For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

KaiTT's avatar
KaiTT
Icon for Nimbostratus rankNimbostratus
Apr 20, 2023

http/2 configuration

Hi All, We are providing LTM service by configuring BIG-IP as below. (This is not a typical configuration)                       BIG-IP creates two connections. 1) Client <-------...
application delivery
KaiTT's avatar
KaiTT
Icon for Nimbostratus rankNimbostratus
Apr 20, 2023

Hi,

http/2 profile has not been applied yet.

We found something unusual during the review before applying the configuration.

 

2) WAF <---------------> BIG-IP <-------------> Leaf

 

In this flow, the client is WAF.

Client Hello does not include ALPN because it is not a typical web browser.

Is it correct to not be able to use http/2 in an environment where ALPN is not included in Client Hello due to topology singularity?

 

Thanks.

 

  • Michael_Saleem's avatar
    Michael_Saleem
    Icon for MVP rankMVP
    Apr 20, 2023

    I would say that you're correct. From what you describe, the WAF is acting as a reverse proxy. The limitation is on the WAF and not the BIG-IP.

    If the WAF cannot proxy the ALPN extension, then you are going to have HTTP/1.1 on connection 2). I'm not sure if there is any way around this. Maybe the WAF software can be upgraded to support this? I'm assuming the WAF is different vendor hardware?