Chrome Quic SSL proxy / deep inspection

Reply
L4 Transporter

Chrome Quic SSL proxy / deep inspection

HI

 

WOndering when / if PA's will handle QUIC the same way it handles web-browsing / ssl ?

 

Alex

L3 Networker

Re: Chrome Quic SSL proxy / deep inspection

As far as I'm aware the PA can not decrypt QUIC. I have a Chrome group policy on my environement disabling QUIC in the browser and I block QUIC high up in my rules which would causes Chrome to fail back to SSL.

-Brad
L7 Applicator

Re: Chrome Quic SSL proxy / deep inspection

@Alex_Samad,

There are technical limitations in decrypting QUIC traffic due to the use of multiplexed connections and proprietery encryption methods. Visibility into this traffic is therefore limited and does not allow the firewall to decrypt this traffic. 

My suggestion would be to block QUIC if you need visibility into the traffic. Since QUIC is still technically in development it would additionally be recommend that you create one rule that blocks application 'quic' on service 'application-default'; and then block udp-443 and udp-80 depending on your requirements. If Google updates QUIC it may be that the app-id drops back to unknown-udp, depending on your logging/security requirements this may/maynot be acceptable to you. 

L7 Applicator

Re: Chrome Quic SSL proxy / deep inspection

Hello,

We block it without any issues. PAN also says block it:

 

 

In Security policy, block Quick UDP Internet Connections (QUIC) protocol unless for business reasons, you want to allow encrypted browser traffic. Chrome and some other browsers establish sessions using QUIC instead of TLS/SSL, but QUIC uses proprietary encryption that the firewall can’t decrypt, so potentially dangerous traffic may enter the network as encrypted traffic. Blocking QUIC forces the browser to fall back to TLS/SSL and enables the firewall to decrypt the traffic.

 

 

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/decryption/define-traffic-to-decrypt

 

L4 Transporter

Re: Chrome Quic SSL proxy / deep inspection

Hi

 

Yes I know that, but i would have presumed over this time PA might have spent some time to do inspection. Its an open spec ?

 

Alex

L7 Applicator

Re: Chrome Quic SSL proxy / deep inspection

@Alex_Samad,

Last I looked at the protocol in depth the encryption method Google was using was still proprietary.

L7 Applicator

Re: Chrome Quic SSL proxy / deep inspection

@Alex_Samad

For PaloAlto it is probably not worth spending money/time on something that 1% of webservers use

L4 Transporter

Re: Chrome Quic SSL proxy / deep inspection

I would have thought PA and google would have some sort of working relationship.

 

Guess it would be in googles interest as well. otherwise sys admins like me are just going to block it..

L4 Transporter

Re: Chrome Quic SSL proxy / deep inspection

If/when it becomes more main stream wouldn't it be rather late.

 

I get the impression PA haven't taken a rather big bit of the pie and some rather basic things have been forgotten. Not this, but have you triee renewing a cert with altname attributes - doesn't work in PA, the PA's drop the alt attributes. Not a main thing but a rather silly thing to forget to do and I am told its not a trival thing to fix for PA ... sigh ....

 

If it speeds up browsing when will it go from 1% to ... 

 

L7 Applicator

Re: Chrome Quic SSL proxy / deep inspection

I agree with the point about some (basic) things. Some of them are silly bugs and some of them features that would be nice. 

PA and Gpogle have some sort relationship with the deployment of paloalto firewalls in the google cloud, but with Quic I think Google simply does not really care. Their goal is to make browsing fast and secure. A Man-in-the-middle per definition isn't that :P

But about Quic itself, I personally don't think this will rapidly grow (it made 0.2% in the last 8 months). Yes, quic does speed up browsing and adds also some other features, but almost the same you will get with http/2 (official benchmarks show that browsing with http/2 AND TLS encryption is faster than http 1.1 without encryption). And http/2 is already at 28.9%.

One really big thing(/problem) for Paloalto will be TLS1.3 ...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!