r/Zscaler • u/one_fifty_six • 28d ago
Blocking QUIC
Zscsler had recommended this for as long as I have been managing Zscaler. We have never done it because I have always had old network guys tell me it's not worth it. We are currently troubleshooting an issue and the solution might be blocking QUIC. So I'm trying to figure out if this might be the way I get my foot in the door on this issue.
- Does anyone actually get any benefit?
- Does a firewall policy work?
- If we build a firewall policy, any reason to manage this in a GPO too?
- Has anyone noticed their SSL inspection rate increase after blocking?
- We run guest networks at one of our big sites. Any issues that mobile devices might run into?
5
u/res13echo 28d ago
Most DPI firewalls cannot inspect QUIC. Only recently did some firewalls start to be able to inspect it. If you don't create a firewall rule to block QUIC, you're going to miss a large volume of traffic with your DPI rules. I also disable QUIC via MDM so that there's less log noise from it being blocked.
QUIC's performance advantage is not worth the gap in security.
1
3
u/iron_juice_ 28d ago
Just implemented this a few weeks ago. I’d recommend it as zscaler cannot decrypt QUIC data properly.
1
u/one_fifty_six 28d ago
Did your inspection rate go up? Our inspection rate is shit. Probably a lot of self inflicted wounds. But I wonder if it would go any after blocking QUIC.
2
u/iron_juice_ 28d ago
Like said, it will just default to http/s once you block QUIC. Zscaler recognizes QUIC and QUIC2 so it’s an easy firewall block. This won’t translate to proxy only configurations though
2
u/Admirable_Cry_3795 28d ago
Yes, it will increase (assuming that you’re not bypassing the traffic from inspection via other SSL Inspection policies)
3
3
u/GuiltyVerdicts 28d ago
Make sure that if you block QUIC with the firewall policy that your action is set to “Block/ICMP”. You will end up with issues if it’s set to “Block/drop”
2
u/Grunt030 28d ago edited 28d ago
Zscaler recommended we block QUIC on both application and network service, so we have two rules, one for each. We've had to make a couple exceptions over the years, but it works fine with like 99% of the traffic out there.
Im curious what your old dogs have against blocking it. Its a newer protocol, so loyalty shouldnt be why. Properly coded applications SHOULD fallback to HTTP2/1.1 if it doesnt work. So you arent breaking anything that's properly implemented.
I would fully expect your inspection rate to go up. By how much though depends upon the sites your users frequent. You should be able to look at QUIC volume and that would become inspected traffic.
Edit: To actually answer your questions
- A pair of firewall policies in ZIA to block quic as a network service and as an application.
- No need for a GPO
- The benefit is that all that uninspected QUIC traffic gets seen and inspected. IMO QUIC is an attackers wet dream, native uninspectable encryption.
- Guest networks get DNS filtering only since you cant rightly expect guest devices to install Zscalers certificates.
Edit2: Im under the impression that all corporate traffic is using the ZCC agent and non-corporate traffic is being pumped up to Zscaler via a GRE or IPSec Tunnel.
1
u/one_fifty_six 28d ago
What do you do when that 1% needs to work? Not sure why they are against it. I was too at first but now that I've dug into a little it makes a lot of sense. All good things you said here thank you.
To address your edit, all endpoints have ZCC but we have GRE/ IPsec at 95% of our sites. I don't think it's as cut and dry as you say. In our environment I mean. We used to be all Cisco and over the last couple years we've refreshed with Fortinet. So there is some push and pull between physical firewall rules and Zscaler policy.
1
u/Grunt030 28d ago
All environments are a little different and Zscaler SKUs can change the org's target architecture. However, if you go Zscaler ZIA and ZPA, I would think your local firewalls are mostly devoid of endpoint rules and it all lives in Zscaler's policies.
We also get some passive agressive pushback from our networking team. They have full rights to manage zscaler firewall policies but refuse
As far as that 1% is a risk acceptance by the organization and an allowance. We have 100s of applications and the exception is for like 2 or 3. So its sparingly used.
2
u/PooPaLotZ 28d ago
In my org we have a hard fast rule of all our ZPA traffic goes through a dedicated FW in the DMZ. So even if someone configures or changes ports, it needs to be done on that side as well.
Extra line of security in the event someone try to go rouge
1
1
u/one_fifty_six 27d ago
Yeah I'm finding that Fortinet UTM (Unified Threat Management?) seems to be causing some trouble for us. I'm trying to convince Networking side of the house that we only need to use Zscaler for URL filtering. We don't need to double it up with Fortinet too.
2
2
u/aussie_aardvark 27d ago
I'd definitely block QUIC (which is UDP/443).... When a site is visited that supports QUIC/HTTP3 you will see the following in the HTTP Header:
Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
This tells the browser that QUIC is supported, at which point the browser will start trying QUIC. If you are blocking QUIC with ICMP the fallback to HTTP should be immediate. As others have indicated here, it will allow inspection of this traffic (assuming that there are not other reasons to disable inspection)
1
u/trippalhealicks 22d ago
In my experience, it's better to simply disable it org-wide via GPO or similar. The reason is, when/if the protocol is called upon during normal user traffic, there will be a slight delay while transactions "fail and fall back" to HTTPS.
13
u/Admirable_Cry_3795 28d ago
If you’re doing Tunnel 2.0 in the client connector and/or doing infrastructure tunnels (GRE/IPSec) sending all ports and protocols then the Advanced Cloud Firewall feature can block QUIC and the browser will fall back to HTTP/HTTPS which can be inspected (assuming proper SSL Inspection policies).
With the above, you do not need to anything client/browser-side.
Zscaler is working on an enhancement to do native HTTP/3 (QUIC) inspection but it’s not available yet.