How do I block Image search?

[Pooch87]

Hi 

I am fairly new to Palo's and I am trying to figure out how I can block search engine image searches. I know there are currently no real app-ids that cover this and just wondering if anyone has a way to block all image search results on the big search engines such as google.

[OtakarKlier]

Hello,

So the short answer is no. But are you trying to just block our inicilt images or anything such as cars for example?

Regards,

[BPry]

@Pooch87,

So longer answer would be kinda. 

Sites like Bing is easy enough to do because the URL is always going to be www.bing.com/images/ so that one is pretty simple. Google gets really hard because it doesn't really have any seperators, just one long string. So with a google search it will always be 'www.google.com/search?q="whateveryousearchedfor"&source=Inms&tbm=isch', essentially the only thing you want to match on this is "tbm=isch". Notice that since there are no common seperators this really can't be done effectively from the firewall. 

Most of the other search engines that are popular are also going to be like google, where you don't really have any seperators to go off of. 

As @OtakarKlier mentioned this isn't really a visable solution if you are trying to do it with the firewall.

[Pooch87 · Accepted solution]

Hi All,

Figured it out

If you ever need to configure blocking for Image Search on Palo Alto or any particular search for Google then the Palo Alto can achieve this through URL Filtering

The Steps are as follows

Go to Objects then Customer URL Catergory

Create a New Category

Enter the following String

*/*&tbm=<Switch>&*

Where <Switch> is replace with the actual switch.

Image Search = tbm=isch

personal - tbm=pers

shopping - tbm=shop

books - tbm=bks

Video - tbm=vid

If you look at a search string in the url search, you will find that these are key switches for search results.

When completed, go to URL filtering profile, look for the newly created category and choose deny.

[BPry]

@Pooch87,

Just a word of caution with the strings that you are using, this is a lot more resource intensive on the firewall and can cause some performance issues. If your firewall is able to handle it that's great, but it's something to keep an eye out going forward.