Question about ECH and its effect on URL filtering (without decryption) + how to block it

[Alpalo]

Hi team

We have received reports from users regarding URL filtering behavior and are investigating whether ECH (Encrypted Client Hello) is the cause. In our environment, we cannot apply SSL decryption, so we rely on inspecting the SNI
in the ssl_client_hello.

In Wireshark captures of the TLS ClientHello, we see the extension “encrypted_client_hello (ECH)”. It appears that Cloudflare allows a generic external SNI and encrypts
the internal SNI, which is where the actual URL to be accessed goes. This makes URL filtering less effective.

Can you confirm this?

1. How ECH affects URL filtering and destination identification in PAN-OS without decryption (official limitations).
2. Whether Palo Alto recommends blocking/mitigating ECH in corporate environments to maintain the effectiveness of URL filtering.
3. What is the supported method for blocking/preventing ECH (e.g., signature to detect ECH in ClientHello, or blocking associated DNS RRs such as HTTPS/SVCB) and how to validate it in logs.

Thank you,

[kiwi]

Hi @Alpalo ,

To maintain optimal function of the security services of the firewall, Palo Alto Networks recommends blocking all ECH-supporting record types.

Source: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/content-inspection-features/dns-se...

Hope this helps,