Google HTTPS Safe Search

[dasilva13]

Has anyone configured HTTPS google safe search to work now that google is going to all HTTPS redirects by default? We are using FortiGate as DNS server.

[Christopher_McMullan]

My method may be the only ugly solution, but bear in mind: when I started working on the case I referenced we already tried and failed with DNS servers. The servers may very well work for you.

[hklb]

I have tried to program that exact solution on the DNS on the FortiGate but it does not work. Just wondering if anyone has actually done it.

Hello You can' t do a CNAME for domain name of the zone. You need to create a A record for " www.google.com -> 216.239.32.20" See attached file

[Dave_Hall]

Not really a solution, but just for kicks, played around with the dnstranslation. I wouldn' t do this on a production fgt.

 config firewall dnstranslation
     edit 1
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.97
     next
     edit 2
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.96
     next
     edit 3
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.110
     next
     edit 4
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.100
     next
     edit 5
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.104
     next
     edit 6
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.99
     next
     edit 7
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.101
     next
     edit 8
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.113
     next
     edit 9
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.116
     next
     edit 10
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.112
     next
     edit 11
         set dst 216.239.32.20
         set netmask 255.255.255.255
         set src 173.194.43.115
     next
 end

As I stated, I did this for kicks -- works " great" on a 200D (that' s on my work bench), providing the source IP is in the table. Can' t see anyone wanting to do this with Google' s IP pool. @dasilva13 Re: installing host file on 1500+ laptops Some of the companies I' ve worked at actually did this via policies and/or login scripts.

I have tried to program that exact solution on the DNS on the FortiGate but it does not work. Just wondering if anyone has actually done it.

When testing out the proposed DNS solution(s) offered here, make sure you flush the DNS resolver cache on your test machine(s). You may also want to set up fw polices on the fgt to prevent client machines from directly accessing outside DNS servers.

[Obes]

Some point in early December Google are turning off the nossl option.

http://googleonlinesecurity.blogspot.com.au/2014/10/an-update-to-safesearch-options-for.html

The new option will force the use of SSL.

https://support.google.com/websearch/answer/186669