Disable QUIC Protocol to Ensure Compatibility with AnyConnect SWG

Introduction

This document describes how to disable the QUIC protocol in browsers to ensure proper operation of AnyConnect Secure Web Gateway.

Overview

Umbrella users who use AnyConnect Secure Mobility Client and Secure Web Gateway can experience issues with Google services (such as Gmail or YouTube) when browsers use the QUIC protocol. QUIC uses UDP instead of TCP, which the AnyConnect Secure Mobility Client does not support. Disabling QUIC ensures that web requests route correctly through the SWG proxy.

Symptoms of QUIC-Related Issues

When a browser attempts to use QUIC, users can encounter:

• Google sites or other sites using QUIC failing to load
• SWG settings, such as Application Control and Advanced Application Control, not applying
• Policy enforcement issues for sites using QUIC

An example of an error loading a YouTube video:

360074357372

Check if QUIC Is Enabled in Google Chrome

To determine if Chrome uses QUIC:

1. Open Chrome Developer Tools (Menu > More tools > Developer tools or press Ctrl+Shift+I).
2. In the Network tab, right-click a column heading and enable the Protocol column.
3. Navigate to a Google-owned website, for example,https://www.google.com.
4. Look for the entry http/2+quic/39 in the Protocol column. If present, QUIC is enabled.

Disable QUIC in Google Chrome

To disable QUIC manually in Chrome:

1. In the address bar, enter: chrome://flags#enable-quic
2. Set the Experimental QUIC protocol flag to Disabled.
3. Relaunch Chrome to apply the change.

Disable QUIC via Policy

Windows registry location for Windows clients:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome

Windows registry location for Google Chrome OS clients:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\ChromeOS

Windows value name (REG_DWORD):

QuicAllowed

Mac/Linux preference name (Boolean):

QuicAllowed

If this policy is set to true (or not set), usage of QUIC is allowed. If the policy is set to false, usage of QUIC is not allowed.

Values to disable QUIC

Windows Decimal REG_DWORD:

0

Windows Hexadecimal REG_DWORD:

0x00000000

Linux:

false

Mac:

<false />

Windows Registry Example for Chrome Windows clients:
22732115303572

Block QUIC on a Firewall

Block QUIC by either blocking UDP port 443 or blocking QUIC by application name if the firewall supports Layer 7 inspection. Ensure that your firewall rules allow Umbrella-related IP addresses for encrypted DNS by referencing the Secure Web Gateway IP List and Domains to Allow in Firewalls.

Manage QUIC in Other Browsers

Other browsers can use the QUIC protocol. Control options include:

• Firefox:
  Set the network.http.http3.enabled configuration option in about:config. For more information, see the articleHow to Enable HTTP 3 Support in Firefox
  
  
• Microsoft Edge:
  QUIC can be controlled via Group Policy