Description
This article describes how to disable or block QUIC protocol to force Google Chrome web browsers to use TLS/SSL and guarantee a proper SSL inspection by FortiGate.
Scope
UDP/443 must be blocked in the FortiGate from the LAN network to the Internet to force the Google Chrome web browsers to use TLS/SSL.
Solution
QUIC is a transport layer protocol that has been developed by Google and even when it started to be implemented in 2013, is still in an experimental stage. This protocol was designed to replace TLS/SSL providing multiplexed connections between two endpoints over port UDP/ 443.
The main goal of this protocol is to optimize connection-oriented web applications currently using TCP and reduce transport latency avoiding congestion. However, due to the protocol being still in the experimental stage, it is not supported by Fortinet and causes some issues when SSL inspection profiles are needed to block specific websites or applications provided by Google itself.
The reason why this is affecting the filtering of apps and websites is that the most recent versions of Google Chrome browsers have QUIC enabled by default when connections to Google servers are established. For example, connections to Gmail, Google Translate, Google Drive, Google Maps, Google search engine, YouTube, Hangouts, and more, are using QUIC instead of TLS when the connection is established through a Google Chrome browser.
This article explains how to avoid these issues by disabling or blocking the QUIC Protocol.
Configuration:
There are three options to avoid the QUIC protocol to be used.
- Disabling QUIC directly in the Google Chrome browser:
Go to the Chrome web browser and type 'chrome://flags/' in the search line.
Find the flag 'Experimental QUIC protocol'. And change it from 'Default' to 'Disabled'.
The browser must be closed completely for the changes to take effect. Then it will be possible to confirm the protocol TLS is being used for any HTTPS connection (even Google servers).
-
Blocking the port UDP/443:Create a service-object 'QUIC' specifying the port UDP/443.Create a firewall policy denying QUIC traffic from the internal network to the Internet.
-
Blocking QUIC using Application Control.
Go to Security Profiles -> Application Control. Select a profile and select 'Edit'. Under 'Application and Filter Overrides', select 'Create New'.
Search for QUIC. Select QUIC and Add Selected as shown below. Select OK and OK again to save the changes.
Enable the Application Control in the firewall policy. When traffic hits this policy, QUIC will be blocked.
This policy must be at the top of the firewall policies sequence. After applying the changes, Google Chrome browsers will be forced to use TLS instead of QUIC.
Verification:
To confirm that TLS is being used after the changes:
Open a connection HTTPS against any Google Server and select the padlock in the search field. Then, select 'connection' and it will show which protocol is being used:
