Chrome allowing some users to bypass web filter

Question

Hello! 
 We recently installed a XG210 onsite and have been learning on the fly, so forgive me if this is something obvious. 
 In our Web Filter policy we have it set to block Video Hosting and Video Streaming sites. This filter is used in multiple firewall policies. It appears though that some users (myself included) are able to still visit www.youtube.com and view the site/videos as if the filter wasn't in place, but only in Chrome. In IE, Firefox and even a Chrome Incognito window the site is blocked. I've look at the live connections and I can see the connections to youtube.com but the Log Viewer does not show any Web Filter logs for youtube.com for users that are able to view it still. 
 I've tried a lot of things but I can't figure it out. Does anyone have any good next steps I can try? 
 Thanks! 
 Devon 
 
 EDIT1: Version 15.01.0 MR3

Aditya Patel · Accepted Answer

sHI DevonNoonan , I have my doubts on the history existed and the connection was no deleted from XG appliance To check the connections in your network console > system diagnostics utilities connections v4 show src_ip Note : The firewall rule would block new connections and would not interfere with existing connections . So even with HTTP Decrytion enabled , it would resume its connection with an existing connection . As per the policy configuration, you have added a Schedule on the Video Hosting sites and So that system might have resumed an existing connection with the same session ID. Could you test by deleting the connection during the Scheduled time by using the command Console>system diagnostics utilities connections v4 delete src_ip I would like to add an information , Youtube/ Google/apps related to google uses QUIC protocol that would operate on UDP : 443 and is applicable to Google Chrome. If you use any other browser then the connection would work on TCP : 443. I would suggest you to create a Rule to Drop UDP: 443 . So the sessions would be diverted to TCP 443 . Thanks and Regards Aditya Patel | Network and Security Engineer.

Billybob · Answer

You can create a UDP HTTPs definition and then create a policy to drop udp 443 traffic. Make sure that the blocking policy is applied BEFORE the allowed policy. I am using v16 so my screen may look different.

On a side note, its generally considered good practice to ONLY ALLOW PROTOCOLS that you need and not use ANY ANY firewall policies.