Symptoms of QUIC Enabled on Google Chrome – Cisco Umbrella

[ad_1]

Overview

Umbrella customers using AnyConnect Secure Mobility Client + Secure Web Gateway (SWG) may need to disable the QUIC protocol in Google Chrome settings to avoid issues such as Google related pages not displaying correctly, Youtube videos not loading as expected, or problems in which application application is not applied.

You may see an error similar to the one in the screenshot below, for example.

Google Chrome uses QUIC to connect to all Google services by default. Therefore, all requests to Google services through the Google Chrome browser use UDP instead of TCP. Therefore AnyConnect Secure Mobility Client will not intercept these requests and therefore the proxy will not see them.

Currently, a default installation of Chrome is not fully supported for Google products with SWG. QUIC must be disabled. Application controls and page loads may not work as expected without disabling QUIC.

QUIC in Google Chrome Symptoms of QUIC enabled on Google Chrome Google sites may not load SWG settings for Google sites may not be applied Application control Advanced application control (such as uploads) Policy enforcement Disabling QUIC in Google Chrome

For more information on disabling QUIC on a managed device, see https://support.google.com/chrome/a/answer/7649838?hl=en. You can manually disable QUIC in Google Chrome using the experimental QUIC protocol flag (# enable-quic):

In the address bar, type: chrome: // flags # enable-quic Set the experimental QUIC protocol flag to Disabled Restart Chrome for the setting to take effect.

The following Windows registry key (or Mac / Linux preference) can be used to disable QUIC in Chrome and can be applied via GPO or equivalent:

Data type:

boolean [Windows:REG_DWORD]

Windows registry location for Windows clients:

Software Policies Google Chrome QuicAllowed

Windows registry location for Google Chrome OS clients:

Software Policies Google ChromeOS QuicAllowed

Mac / Linux Preference Name:

Quic Permitted

Description:

If this policy is set to true (or not set), the use of QUIC is allowed. If the policy is set to false, the use of QUIC is not allowed.

Recommended value:

Windows: 0x00000000, Linux: fake, Mac:

Quic blocking on your firewall

You can also block the QUIC protocol on the firewall, either by blocking UDP 443 (by port) or by blocking QUIC by application name (if the firewall supports L7). In both cases, you will need to allow Umbrella related IP addresses from firewall rules to facilitate encrypted DNS: Secure Web Gateway IP list and domains to allow in customer firewalls.

[ad_2]