google not working with chrome update if unknown-udp is blocked

[PanIst]

Hi,

chrome version 54.0.2840.59m if unknown-udp is blocked - google is not working

Any idea ?

Thanks

[BPry]

@PanIst I can't reproduce the issue on my 3020. Did you recently install a new applications and threats update? I'm still on 621 until this evening and everything is working perfectly on 54.0.2840.59 m. 

[PanIst]

Hi,

please use a deny rule for unknown-udp at top and app-id is 623

Tried with 3 paloalto(vm,5050 and pa200) same issue 

Regards

[PanIst]

app-id version is not ipmportant.Tried with 614 and it is same.

[BPry]

@PanIst I'm not seeing the same issue; traffic is being identified correctly and nothing is getting denied because of the Chrome update. 

[PanIst]

I'm sorry but there must be something different at your side.We replicated it on 3 different customer.Thanks

[PanIst]

[Raido_Rattameister · Accepted solution]

Chrome uses quic by default that runs over udp.

Probably they changed the behaviour and Palo AppID does not match any more.

Temporary workaround might be to disable quic in Chrome.

You can't decypt quic anyway so you loose visibility when users access Google services with Chrome so disabling it might be good idea anyway.

https://www.google.ee/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=chrome%20disable%20quic

[RichColeman]

Had the same issue, Palo TAC advises that the content team is working to resolve the issue. Watch this space for an emergency release.

[luancb]

Version 625
Notes:
With the most recent version of the browser Chrome, Google updated their experimental protocol QUIC, which caused the "quic" App-ID to be misidentified as "unknown-udp". With this content update, Palo Alto Networks is releasing additional coverage for the "quic" App-ID to include the changes made by Google.