This article explains why some URL's would be accessible even when its blocked using Enhanced web-filtering.
The usual suspect for this has been chrome using QUIC protocol and solution which is being given is to block QUIC protocol. Please refer KB87466 [juniper.net]
But there has been some instances reported that even after blocking QUIC, some websites are not being blocked.
The reason for websites not being blocked is because it use ECH, which mask the actual the actual SNI of the website with the ECH provider's SNI.
Some yse workaround to block the SNI of the ECH provider itself. example cloudflare-ech.com.
But as there are multiple ECH providers and it might not be feasible to block all them one by one.
To understand the workaround lets understand the flow of ECH:
Here is the solution that is can be implemented to block ECH using SRX. The solution will need to involve creating necessary signatures that can block the ECH workflow.
STEP 1: Block QUIC AND DoH (DNS over HTTPS) / DoTLS (DNS over TLS) and place it on top of the policy list.
set security policies from-zone trust to-zone untrust policy BLOCK-QUIC-DNS-ENC match source-address any
set security policies from-zone trust to-zone untrust policy BLOCK-QUIC-DNS-ENC match destination-address any
set security policies from-zone trust to-zone untrust policy BLOCK-QUIC-DNS-ENC match application any
set security policies from-zone trust to-zone untrust policy BLOCK-QUIC-DNS-ENC match dynamic-application junos:QUIC
set security policies from-zone trust to-zone untrust policy BLOCK-QUIC-DNS-ENC match dynamic-application junos:DNS-ENCRYPTED
set security policies from-zone trust to-zone untrust policy BLOCK-QUIC-DNS-ENC then deny
set security policies from-zone trust to-zone untrust policy BLOCK-QUIC-DNS-ENC then log session-init
STEP 2: Create a IDP DNS signature and Policy to block DNS type HTTPS
IDP DNS Signatures:
set security idp custom-attack DNS_ECH_BLOCK_TYPE severity critical
set security idp custom-attack DNS_ECH_BLOCK_TYPE attack-type signature protocol-binding application DNS
set security idp custom-attack DNS_ECH_BLOCK_TYPE attack-type signature context dns-type-name
set security idp custom-attack DNS_ECH_BLOCK_TYPE attack-type signature pattern "\x 00 41 \x.*"
set security idp custom-attack DNS_ECH_BLOCK_TYPE attack-type signature direction any
IDP Policy:
set security idp idp-policy BLOCK_ECH_IDP rulebase-ips rule BLOCK_ECH_DNS_HTTPS match from-zone any
set security idp idp-policy BLOCK_ECH_IDP rulebase-ips rule BLOCK_ECH_DNS_HTTPS match to-zone any
set security idp idp-policy BLOCK_ECH_IDP rulebase-ips rule BLOCK_ECH_DNS_HTTPS match application default
set security idp idp-policy BLOCK_ECH_IDP rulebase-ips rule BLOCK_ECH_DNS_HTTPS match attacks custom-attacks DNS_ECH_BLOCK_TYPE
set security idp idp-policy BLOCK_ECH_IDP rulebase-ips rule BLOCK_ECH_DNS_HTTPS then action drop-connection
set security idp idp-policy BLOCK_ECH_IDP rulebase-ips rule BLOCK_ECH_DNS_HTTPS then notification log-attacks
STEP 3: Attach the IDP policy profile to the Security Policy along with the UTM policy.
set security policies from-zone trust to-zone untrust policy BLOCK_ECH_ON_DNS match source-address any
set security policies from-zone trust to-zone untrust policy BLOCK_ECH_ON_DNS match destination-address any
set security policies from-zone trust to-zone untrust policy BLOCK_ECH_ON_DNS match application junos-dns-tcp
set security policies from-zone trust to-zone untrust policy BLOCK_ECH_ON_DNS match application junos-dns-udp
set security policies from-zone trust to-zone untrust policy BLOCK_ECH_ON_DNS match dynamic-application any
set security policies from-zone trust to-zone untrust policy BLOCK_ECH_ON_DNS then permit application-services idp-policy BLOCK_ECH_IDP
set security policies from-zone trust to-zone untrust policy BLOCK_ECH_ON_DNS then permit application-services utm-policy MY_EWF_PROFILE
set security policies from-zone trust to-zone untrust policy BLOCK_ECH_ON_DNS then log session-init
Note: As these are custom signatures, there is no IDP license needed
Note: Use load set terminal to load the IDP signature config on SRX.
Additionally, please note that if a legacy security policy is configured, it will be evaluated before the Unified Policy. As a result, the SRX may not block the Junos application as intended.
In such cases, configure the dynamic-application parameter as any or none under the legacy policy, thereby converting it into a Unified Policy. This ensures that application identification is performed correctly and that the Junos application can be matched and blocked as expected.