Safe search

In this example, safe search is configured for Google in the inline CASB profile.

To configure an inline CASB profile with safe search in the GUI:

1. Configure the inline CASB profile:

   1. Go to Security Profiles > Inline-CASB and click Create new.

   2. Enter a Name, such as google_test.

   3. In the SaaS Applications table, click Create new. The Create SaaS Application Rules pane opens.

   4. Search google and select the google application, then click Next.

      

   5. Enable Safe search.

      

   6. Click OK to save the rule.

   7. Click OK to save the CASB Profile.

2. Configure the firewall policy:

   1. Go to Policy & Objects > Firewall Policy. Edit an existing policy, or create a new one.

   2. Set the Inspection Mode to Proxy-based.

   3. In the Security Profiles section, enable Inline-CASB and select the google_test profile.

   4. Set the SSL Inspection profile to one that uses deep inspection.

   5. Configure the other settings as needed.

   6. Click OK.

To configure an inline CASB profile with safe search in the CLI:

1. Configure the inline CASB profile:

   config casb profile
       edit "google_test"
           config saas-application
               edit "google"
                   set safe-search enable
                   set safe-search-control "strict"
               next
           end
       next
   end

2. Configure the firewall policy:

   config firewall policy
       edit 7
           set name "casb_test_google"
           set srcintf "port1"
           set dstintf "port3"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "ssl"
           set casb-profile "google_test"
           set nat enable
       next
   end

To test the configuration:

1. Open a browser and attempt to search in Google for content that is considered mature or explicit.

2. The sensitive content is filtered out in the search results.

Sample log:

1: date=2026-04-08 time=09:01:46 eventtime=1775664106064977832 tz="-0700" logid="2500010002" type="utm" subtype="casb" eventtype="casb" level="information" vd="root" policyid=7 poluuid="23fa6e58-fd3a-51f0-fcba-755a1c0b5610" sessionid=482175 srcip=13.13.13.13 dstip=142.251.154.119 srcport=60126 dstport=443 srcintf="port1" srcintfrole="undefined" srcuuid="1c9e034e-72bc-51f0-4866-42e7eacff7bb" dstintf="port3" dstintfrole="undefined" dstuuid="70b43f6e-1e2b-51f1-c748-c3c24466ed2e" proto=6 url="https://www.google.com/complete/search?q=explicit.com&safe=active" action="monitor" profile="google_test" saasapp="google" useractivity="google-safe-search" operation="strict" subaction="monitor" tenantmatch="missed" activitycategory="safe-search-control" msg="CASB access was monitored because it contained activity."