About Dpeters1

Thanks for keeping us updated on your TAC case. I'd have raised one but frankly couldnt face it, already got a couple of super weird bug cases open that are taking forever to get to the bottom of! 🙂     The content update didn't help for me unfortunately.  ... View more

@jmurphy on the firewall, the decoders for various protocols are updates as part of apps and threats updates, and as luck would have it... todays apps and threats has an updated http2 decoder... we had issues with this on different web sites back in 9.0 or 9.1 (feels like a million years ago now) and an updated decoder fixed the issues. that said we're on 10.0.2 now for our main site, and that hasn't been affected. still stumped as to how its not a consistent issue across locations and firewalls.  ... View more

No, I wasnt able to re-produce in other browsers, although I didn't really try very hard, 99% over browser use is chrome. I've ended up adding a few youtube URLs and some related google video URLs to our "strip ALPN" url category, youtube videos were being very slow to buffer.   all a bit ironic really, HTTP/2 is support to be faster than 1.1 🙂   PLEASE PLEASE PLEASE let us know the outcome of your TAC call, I anticipate that we'll see an updated HTTP2 decoder in a future content update.    Speaking with some colleagues, they've seen the exact issue but with unrelated websites quite some time ago, and an updates HTTP2 decoder resolved the issue.         ... View more

Ouch, bad times. Such a weird issue how it's so intermittent between deployments.    Have you tried the strip ALPN option on your decrypt profile ? ... View more

I think if you allowed quic, chrome would default to that for comms to google services (unless explicitly disabled in the browser settings), so that would also mitigate the issue, but you'd lose content control over all that traffic as the NGFW cant look inside quic at all.  I've always blocked quic on all our deployments for as long as I can remember.    Well, there's 2 or 3 of us with it on the thread with the issue now! 🙂     Tried hard to recreate in 10.0.2, cant do it.    I've checked a location with 9.0.9, doesnt seem to do it their either, this ones a different client so slightly different policy setup, they were actually allowing quic, blocked it, still all working fine.   so strange, seems movable...    they're all on the same apps/threats which includes the decoder updates.    anyway feel like raising a TAC case? 😉 ... View more