Description
This article describes how to block or disable QUIC (Quick UDP Internet Connections).
Scope
FortiGate.
Solution
QUIC (Quick UDP Internet Connections) is an experimental transport layer network protocol developed by Google. Starting from 2015, some sites (For example Google and YouTube) offer connection via QUIC protocol. Google Chrome supports it in the latest version by default.
QUIC uses UDP port 80 and port 443 and often permits clients to bypass transparent proxies, in which UTM features such as web filtering may not work properly on Google Chrome, but work perfectly on other browsers such as Internet Explorer or Mozilla Firefox.
QUIC uses UDP port 80 and port 443 and often permits clients to bypass transparent proxies, in which UTM features such as web filtering may not work properly on Google Chrome, but work perfectly on other browsers such as Internet Explorer or Mozilla Firefox.
There are three ways to block/disable QUIC:
Method 1: Disable the Experimental QUIC protocol on Google Chrome browser.
To do this, open Google Chrome, entering 'chrome://flags' in the address bar, then search for 'Experimental QUIC protocol' and disable it.
Method 2: Block QUIC using Application Control.
Go to the Application Control profile, look for the Application signature name 'QUIC', and select the action 'Block'. Apply this Application Control profile into the firewall policy.
Method 1: Disable the Experimental QUIC protocol on Google Chrome browser.
To do this, open Google Chrome, entering 'chrome://flags' in the address bar, then search for 'Experimental QUIC protocol' and disable it.
Method 2: Block QUIC using Application Control.
Go to the Application Control profile, look for the Application signature name 'QUIC', and select the action 'Block'. Apply this Application Control profile into the firewall policy.
Note:
Starting from v7.2.0, the option to allow or block QUIC has been removed. Refer to this link for more information. To allow/block QUIC, use the Application and Filter Overrides section.
Method 3: Block QUIC using a firewall policy.
Create a custom firewall service for UDP ports 80 and 443. Configure a firewall policy with the custom service created and set the action to Deny.
Related article:
