Safe Serach

Question

I have Sophos XG firewall(16.05) and Sophos Endpoint Cloud Clients. I configured the both sides for the blocking adult contents. Safe search is running when goes to adult content websites and etc. But in search engines images The adult content images still here. How to block the adult content images in serch engines ?(google,yandex etc...)

This thread was automatically locked due to age.

Aditya Patel · Accepted Answer

HI Yasin , 
 If you have enabled Safe Search as Suggested by LUK , you may need to enable Malware Scanning Http and HTTPS (Especially) in order to work . Also Create a Rule on the Top position and Drop Port UDP:443 so the Google in your network would not operate in QUIC protocol and would switch to Standardized TCP:443 connection.

lferrara · Answer

Yasin, 
 can you share the words you are able to dispaly on google for example? 
 Did you enable safe search and additional image filters under Web > Advanced menu ? 
 Thanks

lferrara · Answer

Yasin, 
 Yes enable both. In my test environment it works with no issue. Bad words like porn are blocked. 
 Make sure to allow only https/http on the firewall rule as suggested by Aditya. 
 Regards

lferrara · Answer

Yasin, 
 If you have created an allow rule where you allow only http/https services, the drop rule is not needed. 
 Google chrome uses udp 443 and then fails back to tcp 443. So if you allow only https and your last rule is a drop rule (any, any, any), your are ok. 
 Regards

Aditya Patel · Answer

Hi Yasin, 
 You may need to import the certificate onto our IOS and Android. If you are using authentication you may log in to your User portal using your Mobile Web Browser and click to download the CA certificate. This will allow you to import the certificate directly. Or simply mail to your employees the CA certificate they would open the attachment and get it installed. 
 The certificate format is .PEM you may change to .crt by simply changing the extension and mail to your clients. Otherwise, you may need to create a seperate rule for your IP/MAC host associated to your mobile devices and remove HTTPS decryption. This was you do not need to install certificate . Downside is that Safe search Would not work .