Technical Tip: IPS rule to block setting safe search rule on Bing.com
Description
The following IPS custom signature will block the return packet from the Bing.com (Microsoft search engine) server that switches the option in the users' cookie, and should effectively block the users from disabling the safe search option to prevent adult content display.
Solution
This signature will block safe search on Bing.com
F-SBID( --name "Bing.Search.Safe"; --protocol tcp; --service HTTP; --flow from_server; --pattern "ADLT=OFF"; --context header; )
Procedure to add a custom signature:
- Go to Intrusion Protection> Signature> Custom.
- Select Create New.
- Enter the name for the signature, for example, "Windows Streaming Audio".
- For the Signature, enter the following:
F-SBID( --name "Bing.Search.Safe"; --protocol tcp; --service HTTP; --flow from_server; --pattern "ADLT=OFF"; --context header; ) - Set the Action to Drop Session.
- Select OK.
Note: In FortiOS 3.0 MR6, you create the custom signature, then add it to an IPS sensor where you define the action.