Technical Tip: QUIC traffic denied when SSL/SSH profile is configured with ‘block’ option

When the QUIC option in the SSL/SSH inspection profile is set to 'block', FortiGate will deny QUIC traffic. This behavior is expected and is reflected in traffic logs similar to the example below:

action="deny" service="udp/443" msg="Traffic denied because of quic inspection setting."

To change this behavior, verify and modify the QUIC setting in the SSL/SSH profile that is applied to the relevant policy. Use the following commands to inspect or bypass QUIC traffic:

config firewall ssl-ssh-profile
    edit <profile_name>
        config https
            set quic inspect
        end
end

Note: Replace '<profile_name>' with the name of the SSL/SSH inspection profile in use.

Available options for the QUIC setting:

• 'inspect': Inspect QUIC (HTTP/3) traffic.
• 'bypass': Allow QUIC traffic without inspection.
• 'block': Deny QUIC traffic entirely.

If inspection of HTTP/3 traffic over QUIC is required, set the option to ‘inspect’. There is no setting labeled ‘allow’. Instead, use ‘bypass’ to permit the traffic without inspection.