Google QUIC Disconnects

[cosx]

We started getting complaints from users that various Google services were showing intermittent disconnects. I think we've tracked it down to the QUIC protocol not being accurately identified by the PAN firewalls and getting blocked. I see 443/udp traffic from the hosts in question getting dropped as "unidentified-udp" mixed in with the allowed "quic" traffic on the same ports to the same general set of Google servers. Google has been rolling out QUIC for a while now, but we only recently allowed it in the firewall. It's been since then that we've seen the Google issues start.

I am considering adding a rule allowing "any" application out on 443/udp as a workaround. Has anyone else seen similar problems? That is, do you allow "quic" out to the Internet, but otherwise would drop 443/udp and see or not see this issue? Did you implement a workaround like this or something else? (BTW, I am not overly concerned about the security implications. PAN firewalls don't understand the QUIC traffic like HTTPS to guess at the Google "applications" inside.)

[OtakarKlier]

Not sure which version of software and/or dynamic updates you are on, however our PAN does see the quic traffic but we dont see any of the unidentified-udp. We currently are blocking quic but that is mainly because no one has complained about it. We dont use many google apps, maily search and mail for some users.

[cosx]

Running 6.1.2 and keep up-to-date with the application-threat updates.

Yeah, it all worked fine when we weren't allowing quic. We didn't start seeing problems until we expressly allowed it.