Google-Web blocked

[Tutek]

Hi,

some web pages are not working properly and I see in logs that Google-Web service is blocked by fortigate with strange 443 port and protocol 17 UDP. I don't see any App ID that I could allow in App Control profile for that particular event, have a look:

My firewall policy rule that allow internet access have as service set "Web Access" service group so TCP 80,443 and DNS 53 there is not UDP port 443 here.

So how could I allow this service Google-Web, just should I add UDP 443 port in my firewall?

[Vichu_94]

Hi Tutek,

Could you let know if the firewall policy is configured in proxy or flow based?

May I also know if it is configured with deep inspection?

If it is configured in deep inspection, you could try to exempt the google traffic on the network by follow the steps in the link below:

http://docs.fortinet.com/document/fortigate/5.6.0/cookbook/655529/creating-an-ssl-ssh-profile-that-e...

[Tutek]

Hi, sorry for late response. We use flow base inspection with deep ssl scan.

[nweckel]

Hello,

UDP port 443 is Google's protocol QUIC

https://community.fortinet.com/t5/FortiGate/Technical-Note-Disabling-Blocking-QUIC-Protocol-to-force...