Force Safe Search without SSL decryption

[LucaMarchiori]

We are a K-12 school district.  SSL decryption is not in the cards, at least for the time being.  From what I read, enabling safe search enforcement in URL filtering profile will not work properly without having implemented SSL decryption

If that's correct, is a DNS proxy the way to go, as described here:

https://support.google.com/websearch/answer/186669?hl=en

Thanks

[acc6d0b3610eec313831f7900fdbd235]

@LucaMarchiori

Because most search engines encrypt their search results, you must enable SSL forward proxy decryption so that the firewall can inspect the search traffic and detect the safe search settings.

https://www.paloaltonetworks.com/documentation/60/pan-os/newfeaturesguide/content-inspection-feature...

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/url-filtering/safe-search-enforcemen...

https://researchcenter.paloaltonetworks.com/2015/01/firewall-pro-tip-enforce-safe-search-without-blo...

I don't think DNS Proxy will resolve this challenge for you, at least not based on my own experience.

I hope this helps.

[LucaMarchiori]

Hi Willian,

I might be wrong, but I don't see us implementing SSL decryption anytime soon, due to a number of factors.   Could you please elaborate a little, when you say that in your experience DNS-Proxy route is not going to resolve this? 

We are not looking for a fool-proof solution at this time, more like at having something in place, rather than nothing.

Did you find user were able to circumvent this easily, or it just plain didn't work?

Thanks,

Luca

[Brandon_Wertz]

What are you trying to protect from in your K-12 network?

[LucaMarchiori]

In short, we are trying to avoid kids getting inappropriate results from google search.  This was sparked from one complaint at an elementary site, even though we are blocking adult categories with URL filtering.

In my mind this is about enforcing a browser setting, and as such should be handled on the device side (GPO, MDM, etc).  Nevertheless, I've being asked if anything could be accomplished with our PA firewall.

[Brandon_Wertz]

So..."Content Filtering" should be able to get you what you need (URL Profiles.)  However I thought I heard not doing SSL decryption you can bypass that filtering control by using Google's translation services.  

Let me do some searching real quick.

[Brandon_Wertz]

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Block-Alert-Category-of-a-Website-th...

[jvalentine]

Yes, if you're unable to use SSL decryption in order to enforce safe-search and if you don't have an endpoint-specific solution (GPO/MDM), then I would recommend leveraging google's DNS-based safe-search configuration as you posted in your original question.  

[LucaMarchiori]

We are already doing URL filtering for the usual inappropriate categories.  Somehow this kid managed to get explicit pics on the browser, supposedly by using search function.  Unfortunately this was reported as an anecdote, without any technical details.  I took at face value.

If I click on the link you provided I get:

An invalid set of parameters has been specified in the url.

Return to my original page

[LucaMarchiori]

Hi,

So, the DNS Proxy solution should be working OK?  I'm going to setup a test site, and see what I come up with.

[Brandon_Wertz]

sorry it had an extra space https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Block-Alert-Category-of-a-Website-th...

[jvalentine]

It's a good first step.  The DNS-based solution should enforce "safe search" - meaning Google will be providing filtered search results.  

This would address the case where your student searched for inappropriate content via the google search engine and google was the one displaying the inappropriate content.  

Students are resourceful, though - so there will be additional steps that you need to take, such as blocking access to proxy websites, blocking VPN applications, etc.  

[LucaMarchiori]

Thanks for fixing it.  Yes, we already have security profiles in place.  Mind you this is the first report of this nature that I've seen in a couple of years, so I'd say this is not a common occurrence. 

[gwesson]

Blocking outbound DNS from students would also need to be blocked, or else they'll just point their DNS queries to an external resolver. 

Without SSL decryption though, you'll be chasing this a lot. A student forced to use google safe search may decide Bing is just fine for them (or DuckDuckGo, or Yandex, or... etc.). Longer term I'd recommend looking into the decryption end. You'll get a lot better enforcement if you can trigger on every request rather than just the requests in clear text.

[LucaMarchiori]

Yes, they are resourceful, you have to admire that.  We're not seeing much in terms of VPNs at elementary sites.  It's a different story at secondary ones. 🙂  Might just start another thread on how you guys manage to stop all VPNs, when PA only detects unknown-tcp, unknown-udp, or ipsec-esp-udp traffic...