For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

pcourtois's avatar
pcourtois
Icon for Cirrus rankCirrus
Aug 28, 2024

F5 AWAF with HTTP/2, MRF and Websocket profiles

Good day all,   I have F5 Big-IP AWAF's (version 16.1.4.3) and I am trying to configure HTTP/2 with MRF.  My colleague and I discovered that Websocket profiles on the Virtual Server don't play well...
application delivery
http2
mrf
websocket
pcourtois's avatar
pcourtois
Icon for Cirrus rankCirrus
Aug 31, 2024

Thank you for the response.  This helps a ton.  Strange however, that F5 documentation states HTTP/2 requires MRF.  Confusing.  Thanks again.  

zamroni777's avatar
zamroni777
Icon for MVP rankMVP
Sep 04, 2024

https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-http2-full-proxy-configuration/http2-full-proxy-configuring.html#concept-2621

considering that server side http/2 makes oneconnect unusable,
i'd rather have http/1.1 on server side.

in live traffic, the simultaneous loading features of http/2 is usually useful to load mutiple static contents (js, css and images).
meanwhile dynamic contents (login transaction, load user profile, etc.) mostly still happens sequentially.

hence, if caching static contents is enabled in ltm vserver,
then f5 barely needs to send simultaneous requests from a client session.

there are multiple dynamic content load from multiple client sessions in which oneconnect does tcp multiplexing
f5 and servers also connect via datacenter wired lan, so transport latency is under 1ms.