Technical Note: Restrict YouTube content on network or managed devices
Description
Solution
YouTube for Schools was a way to access educational videos from inside a school network. This YouTube feature gave schools the ability to access a broad set of educational videos on YouTube EDU and to select the specific videos that are accessible from within the school network.
Google decided to stop supporting YouTube for Schools (YTfS) as of July 1, 2016. Consequently, the current YouTube safe search does not work anymore.YouTube for Schools
Google decided for YouTube education to be turned down on July 1, 2016
Google provides an article entitled "Restrict YouTube content on your network or managed devices" at https://support.google.com/youtube/answer/6214622
At this time, Google offers two options to restrict inappropriate content: DNS and HTTP header
Google decided to stop supporting YouTube for Schools (YTfS) as of July 1, 2016. Consequently, the current YouTube safe search does not work anymore.YouTube for Schools
Google decided for YouTube education to be turned down on July 1, 2016
Google provides an article entitled "Restrict YouTube content on your network or managed devices" at https://support.google.com/youtube/answer/6214622
At this time, Google offers two options to restrict inappropriate content: DNS and HTTP header
Solution
Restricting YouTube access in FortiOS 5.4 and 5.4.1
This is a FortiGate configuration example for adding the HTTP header to YouTube requests to implement safe-search for YouTube (FortiOS v5.4).
1. Configure web proxy profile to add header
2. Add a profile to the url-filter profile
3. Add urlfilter profile to webfilter
4. Apply the above profile to the outgoing firewall policies
This is a FortiGate configuration example for adding the HTTP header to YouTube requests to implement safe-search for YouTube (FortiOS v5.4).
1. Configure web proxy profile to add header
config web-proxy profile
edit Restrict
set header-via-request add
set header-via-response add
config headers
edit 1
set name "YouTube-Restrict" ----{The name can be any value
set content "Strict"
next
end
next
end
2. Add a profile to the url-filter profile
config webfilter urlfilter
edit 1
set name "Youtube" ----{The name can be any value
config entries
edit 1
set url "www.youtube.com"
set action allow
set web-proxy-profile "Restrict"
next
edit 2
set url "m.youtube.com"
set action allow
set web-proxy-profile "Restrict"
next
edit 3
set url "youtubei.googleapis.com"
set action allow
set web-proxy-profile "Restrict"
next
edit 4
set url "youtube.googleapis.com"
set action allow
set web-proxy-profile "Restrict"
next
edit 5
set url "www.youtube-nocookie.com"
set action allow
set web-proxy-profile "Restrict"
next
end
next
end
3. Add urlfilter profile to webfilter
config webfilter profile
edit "Youtube-Restrict" ----{The name can be any value
config web
set urlfilter-table 1
end
next
end
4. Apply the above profile to the outgoing firewall policies
- Enable the web-filter and select the created web-filter
- Enable SSL Deep Inspection
Restricting YouTube access in FortiOS 5.4.2
In FortiOS v5.4.2, YouTube access can be restricted through the GUI.
- Go to Security Profiles > Web Filter.
- Edit the default web filter or create a new one.
- Expand Search Engines and enable Restrict YouTube Access.
- Select Strict or Moderate level of restriction.
Google discusses the difference between strict and moderate levels of access in the article entitled on its support site.
