Encrypted client hello

[Chris3]

Hi 

I saw an update in browsers about websites using encrypted client hello for dns.

apparently protects dns better from isp etc.

Does this make any changes to how Meraki devices work? Filtering etc?

[alemabrahao]

This probably won't change anything since the MX doesn't do SSL inspection.

[PhilipDAth]

If you are referring to DNS over HTTPS, it will:

• Break firewall rules that use FQDN
• Reduce the ability to monitor connections

Personally, I block this traffic, and if the network supports policies (such as Intune, Active Directory), I disable it via policy.

[Chris3]

Thanks guys for the knowledge. I’ll look to adjust. 🙂

[AlexP]

To be explicit here, yes, ECH will pose a problem for some features on MX. Explicitly, Content Filtering relies on being able to see the domain the client is attempting to communicate with, which is contained in the Server Name Information (SNI) field of a TLS header during the initial handshake.

This works just fine for TLS 1.2, and TLS1.3 when ECH is NOT in use, but any extensions to TLS1.3 that obfuscate this information will prevent it from functioning.