Blocking QUIC manually

With the full support of HTTP3 over QUIC in flow inspection mode, the application control profile no longer needs to block QUIC by default. However, if you’re using proxy mode, you can manually block or monitor QUIC by selecting the QUIC application signature (40169).

To block the QUIC application signature in the GUI:

1. Go to Security Profiles > Application Control and click Create New.

2. Enter a name (test).

3. Add a filter override for the QUIC application signature:

   1. In the Application and Filter Overrides section, click Create New. The Add New Override pane appears.

   2. In the search box, enter QUIC and press Enter.

   3. Select the QUIC entry and click Add Selected.

      

   4. Click OK.

      

4. Configure the other sensor settings as needed.

5. Click OK.

To block the QUIC application signature in the CLI:

config application list
    edit "test"
        set other-application-log enable
        config entries
            edit 1
                set application 40169
                set action block
                set log enable
            next
        end
    next
end

Sample traffic log

1: date=2022-11-01 time=18:45:48 eventtime=1667353547840005082 tz="-0700" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="vd1" srcip=10.1.100.141 srcport=60268 srcintf="port2" srcintfrole="undefined" dstip=142.250.217.98 dstport=443 dstintf="port1" dstintfrole="undefined" srccountry="Reserved" dstcountry="United States" sessionid=2978 proto=17 action="accept" policyid=1 policytype="policy" poluuid="72a572a8-5a33-51ed-fa85-db33d77e4804" policyname="test" service="udp/443" trandisp="snat" transip=172.16.200.1 transport=60268 appid=40169 app="QUIC" appcat="Network.Service" apprisk="low" applist="test" appact="drop-session" duration=183 sentbyte=6390 rcvdbyte=0 sentpkt=5 rcvdpkt=0 utmaction="block" countapp=5 utmref=65535-1102