Chrome Safe search broken???

[David_Ralph]

Is anyone else having issues with Chrome Safe Search breaking suddenly.  In our area, we have three different sites using different flavors of Fortinets.  All three have lost the Chrome Safe Search suddenly.  Typing in XXX gives pronographic results for all students.  We also have two different ISP's between the three school sites.  The only thing in common is fortinet and google safe search through web filtering.  Yahoo and other search engines are still filtered. 

[Dave_Hall]

Hi David.

If by Chrome Safe search you mean Google Safe search, I think you need to have the Enable Safe Search option enabled in the security/web filter profile and Full SSL (Deep) inspection enabled and have this applied to web traffic.  If you are unable to use deep inspection, you can try the DNS option outlined in the following document.

See https://cookbook.fortinet.com/blocking-adultmature-content-google-safesearch/

[David_Ralph]

Thank you Dave.  At three different sites it was working fine.  Safe search is enabled.  Enabled in security and web profile with full SSL scanning.  All has been beautiful until two days ago.  Three sites, three different Fortigates.  Two different ISP's.  All are filtering yahoo, bing , etc with no issues.  It is only google.  No changes were made at any site so that is why we are totally confused.  I am still looking , but everything is correct from what the cookbook says.  We are opening up a support ticket right now.  If we search for xxx on google, we get solid porn,  Any other search engine, we get totally different information.  It is only google which is just throwing us for a loop.

Dave Hall wrote:

Hi David.

If by Chrome Safe search you mean Google Safe search, I think you need to have the Enable Safe Search option enabled in the security/web filter profile and Full SSL (Deep) inspection enabled and have this applied to web traffic.  If you are unable to use deep inspection, you can try the DNS option outlined in the following document.

See https://cookbook.fortinet.com/blocking-adultmature-content-google-safesearch/

[Dave_Hall]

When on the google search site, does it show SafeSearch is turned on? Does the problem also happen in different web browsers?  Have you drilled down in the traffic logs via FortiView to see how the client is connecting to google?

David Ralph wrote:

[...]If we search for xxx on google, we get solid porn,  Any other search engine, we get totally different information.  It is only google which is just throwing us for a loop.

[David_Ralph]

Dave, 

Tech support at fortinet has been very responsive, but they are just as confused.  Bing and Yahoo work perfectly in Chrome, firefox, edge, and ie.  Google does not work in anything at all.  The last thing they have done is to take logs based on different search engines and they are sending them to higher level of tech support.  The weird part is nothing changed on any of three fortigate boxes and they all happened at the same time.

Dave Hall wrote:

When on the google search site, does it show SafeSearch is turned on? Does the problem also happen in different web browsers?  Have you drilled down in the traffic logs via FortiView to see how the client is connecting to google?

David Ralph wrote:

[...]If we search for xxx on google, we get solid porn,  Any other search engine, we get totally different information.  It is only google which is just throwing us for a loop.

[Zdzich]

David, as it passed over three months, please share an info:

What was the resolution provided to you by Fortinet Tech Support?

[David_Ralph]

Fortinet never came up with a viable solution.  We are a school system with PC's, Chromebooks, Ipads, ipods, and BYOD.  The only option they gave was to change something on every PC.  I do not even remember what it was, but it was taking me a bout one hour per machine to get it working correctly.  It still never answered the question on the ipads or chromebooks and the BYOD devices were completely wide open.  So fortinet failed miserably.  What I ended up doing was going into my DNS server and pointing every dns request to google to go to safesearch.google.com (or whatever the safesearch site is)  It definitely was not the desired fix for something that broke at three different sites at the same time and one of the three was 100% independent of the other two (different ISP, network, building, version of MS Server, fortigate appliance --- everything diffeerent and not connected in any fashion --- and the fortigate was set up by a totally different person with no assistance from me).  I have no idea if it was ever fixed.  I finally told Fortinet that I am a school district with no test environment and cannot wait for them to fix it.  By that point, we had shut down google completely for one week.  That meant we had over 500 chromebooks collecting dust and kids had no access to their google drive or google classroom.

I would love to know if others have run into the same situation.