For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

flalar's avatar
flalar
Icon for Altocumulus rankAltocumulus
Jan 20, 2020

Are the HTTP/2 profile defaults sound?

The current default for the HTTP/2 profile has a Concurrent Streams Per Connection default of 10. This seems a bit conservative. IETF recommended that this value being no smaller than 100, so as to n...
application delivery
BIG-IP
http2
LTM
performance
tuning
Rodrigo_Albuque's avatar
Rodrigo_Albuque
Icon for Cirrocumulus rankCirrocumulus
Jan 22, 2020

Hi Flalar

 

Short answer: No, performance-wise 10 concurrent connections are too little. I'd definitely set it to 100+.

 

F5 is already aware of this and there's an RFE tracked by ID 848545 internally that suggests such changes to comply with RFC's recommendation but at the moment there's no target version so I believe we should still see the default of 10 for a while.

 

I believe we should eventually move the default settings to 100 and that makes the most of HTTP/2 parallelism. I don't see any downside from increasing number of concurrent connections. However, In the event of an attack, for example, in scenarios such as H2/H1 (HTTP/2 Gateway), an attacker could potentially be able to exhaust BIG-IP resources faster. 

flalar's avatar
flalar
Icon for Altocumulus rankAltocumulus
Jan 23, 2020

Thank you for you reply . Based on what you are writing, we interpret that increasing concurrent streams per connection is recommended for increased user performance and that this has also been done during product testing by F5.

If so we will go forward with increasing concurrent streams in steps of 25, 50, 75, 100 to ensure we don't hit any limits in the appliance or anything like that.