# Configuring QUIC or HTTP/3 inspection settings

##

## Steps

1. Configure the QUIC and HTTP/3 settings on the Security Engine. For details, refer to the Configuring QUIC and HTTP/3 settings on the Security Engine topic.
2. Add an access rule to engine policy to allow QUIC or HTTP/3 web traffic. The following are some example rules for QUIC or HTTP/3 web traffic:
   - Access rules when configuring QUIC inspection:

     Table 1.
     Source | Destination | Service | Action
     --- | --- | --- | ---
     ANY | ANY | HTTP HTTPS QUIC | Allow Deep inspection: on File Filtering: off Decryption: disallowed Snort: off

   - Access rules when configuring HTTP/3 inspection:

     Table 2.
     Source | Destination | Service | Action
     --- | --- | --- | ---
     ANY | ANY | HTTP HTTPS QUIC | Allow Deep inspection: on File Filtering: on Decryption: allowed Snort: off

3. In the UDP / QUIC Service Properties dialog box, configure the following settings:
   - Discard HTTP/3 if TLS inspection is required by access policy: Select the Default option. For more information, refer to the Protocol Parameters tab, when Protocol is QUIC table in the Create custom Service elements topic.
     Note: Select the Default option unless a rule-specific exception is required for this setting.
   - HTTPS Inspection Exceptions: Select the domains that must not be decrypted. For more information, refer to the Exclude domains from inspection of HTTPS traffic topic.
   - Logging of Accessed URLs: Select one of the following options:
     - Yes — An HTTP_URL-Logged situation including the URL is logged for each HTTP/3 request.
     - No — HTTP_URL-Logged situations are not logged.
4. In the TCP / HTTPs Service Properties dialog box for the Strip QUIC support from server replies option, select one of the following:

   For details, refer to the Protocol Parameters tab, when Protocol is HTTP or HTTPS table in the Create custom Service elements topic.

   - Yes — HTTP header that indicates the server support for HTTP3/QUIC is stripped away. This way clients typically end up using HTTP/2 instead of HTTP/3.
   - No — HTTP header that indicates the server support for HTTP3/QUIC is not stripped away. When configuring QUIC or HTTP/3 inspection this option must be selected to make clients aware that HTTP/3 can be used.
   Note:
   - Setting the Strip QUIC support from server replies option to Yes can be used when decryption of the traffic in general is desired, but decryption of HTTP/3 traffic is not desired.
   - While creating a new custom Network Application, URL Category Application or URL List Application, if QUIC is selected in the Protocol list, access rules that include URL lists, URL categories, and Network Applications will inspect the QUIC or HTTP/3 traffic in a similar manner to how they handle the HTTP/2 and HTTP/1.1 traffic.
5. Save and refresh the policy.