Sophos Firewall: v19.0 MR1: Feedback and experiences

Just noticed that the DPI engine / Application Filter isn't picking up iCloud+ relay traffic.

The link below provides the details

https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay

DPI Engine cannot use QUIC Protocol. But you can block it, if you want. 

Apple seems to use QUIC for this feature. iCloud Private Relay uses QUIC, a new standard transport protocol based on UDP. QUIC connections in Private Relay are set up using port 443 and TLS 1.3, so make sure your network and server are ready to handle these connections.

DPI Engine cannot use QUIC Protocol. But you can block it, if you want. 

Apple seems to use QUIC for this feature. iCloud Private Relay uses QUIC, a new standard transport protocol based on UDP. QUIC connections in Private Relay are set up using port 443 and TLS 1.3, so make sure your network and server are ready to handle these connections.

Thank you for the response, it was more the point that I was hoping that the Application reporting engine would be able to report on traffic going to these URLs, as listed, and therefore identify them as iCloud + Relay - the same as Netflix is identified etc.

Also seems that the Apple TV / Apple Movies in the Cloud  traffic is not being recognized either. 

LuCar Toni said:

DPI Engine cannot use QUIC Protocol.

Out of interest: Is an implementation technically not possible - or is that a limitation for now?

It is not that easy to answer. As HTTP/2 and now HTTP/3 is going to take over, it is hard to decrypt this on a native part. There are certainly parts to do this, but it is not that easy to implement it. Going forward, there will be show cases in how to do this.

You can maybe read something about this here: https://blog.cloudflare.com/unlocking-quic-proxying-potential/

I will understand this as support for QUIC in the DPI Engine is at least mentioned on the backlog and you will continue to review this. Sounds great and fine for me ^^

Thanks!