Requirement is to achieve BLOCKING tunnelling application like QUIC

QUIC protocol is not getting blocked while using UTM web-filtering custom URL BLOCK.

When you want to block certain tunneling applications such as QUIC, you can either configure a L4 DENY UDP policy for port 443/80, or use junos:QUIC app under dynamic-application config.

Solution 1: (L4 DENY Policy)

Configure custom application

set applications application udp-443 protocol udp
set applications application udp-443 destination-port 443

[edit security policies global]
root@SRX345-B# show 
policy Reject-QUIC {
    match {
        source-address any;
        destination-address any;
        application udp-443;
    }
    then {
        reject;
        log {
            session-init;
        }
    }
}

Solution 2: (Dynamic Application)

[edit security policies]
root@SRX1500-A# show 
global {
    policy Reject-QUIC {
        match {
            source-address any;
            destination-address any;
            application any;
            dynamic-application junos:QUIC;
        }
        then {
            deny;
            log {
                session-init;
            }
        }
    }

2024-05-28 : Article Created

Added:-

Configure custom application
set applications application udp-443 protocol udp
set applications application udp-443 destination-port 443

PLM suggested workaround to block QUIC, either as L4 UDP 443/80, or using junos:QUIC app.

PLM confirmed that SRX can detect QUIC but the support for L7 services is road mapped to 1H2024, and this topic is under discussion with Engineering.