By default, when you enable safe search enforcement, when a user attempts to perform a search without using the strictest safe search settings, the firewall will block the search query results and display the URL Filtering Safe Search Block Page. This page provides a link to the search settings page for the corresponding search provider so that the end user can enable the safe search settings. If you plan to use this default method for enforcing safe search, you should communicate the policy to your end users prior to deploying the policy. See Table: Search Provider Safe Search Settings for details on how each search provider implements safe search. The default URL Filtering Safe Search Block Page provides a link to the search settings for the corresponding search provider. You can optionally Customize the URL Filtering Response Pages.
Alternatively, to enable safe search enforcement so that it is transparent to your end users, configure the firewall to Enable Transparent Safe Search Enforcement.
Enable Safe Search Enforcement
Enable Safe Search Enforcement in the URL Filtering profile. Select Objects > Security Profiles > URL Filtering. Select an existing profile to modify, or clone the default profile to create a new profile. On the Settings tab, select the Safe Search Enforcement check box to enable it. ( Optional ) Restrict users to specific search engines: On the Categories tab, set the search-engines category to block. For each search engine that you want end users to be able to access, enter the web address in the Allow List text box. For example, to allow users access to Google and Bing searches only, you would enter the following: www.google.com www.bing.com Configure other settings as necessary to: Define how to control access to web content. Define websites that should always be blocked or allowed. Click OK to save the profile.
Add the URL Filtering profile to the security policy rule that allows traffic from clients in the trust zone to the Internet. Select Policies > Security and select a rule to which to apply the URL filtering profile that you just enabled for Safe Search Enforcement. On the Actions tab, select the URL Filtering profile. Click OK to save the security policy rule.
Enable SSL Forward Proxy decryption. Because most search engines encrypt their search results, you must enable SSL forward proxy decryption so that the firewall can inspect the search traffic and detect the safe search settings. Add a custom URL category for the search sites: Select Objects > Custom Objects > URL Category and Add a custom category. Enter a Name for the category, such as SearchEngineDecryption. Add the following to the Sites list: www.bing.* www.google.* search.yahoo.* Click OK to save the custom URL category object. Follow the steps to Configure SSL Forward Proxy. On the Service/URL Category tab in the Decryption policy rule, Add the custom URL category you just created and then click OK.
( Optional , but recommended) Block Bing search traffic running over SSL. Because the Bing SSL search engine does not adhere to the safe search settings, for full safe search enforcement, you must deny all Bing sessions that run over SSL. Add a custom URL category for Bing: Select Objects > Custom Objects > URL Category and Add a custom category. Enter a Name for the category, such as EnableBingSafeSearch. Add the following to the Sites list: www.bing.com/images/* www.bing.com/videos/* Click OK to save the custom URL category object. Create another URL filtering profile to block the custom category you just created: Select Objects > Security Profiles > URL Filtering. Add a new profile and give it a descriptive Name. Locate the custom category in the Category list and set it to block. Click OK to save the URL filtering profile. Add a security policy rule to block Bing SSL traffic: Select Policies > Security and Add a policy rule that allows traffic from your trust zone to the Internet. On the Actions tab, attach the URL filtering profile you just created to block the custom Bing category. On the Service/URL Category tab Add a New Service and give it a descriptive Name, such as bingssl. Select TCP as the Protocol and set the Destination Port to 443. Click OK to save the rule. Use the Move options to ensure that this rule is below the rule that has the URL filtering profile with safe search enforcement enabled.
Save the configuration. Click Commit.
Verify the Safe Search Enforcement configuration. This verification step only works if you are using block pages to enforce safe search. If you are using transparent safe search enforcement, the firewall block page will invoke a URL rewrite with the safe search parameters in the query string. From a computer that is behind the firewall, disable the strict search settings for one of the supported search providers. For example, on bing.com, click the Preferences icon on the Bing menu bar.
Set the SafeSearch option to Moderate or Off and click Save. Perform a Bing search and verify that the URL Filtering Safe Search Block page displays instead of the search results:
Use the link in the block page to go to the search settings for the search provider and set the safe search setting back to the strictest setting ( Strict in the case of Bing) and then click Save. Perform a search again from Bing and verify that the filtered search results display instead of the block page.

Related Documentation