topic Re: ‘TLS alert: protocol_version’ after QUIC blocking and connecting via https in Firewall and Security Management

‘TLS alert: protocol_version’ after QUIC blocking and connecting via https

Oliver_222 — Wed, 24 Jul 2024 13:54:22 GMT

‘TLS alert: protocol_version’ after QUIC blocking and connecting via https
Good afternoon

Can you please tell me if HTTPS inspection will work correctly when the connection is already via TCP 443?

We have QUIC blocked. User has Bypass configured in https inspection. In logs we see reject QUIC and then Bypass log with Alert. And we see the error: ‘The probe detected that this destination cannot be inspected and its identity cannot be verified due to a TLS alert (TLS alert: protocol_version)’.
What can this be related to?

Re: ‘TLS alert: protocol_version’ after QUIC blocking and connecting via https

Jan_Kleinhans — Thu, 25 Jul 2024 15:02:28 GMT

We have the same log entries.

Which firewall version?

Re: ‘TLS alert: protocol_version’ after QUIC blocking and connecting via https

PhoneBoy — Thu, 25 Jul 2024 19:00:13 GMT

HTTPS Inspection only supports up to TLS 1.2 unless you're on R81+ and USFW is enabled: https://support.checkpoint.com/results/sk/sk167052
If the remote site requires TLS 1.3 (or above), then I could see this error popping up.

In any case, please provide a full log card (redacting sensitive details.