www.google.com bypassing web filtering

[scarroll]

Hello.  

We are trying to implement web filtering for a particular server where we only want the server to be able to access a single URL.  We have Web Filtering working, except for the fact that in Chrome when you go to www.google.com it goes to the site.  This is bypassing both the wildcard blocking rule and the specific blocking rule for www.google.com.  Not only does it go to the page, but it also allows you to search.  clicking on search results fails, but you can still see results as well as the image tab.  Oddly, going to images.google.com or drive.google.com or www.google.fr all are blocked as expected.  

Is there something I am missing here?  

[Toshi_Esumi]

Try this to block QUIC if the behavior persists:

http://kb.fortinet.com/kb....do?externalId=FD36529

[scarroll]

Tried disabling QUIC and blocking it on the Fortigate and it still lets it through... and it's ONLY www.google.com... and ONLY in Chrome... no other site works... 

[rwpatterson]

Policies are hit from the top of the list down. Make sure you put that block policy above the one that allows QUIC.

[Toshi_Esumi]

Run flow debug "diag debug flow" to see the chrome's google access is actually hitting the policy, which is supposed to block but be allowing. Then open a ticket with TAC.