Forum Discussion

pcourtois's avatar
pcourtois
Icon for Altocumulus rankAltocumulus
Aug 28, 2024

F5 AWAF with HTTP/2, MRF and Websocket profiles

Good day all,

 

I have F5 Big-IP AWAF's (version 16.1.4.3) and I am trying to configure HTTP/2 with MRF.  My colleague and I discovered that Websocket profiles on the Virtual Server don't play well when enabling MRF.  Is there a way to enable a "hybrid" configuration using websocket and HTTP/2 with MRF?  

I value and appreciate your time and energy and look forward to hearing from you.  Thank you.  

 

application delivery
http2
mrf
websocket
    • pcourtois's avatar
      pcourtois
      Icon for Altocumulus rankAltocumulus
      Aug 31, 2024

      Much appreciated.  Thank you for the suggestion and link.  I'll look into this.  

  • zamroni777's avatar
    zamroni777
    Icon for Nacreous rankNacreous
    Aug 29, 2024

    i suggest avoid mrf for now and simply use regular ltm based http and websocket profiles.
    based on some mrf docs, it seems it was created for sip voip traffic.

    i had mrf trial for diameter billing traffic last year but mrf couldn't do several basic things that regular ltm profile can e.g.:
    ratio load balancing doesnt work, pool member's health status is ignored by mrf, mrf vserver status remains unknown, etc.

    • pcourtois's avatar
      pcourtois
      Icon for Altocumulus rankAltocumulus
      Aug 31, 2024

      Thank you for the response.  This helps a ton.  Strange however, that F5 documentation states HTTP/2 requires MRF.  Confusing.  Thanks again.  

      • zamroni777's avatar
        zamroni777
        Icon for Nacreous rankNacreous
        Sep 04, 2024

        https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-http2-full-proxy-configuration/http2-full-proxy-configuring.html#concept-2621

        considering that server side http/2 makes oneconnect unusable,
        i'd rather have http/1.1 on server side.

        in live traffic, the simultaneous loading features of http/2 is usually useful to load mutiple static contents (js, css and images).
        meanwhile dynamic contents (login transaction, load user profile, etc.) mostly still happens sequentially.

        hence, if caching static contents is enabled in ltm vserver,
        then f5 barely needs to send simultaneous requests from a client session.

        there are multiple dynamic content load from multiple client sessions in which oneconnect does tcp multiplexing
        f5 and servers also connect via datacenter wired lan, so transport latency is under 1ms.