Technical Tip: How to configure Safe Search on FortiGate

[hazim]

Description	This article describes how to enable Safe Search on FortiGate.
Scope	FortiGate version 6.4, 7.0, and 7.2 above.
Solution	Note that this feature is only available and works with these two requirements: Use proxy mode inspection for web filtering profile and policy. Enable QUIC protocol block in Application Control. Go to Security Profiles -> Web Filter -> Feature set Proxy-based. Enforce 'Safe Search' on Google, Yahoo!, Bing, Yandex.   From the CLI: config webfilter profile     edit "safe-search"         config web             set safe-search url header         end     next end In the policy, it is necessary to turn on both the Web filter and Application control profile with the inspection mode set to proxy-based. From the CLI: config firewall policy     edit 0         set name "v96"         set srcintf "port4"         set dstintf "port1"         set action accept         set srcaddr "all"         set dstaddr "all"         set schedule "always"         set service "ALL"         set utm-status enable         set inspection-mode proxy         set ssl-ssh-profile "deep-inspection"         set webfilter-profile "safe-search"         set application-list "safe-search"         set logtraffic all         set nat enable     next end Note: Deep inspection is required for this to work. Make sure search engines are not exempted from SSL Inspection. Examples of search engine URLs:  www.google.com bing.com search.yahoo.com Refer to the 'To import the built-in certificate (Fortinet_CA_SSL) to the browser:' section in Technical Tip: How to enable deep inspection and import a certificate in the browser for instructions on importing the deep inspection certificate into the browser.