Enforce Google SafeSearch on Cloud SWG (formerly known as WSS) UPE (Universal Policy Enforcement) Tenant.

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Cloud SWG allows customers to fully enforce Google's Safe Search mode regardless of the client browser's configuration. When Cloud SWG policies are managed from the portal, Portal Admin's can configure this from the Portal > Policy > Content Filtering > Search Restriction. The feature is explained here.

This option is removed from the portal when the policy is managed from the Management Center. The Safe Search policy has to be configured on the MC and then push it to WSS in case of UPE.

Environment

Cloud SWG (formerly known as WSS) UPE (Universal Policy Enforcement) Tenant

Cause

The Safe Search policy has to be configured on the MC and then push it to WSS in case of UPE.

Resolution

Things to note before installing the policy.

1. This policy would force SSL Intercept the category "Search Engines/Portals" and Google domains\IPs. Make sure the WSS root certificate is present on the endpoints if it is not installed already.
2. This policy will also Deny access to Pornography and Proxy Avoidance categories.
3. This policy will not work on on-premise ProxySG.
4. If anything needs to be bypassed from the safe search policy, add those domains\IP into the "BC_SafeSearch_Exempt" definition

Installing the CPL policy to Enforce Google SafeSearch

1. Using the MC Management Console, open the VPM of the UPE Policy.
2. In the VPM create a new CPL layer, name it "SafeSearch".
3. Open the safe search CPL file (WSS_Safe_Search_Control_1646276576278.txt) attached to this article, copy the text to the new CPL layer.
4. Install Policy, verify that the policy is installed without any errors.
5. Access Google images and make sure it is not displaying links to mature/inappropriate sites and contents.