Google Enforced SafeSearch is not working on Google Chrome with Sophos XG?

Hi Dave,

Verify the configuration for safe search from the KBA here.

If the issue is observed with Google Chrome browsers then I believe it is caused due to the QUIC protocol implemented by google when Chrome is used to access google services.

Configure a drop FW-rule on TOP for UDP port 443. Restart web proxy from system> diagonostics> services> web proxy and clear the web cache on the browser. 

Hope this helps.

sachingurung said:

Hi Dave,

Verify the configuration for safe search from the KBA here.

If the issue is observed with Google Chrome browsers then I believe it is caused due to the QUIC protocol implemented by google when Chrome is used to access google services.

Configure a drop FW-rule on TOP for UDP port 443. Restart web proxy from system> diagonostics> services> web proxy and clear the web cache on the browser. 

Hope this helps.

 

Thank you! This solution has worked perfectly for Sophos XG.

This isnt working for me on the XG, is my firewall rule at the top correct?

Hi Craig,

3 things:

1. remove UDP 80 port from the service.

2. Configure the service host definition as UDP -> * -> 443 | UDP -> 443 -> *

3. Move the firewall rule on TOP.

Thanks

Like this?

HI Craig,

Yes , that settings  should work out for you .

 Thanks 

Aditya Patel

............. thats the problem, its still not working!

HI Craif , 

Are you getting the same issue while using Incognito mode in Chrome. 

Thanks 

Aditya Patel

Yes i get the same issue in Incognito mode also 

Hi Craig, 

That is unusual, as incognito browsing will not make use of QUIC protocol i.e., UDP 443 port. If you still face the issue with safe search on Google chrome, I doubt you have allowed something through custom categories in web filter. Check #1 in my guide and see in the packet capture option, which firewall rule forwards the internet traffic on google chrome while attempting something that should be blocked through safe search.

Post the screenshot of the safe search configuration, FW rule which forwards the traffic and the packet capture screen that states which FW rule forwards the traffic.

Thanks

Please find attached screenshots as requested:

Hi Craig, 

In the BlockQUIC FW-rule, if you see on the bottom left corner then there is no traffic logged in it. It states 0byte because you have enabled "Match rule based on user identity" option. Disable this option and victory. 

Thanks

Hi Craig, 

In the BlockQUIC FW-rule, if you see on the bottom left corner then there is no traffic logged in it. It states 0byte because you have enabled "Match rule based on user identity" option. Disable this option and victory. 

Thanks

Hi Sach,

Perfect that was it,  I just unchecked: "Match known users" :)

Thanks,

Craig