topic QUIC deny vs drop in General Topics

QUIC deny vs drop

mike406 — Mon, 29 Oct 2018 14:25:10 GMT

Just curious.

The recommended QUIC rules set the action to 'deny', but the first rule is for service udp 80/443 any application. Is there a reason this is a 'deny' and not a 'drop'?

Reference

HOW TO BLOCK QUIC PROTOCOL

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClarCAC

What a difference a Deny makes

https://live.paloaltonetworks.com/t5/Community-Blog/What-a-difference-a-Deny-makes/ba-p/188811

Re: QUIC deny vs drop

JW6224 — Mon, 29 Oct 2018 15:12:46 GMT

There isn't a default "Deny Action" on QUIC, as it is (as you note) a UDP-only protocol. I believe that the default Deny is equivalent to a Drop, unless you check the checkbox on the "Send ICMP Unreachable" option.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/policy/security-policy/security-policy-actions

"For a UDP session with a drop or reset action, if the ICMP Unreachable check box is selected, the firewall sends an ICMP message to the client."