Encrypted client hello

Chris3
Here to help

Encrypted client hello

Hi 

I saw an update in browsers about websites using encrypted client hello for dns.

apparently protects dns better from isp etc.

 

Does this make any changes to how Meraki devices work? Filtering etc?

4 Replies 4
alemabrahao
Kind of a big deal
Kind of a big deal

This probably won't change anything since the MX doesn't do SSL inspection.

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.
PhilipDAth
Kind of a big deal
Kind of a big deal

If you are referring to DNS over HTTPS, it will:

  • Break firewall rules that use FQDN
  • Reduce the ability to monitor connections

Personally, I block this traffic, and if the network supports policies (such as Intune, Active Directory), I disable it via policy.

Chris3
Here to help

Thanks guys for the knowledge. I’ll look to adjust. 🙂

AlexP
Meraki Employee
Meraki Employee

To be explicit here, yes, ECH will pose a problem for some features on MX. Explicitly, Content Filtering relies on being able to see the domain the client is attempting to communicate with, which is contained in the Server Name Information (SNI) field of a TLS header during the initial handshake.

 

This works just fine for TLS 1.2, and TLS1.3 when ECH is NOT in use, but any extensions to TLS1.3 that obfuscate this information will prevent it from functioning.

Get notified when there are additional replies to this discussion.