{"id":22327,"date":"2018-03-14T12:00:00","date_gmt":"2018-03-14T11:00:00","guid":{"rendered":"https:\/\/www.avanet.com\/kb\/sophos-firewall-and-the-quic-protocol\/"},"modified":"2022-06-16T19:43:05","modified_gmt":"2022-06-16T18:43:05","slug":"sophos-firewall-and-the-quic-protocol","status":"publish","type":"kb","link":"https:\/\/www.avanet.com\/en\/kb\/sophos-firewall-and-the-quic-protocol\/","title":{"rendered":"Sophos Firewall and the QUIC protocol"},"content":{"rendered":"\n

In this article we will explain what the QUIC protocol is and why you should disable it for security reasons, at least for now.<\/p>\n\n

What exactly is the QUIC protocol?<\/h2>\n\n

QUIC stands for “Quick UDP Internet Connections” and was developed by Google to make the Internet faster.<\/p>\n\n

Let’s take a well-tried protocol, such as HTTP (Hyper Text Transfer Protocol). This already exists in a second version – HTTP\/2. The transport protocol that HTTP relies on is TCP. This has proven to be reliable, but it is also not exactly fast. The connection takes a long time to establish and if the page is then also encrypted with SSL, i.e. HTTPS, it takes even longer. This is exactly where Google came in and created QUIC, a protocol that is not only secure, but also enables fast connections.<\/p>\n\n

QUIC does not use TCP, but UDP, which is faster but also less reliable. Because of its speed, the protocol is therefore also often used for video or audio streaming. With QUIC, Google has managed to compensate for the unreliability of UDP and thus develop a fast, stable and secure protocol.<\/p>\n\n

The web server running this website here already supports QUIC. HTTP\/2 is used as the protocol by default. However, if you are using Google Chrome, QUIC is used. On the following screenshot you can see how the whole thing works. Massively less packet turnaround time (Round Trip Time > RTT).<\/p>\n\n

\n
\"QUIC:<\/a>
Image source<\/strong>: Chromium Blog<\/small><\/figcaption><\/figure>\n<\/figure>\n\n

But QUIC can do more, such as maintaining the connection to the web server. You are probably familiar with the behavior that when you visit a website at home and then want to view it again later on the road via 4G or in the office via the WLAN, the page is reloaded. This behavior is triggered because your IP address has changed, causing you to disconnect from the web server. With QUIC this won’t happen to you, because it works with browser detection and the connection can be easily re-established.<\/p>\n\n

QUIC – Uncontrollable with Sophos at the moment<\/h2>\n\n

Google has definitely developed something great with QUIC and with almost 60% market share of the Google Chrome browser (source: statista), they definitely have the power to spread this protocol.<\/p>\n\n

The problem, however, is that QUIC bypasses WebProxy, Sophos Sandstorm, and also malware scanning and content filtering. The reason for this is that currently only HTTP and HTTPS can be scanned by the web filter. So, as with HTTPS scanning<\/a>, the firewall owner must take action to avoid taking any risks.<\/p>\n\n

Disable QUIC<\/h2>\n\n

1st option: Via Google Chrome<\/h3>\n\n

The first option would be to disable the QUIC protocol directly in the Google Chrome browser. To do this, simply enter chrome:\/\/flags\/<\/code> in the address bar and deactivate QUIC.<\/p>\n\n

\n
\"Disable<\/a><\/figure>\n<\/figure>\n\n

2nd option: Via Application Control<\/h3>\n\n

If you prefer to block QUIC via the firewall, you can control this via Application Control. Simply create a new filter, add the QUIC protocol and finally select the created filter under Application Control.<\/p>\n\n

\n
\"Add<\/a><\/figure>\n<\/figure>\n\n
\n
\"Select<\/a><\/figure>\n<\/figure>\n\n

3rd option: block UDP on the firewall<\/h3>\n\n

The third option is to simply block UDP on ports 443 and 80 on the firewall, which will then automatically use HTTP\/HTTPS.<\/p>\n\n

\n
\"Disable<\/a><\/figure>\n<\/figure>\n\n

<\/p>\n","protected":false},"author":5,"featured_media":0,"parent":0,"template":"","format":"standard","kb_kategorie":[382],"class_list":["post-22327","kb","type-kb","status-publish","format-standard","hentry","kb_kategorie-sophos-firewall"],"blocksy_meta":[],"acf":[],"_links":{"self":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb\/22327","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb"}],"about":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/types\/kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/users\/5"}],"wp:attachment":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/media?parent=22327"}],"wp:term":[{"taxonomy":"kb_kategorie","embeddable":true,"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb_kategorie?post=22327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}