Objects
        URL Category
         and
        Add
         a custom category.
      2. Enter a
        Name
         for the category, such as
        SearchEngineDecryption
        .
      3. Add
         the following entries to the
        Sites
         list:
        • www.bing.*
        • search.yahoo.*
        • yandex.com.*
      4. Click
        OK
         to save the custom URL category.
    8. Because most search engines encrypt their search results, you must enable SSL Forward Proxy decryption so the firewall can inspect the search traffic and detect the safe search settings.
      On the
      Service/URL Category
       tab of the Decryption policy rule,
      Add
       the custom URL category you created earlier. Then, click
      OK
      .
    9. Commit
       your changes.
    10. Verify the Safe Search Enforcement configuration.
      From a computer behind a firewall, open a browser and perform a search using Bing or Yahoo. Then, use one of the following methods to verify your configuration works as intended:
      • Examine the query string of the URL for safe search parameters. Safe Search Settings for Search Providers lists the safe search parameter appended to each search query URL.
      • Go to the Safe Search settings for the search engine and verify that the selected SafeSearch preference is the strictest level (
        Strict
         in the case of Bing).

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.