Hello, we have a large amount of Google Chrome users. I am starting to hear the odd complaint about slow connections to some sites on the internet. As a test I disabled the QUIC protocol (UDP 443) in the web browsers at one site, and the complaints stopped. In addition we also block QUIC on our firewall.
So it would seem that browsers were failing to communicate via QUIC and then either stalling or taking too long to revert to TCP 443.
Are any other of you network engineers seeing the same sort of problem ? - I was considering disabling QUIC in all Chrome browsers company-wide.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
monitor the chome:net-internals for QUIC but no I never heard of this. Also did you monitor the firewall policy and service object?
Do you have any TLS inspection going ? ( iirc fortiOS still can't inspect DTLS )
http://socpuppet.blogspot.com/2016/10/how-to-force-quic-connections-with.html
BTW: I do not know of one firewall vendor that can decrpyt quic
PCNSE
NSE
StrongSwan
Hi,
What you may have encountered is excesive traffic on your network.
As far as I know FortiGates cannot perform SSL inspection when traffic uses Quic.
By blocking Quic, Google Chrome does fail over to HTTP/HTTPS which can be inspected and blocked.
Went through a couple weeks of trying different debug/troubleshooting steps to figure this out with support. Turns out QUIC was triggering UDP Flood DoS policies. When we changed the disabled the UDP Flood DoS setting or adjusted the rate limit to much higher levels (2000 default -> 50000) then we had normal throughput again with QUIC enabled.
Test it with the UDP Flood DoS policy disabled and if it works then turn it back on and adjust the final rate limit accordingly.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1640 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.