cancel
Showing results for 
Search instead for 
Did you mean: 
lucasfh
Level 7

Safe Search Enforcer with MWG as ICAP Server

Jump to solution

Hi all.

I'm using MWG 7.2 as ICAP Server and SQUID as ICAP Client.

I enabled rule Safe Search Enforcer, but I can change Safe Search filter to "no filter" (Google Search) in my lab.

Explicit Mode Proxy it works.

Anybody can help me?

Thanks!

0 Kudos
1 Solution

Accepted Solutions
fschulte
Level 10

Re: Safe Search Enforcer with MWG as ICAP Server

Jump to solution

MWGs ICAP server component did not detect that the SSE changed the URL and sent back the original one. So SafeSearch was effectively not enforced. This has been fixed in 7.3 and 7.2.0.2.

The Bugzilla discussion tells the following workaround: "As a workaround the customer can add an arbitrary header in the request cycle."

Workaround.png

Message was edited by: fschulte on 7/10/12 3:38:08 AM CDT
0 Kudos
4 Replies
McAfee Employee

Re: Safe Search Enforcer with MWG as ICAP Server

Jump to solution

Hi Lucas,

I would get connection traces from a working scenario (direct proxy), and from a non-working scenario (as ICAP server). Then submit this to support, connection traces can be gathered under Configuration > Troubleshooting, then you will need to specify the client IP, and check both of the boxes for connection tracing.

Turn connection tracing off immediatley after you reproduced the issue. They can be collected from the CLI or under Troubleshooting > Connection tracing.

Connection tracing will allow us to see what is different. SafeSearch enforcer should work if MWG is an ICAP server.

Hope this helps,

Jon

0 Kudos
eelsasser
Level 15

Re: Safe Search Enforcer with MWG as ICAP Server

Jump to solution

Keep in mind that SafeSearch is used in the REQMOD cycle only.

It modifies the request before it goes out to google.

If you are using Squid in RESPMOD, it will have no effect.

0 Kudos
lucasfh
Level 7

Re: Safe Search Enforcer with MWG as ICAP Server

Jump to solution

Hi all

I opened a case to support. I sent TCP Dump and connection traces to support.

We are using MWG as ICAP Server with REQMOD and RESPMOD.

I will post results here.

Thanks!

Lucas

0 Kudos
fschulte
Level 10

Re: Safe Search Enforcer with MWG as ICAP Server

Jump to solution

MWGs ICAP server component did not detect that the SSE changed the URL and sent back the original one. So SafeSearch was effectively not enforced. This has been fixed in 7.3 and 7.2.0.2.

The Bugzilla discussion tells the following workaround: "As a workaround the customer can add an arbitrary header in the request cycle."

Workaround.png

Message was edited by: fschulte on 7/10/12 3:38:08 AM CDT
0 Kudos