How to block Google QUIC Protocol on SonicOSX 7.0?

08/31/2020 0 2648

DESCRIPTION:

QUIC stands for Quick UDP Internet Connections. QUIC improves performance of connection-oriented web applications that are currently using TCP. It does this by establishing a number of multiplexed connections between two endpoints over UDP.

Google Chrome uses this protocol to reduce latency but then it bypasses security services on the firewall as they are TCP based. If QUIC is blocked, Google fails back to TCP and the security services can be enforced correctly.

RESOLUTION:

The following method shows how QUIC can be disabled on the Google Chrome Browser itself:

1. On Google Chrome browser, navigate to chrome://flags/
2. Look for Experimental QUIC protocol and set the state to Disabled instead of Defaults or Enabled.
   
   
   
3. You would need to relaunch the browser for this to take effect.

These changes might not be feasible to be done on every computer and a firewall security policy might help block it for the entire network. It can be either blocked as a service or as an application.

Block Google QUIC as a service

1. Navigate to Policy | Rules and Policies | Security policy tab and click on Top at the bottom of the screen. This adds the new Policy at the top of the list. You might need to adjust its priority based on other rules you have.
   
   
   

2. 
   

   Mention a relevant name and in the Source/Destination tab, you can select many fields like source/destination zones, address, services and also user, geo-location settings. Select the pencil icon next to Destination Port/Services to add a new Service object.
   
   
   

3. 
   

   Give the service object a relevant name, use UDP as the protocol and port range as 443-443. Click on Save.
   
   
   

4. 
   

   Under App/URL/Custom Match tab leave everything on defaults.
5. Select the Default Profile as the Security rule action. Make sure that the Action is set to Deny and the policy is in enable state. Click Add.
   
   
   

Block Google QUIC as an application:

1. Navigate to Policy | Rules and Policies | Security policy tab and click on Top at the bottom of the screen. This adds the new Policy at the top of the list. You might need to adjust its priority based on other rules you have.
   
   
   
2. Mention a relevant name and in the Source/Destination tab, you can select many fields like source/destination zones, address, services and also user, geo-location settings.
   
   
   
3. Under App/URL/Custom Match, use the radio button for 'Match Operation' as OR. Also, select the pencil icon to add a new Application Match Group. 
   
   
   
4. Select the Google QUIC application using the right arrow and move it to the right. Click Save.
   
   
   
5. Select the Default Profile as the Security rule action. Make sure that the Action is set to Deny and the policy is in enable state. Click Add.