This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Search Engine Enforcement - XG SFOS V17

Hello all,

Following the introduction of SFOS version 17, the "old" way of having to enable HTTPS scanning and blocking QUIC to enforce Safe Search / Search Engine Enforcement on firewall rules has been replaced with the ability to globally enable or disable the Search Engine Enforcement feature (note I say replaced, as just prior to us installing V17 on our XG unit the "old" way of enabling the feature started to break YouTube on some browsers for some reason, which forced us to update to 17 to get the feature working).

We are now having an issue with what is being blocked as "restricted" on YouTube - whereby it seems that anything not marked as appropriate for All Ages or similar is blocked / restricted. I know this is more a YouTube issue, but I have also noted that some of my users (myself included) that have the "Allow All" web filter applied do not have any of these restrictions, which is odd as as far as I know this is an either "On for All" of "Off for All" type setting - so it is odd that users with the "Allow All" filter applied to their rule dont have this issue...

Now, from what I have seen and what others that use XG have said when I contacted them, there is no way to either apply the Search Engine Enforcement feature to specific groups / users / firewall rules, nor is there a way I can see to change what is "restricted" in restricted mode on YouTube.

Does anyone know of something I am missing or a way to control what YouTube Restricted Mode / Safe Search are restricting?

Thanks in advance :)

This thread was automatically locked due to age.

0 JDR over 7 years ago

I am seeing the same thing. Many video's on YouTube are being restricted that have no adult content in them. Is there a way to allow specific video's?
Cancel
Vote Up 0 Vote Down

Cancel
0 Darrian Churchill over 7 years ago

Small update - We tested by moving a user to a group whose firewall rule was set to "Allow All" web filter, and the issue with blocked YouTube videos appears to have persisted.

Anyone with some insight into how we could tune this feature? I'm drawing a blank in my fiddling.
Cancel
Vote Up 0 Vote Down

Cancel
0 lukg over 7 years ago in reply to Darrian Churchill

Apparently Restricting YouTube via HTTP Header for some user groups was on roadmap for V17 of XG.

ideas.sophos.com/.../13618821-restrict-youtube-via-http-header-for-some-user-gro

In V16 I was able to control YouTube restricted mode by using different DNS settings on the clients and HTTPS decryption exceptions on SOPHOS XG firewall. In this way some of my PCs had unrestricted Youtube while most of our PCs had restricted YouTube via Sophos enforce safe search. Sophos XG firewall had my custom DNS entries to enforce safe search globally.
Cancel
Vote Up 0 Vote Down

Cancel
0 Darrian Churchill over 7 years ago in reply to lukg

Thanks for that link. It does look like that was the plan... It would make so much more sense to be able to enable Search Engine Enforcement on a per web policy basis instead of globally. I still think I am missing something since my applied policy with "Allow All" doesn't break YouTube. Real head-scratcher this.
Cancel
Vote Up 0 Vote Down

Cancel
0 TorvaFirmus over 7 years ago

Hi,

Please separate YouTube restricted mode from SafeSearch. With SafeSurfing enabled, I cannot view some of the engineering (circuit board and electronics) and christian broadcasts on youtube. I much preferred when you didn't handle restricted mode.

I don't like having SafeSearch disabled.

Regards,

William
Cancel
Vote Up 0 Vote Down

Cancel
0 lukg over 7 years ago in reply to TorvaFirmus

Someone had this idea already, Please vote here:

ideas.sophos.com/.../32531740-safe-search
Cancel
Vote Up 0 Vote Down

Cancel
0 RainMan730 over 7 years ago in reply to TorvaFirmus

Wiliam, this would be idea to vote for:
Cancel
Vote Up 0 Vote Down

Cancel
0 TorvaFirmus over 7 years ago in reply to RainMan730

You are correct. Thanks for mentioning it. I added the following comment.

I agree. But I would go one step further and say that the "Enforce Safe Mode" and "Restricted Mode" should be available as an override in the firewall rules. This allows some users/connections to override the default Rule 0 (One rule to kill them all) method of implementation.

.
Cancel
Vote Up 0 Vote Down

Cancel