how to block pornographic images displayed by Google Image

allwynmasc wrote:

wouldn't just certificate inspection achieve this?

No, Certificate Inspection only looks up the SNI [usually the domain you are visiting.] information of the website when the website is first visited. If the domain is allowed, it goes through and all future sessions will pass without any furhter ssl inspection.

Deep packet inspection [DPI], on the other hand makes the fortigate to act as the man in the middle. Allowing fortigate to inspect all contents inside the secure packet.

With Certificate Inspection:

You visit google.com, once the domain is allowed, the fortigate doesn't know what search queries are you typing as it is communicated over https since we are NOT doing DPI

and it cannot modify the URL as it cannot see the part past the hostname.

With Deep Inspection:

Fortigate acts as a man in the middle and can see the contents being transferred but more importantly it can see the URL, allowing the fortigate to intercept and add the safe=active parameter to force safe search everytime.

This also allows a network admin to monitor what search queries are being entered.

allwynmasc wrote:
 

Deep inspection slows down things i guess, also depends on the FGT model and no. of users right?