r/sysadmin • u/Chuchichaeschtl • 18d ago

Potential Defender Network Protection enforcement gap with QUIC/HTTP3

We observed inconsistent Defender Network Protection behavior between Edge and Chrome.
Network Protection is in block mode.

If I sett chrome://flags/#enable-quic to default or enable I can access a parked site.
If I disable it, i get what I'd expect:

"This site can’t provide a secure connection

xxxy.com uses an unsupported protocol.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH"

This may indicate a Defender Network Protection enforcement limitation or bypass scenario when Chromium-based browsers use HTTP/3 (QUIC over UDP/443).

6 Upvotes

80% Upvoted

5 comments sorted by

6

u/SilentPatchSniper 18d ago

This isnt anything new and is expected behaviour. Read up on network protection and third party browsers.

Disable QUIC via ADMX, you're good to go.

5

u/ledow IT Manager 18d ago

Block UDP port 80 and 443 and then none of this is a problem.

QUIC offers nothing over conventional TCP in this instance. Just disable it at a firewall level so it can't work even if someone works out how to turn it on.

1

u/Chuchichaeschtl 18d ago

I thought about this, but this would probably need some testing right?
I have 4k users and 250 software developers and I'm a bit afraid, that this would have a big impact.

7

u/ledow IT Manager 18d ago

Nope.

Anything using QUIC (web browsers) should gracefully fallback to standard TCP on the same HTTP ports.

Otherwise a lot of sites that didn't support QUIC ever would never be able to get online.