YouTube over QUIC Bypasses Student Web Filter
A school uses a FortiGate 100F with 1,200 student Chromebooks on VLAN 30 and 150 staff laptops on VLAN 20. Staff policy allows streaming media; student policy blocks Streaming Media and Social Networking, allows Education, and applies application control to block P2P. Both policies use certificate-inspection, not deep-inspection, because deep inspection previously caused Google Classroom certificate errors. Students now reach YouTube over QUIC on UDP 443, and application control logs show the session as QUIC/HTTPS rather than YouTube. The student web filter has no static URL entries. Staff report that a pilot deep-inspection policy on VLAN 20 breaks some Google apps with certificate pinning. The FortiGate CA certificate is installed on managed student Chromebooks via MDM but not on staff laptops. The school wants YouTube blocked for students, Classroom reliable for both groups, and no blanket deep inspection of all traffic.
1. Why does application control show QUIC/HTTPS instead of YouTube, and why is YouTube still allowed for students despite the Streaming Media block?
Read the worked answer
QUIC is encrypted UDP 443. Certificate inspection can see the server certificate or SNI in some cases, but application control may only classify the flow generically as QUIC or HTTPS because it cannot see the HTTP host or URL path. The web filter category engine also has less visibility into QUIC than into TCP 443 with certificate inspection. If the student policy allows UDP 443 and does not block QUIC, YouTube can load over QUIC before the category block is reliably applied.
The Streaming Media category block may also not match because the flow is not being decoded as an HTTP session. The absence of static URL entries removes a domain-level fallback. The practical fix is to block or control QUIC so browsers fall back to TCP 443, then use web filter categories or static URL filters for youtube.com and googlevideo.com. Application control can block QUIC as an application, but the goal is to force inspectable TCP, not simply to log QUIC.
2. Design a policy set that blocks YouTube for students, keeps Classroom working, and limits deep inspection.
Read the worked answer
Keep separate policies for student VLAN 30 and staff VLAN 20. On the student policy, add application control to block QUIC and P2P, and add a web filter with Streaming Media blocked plus static URL entries for youtube.com, youtu.be, and googlevideo.com. Use certificate inspection; with QUIC blocked, the browser falls back to TCP 443 and the category or URL filter can act. This avoids deep inspection for most student traffic.
On the staff policy, allow streaming media and block QUIC only if it does not break Classroom; Google apps fall back to TCP if QUIC is blocked, but test first. Reserve deep inspection for a narrow pilot or a specific category, and use SSL exemptions for pinned Google domains that break. Install the FortiGate CA only on managed devices that will be deeply inspected. Put the student policy above any broad policy that might match the same VLAN, and verify with logs that YouTube sessions are denied and Classroom sessions are allowed.
3. What certificate and client considerations determine whether deep inspection can be used for Classroom troubleshooting?
Read the worked answer
Deep inspection requires the FortiGate CA certificate to be trusted by the client. Student Chromebooks are managed through MDM, so the CA can be deployed at scale; staff laptops are unmanaged, so deep inspection there will cause certificate warnings and may break pinned applications. Certificate pinning cannot be solved by trusting the FortiGate CA, because the client expects a specific issuer or key. Those domains need SSL exemptions and certificate inspection instead.
Use a pilot group, not a blanket policy. Identify the exact Google domains that fail, add exemptions for those domains, and keep deep inspection for categories that need URL visibility. Test Classroom login, video, and file upload after each change. Review FortiGate SSL inspection logs for certificate errors and exceptions, and document that staff devices without the CA must stay on certificate inspection.