For devices that cannot block the QUIC protocol, use temporary workarounds on the device

Null

QUIC protocol can't be blocked.

1. Use domain name blocking.

First, enable the DNS snooping command in the command line.

Second, create a new object group in [Objects->Object Groups->IPv4 Address Object Groups]

You can enable DNS aging to prevent cache from aging and causing false positives.

Then, via[Policies->Security Policies-> Security Policies], create a new security policy that references the new created IPv4 object group. If the interface references VRF, you also need to create a VRF blocking policy.

The defects of using domain name blocking are as follows:

1) When using the domain name blocking function, the terminal's DNS traffic must also pass through the firewall, and the firewall records the address locally, otherwise it will not take effect

2) This function intercepts the destination IP based on the IP address returned by the DNS message. If the IP address of a domain name is the same as the domain name to be intercepted, it will cause erroneous interception.

Refer to the analyzing process.