topic Re: Safe Search Enforcement in General Topics

Safe Search Enforcement

Welligton — Wed, 23 Jul 2014 14:35:16 GMT

Gentlemen,

I set up the Safe Search Enforcement option, as described in the documentation of Palo Alto Networks. But it still fails when it comes to blocking searches for porn on search engines.

Does anyone by chance have used this new option that is only available in version 6.0 PAN?

Thanks for everything.

Re: Safe Search Enforcement

kadak — Wed, 23 Jul 2014 16:43:20 GMT

Hello Welligton,

I wanted to point out couple of important things for successful safe search enforcement:

The following snippet was taken from the following document:

New Features Guide 6.0 (English) (Page 26 onwards)

Hope that helps!

Thanks and regards,

Kunal Adak

Re: Safe Search Enforcement

Welligton — Wed, 23 Jul 2014 18:08:18 GMT

Thanks, did not I heed some things.

Thanks for everything.

Re: Safe Search Enforcement

kadak — Thu, 24 Jul 2014 14:28:11 GMT

No worries Welligton. I am glad that I can help you.

Re: Safe Search Enforcement

dyang — Thu, 24 Jul 2014 19:26:21 GMT

One minor update to this is that as of content version 446 (released July 15, 2014), Safe Search enforcement also supports Yandex.

Re: Safe Search Enforcement

Miki5092 — Fri, 14 Nov 2014 19:21:06 GMT

Well it doesn't work for me and I am on 6.1.0 and I have followed up all instructions. :smileyconfused:

Re: Safe Search Enforcement

LCMember2860 — Mon, 24 Nov 2014 17:13:55 GMT

Google have introduced a virtual IP to facilitate the enforcement of safesearch (:

Block adult content at your school - Search Help

(option 3

I too have found PAN's safesearch enforcement feature buggy and unreliable, and Google's own solution has the added advantage that it requires no end-user configuration at all - safesearch gets forced on transparently. It's straightforward to set this up on our DNS servers using RPZ (we're already doing this for Google's nosslsearch virtual IP), but... we don't force users to use our DNS so they can easily bypass this by using Googles (or some other) DNS.

Is there some way to transparently proxy external DNS requests to our own servers - the DNS proxy feature seems to assume that requests are directed to the PAN firewall, so this isn't an option - maybe PBF or sinkholing could be used?