# The State Of HTTP/2 Full Proxy With F5 LTM **URL:** \ **Category:** Community CodeShare\ **Tags:** application-delivery\ **Created:** [November 4, 2025, 3:22pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637 "2025-11-04T15:22:18Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Juergen\_Mang](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/juergen_mang/32/12756_2.png) [@Juergen\_Mang](https://community.f5.com/u/Juergen_Mang)\ **Post date:** [November 4, 2025, 3:22pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/1 "2025-11-04T15:22:18Z")
##### Code is community submitted, community supported, and recognized as ‘Use At Your Own Risk’. In this article, I will attempt to summarize the known challenges of an HTTP/2 full proxy setup, point out possible solutions, and document known bugs and incompatibilities. Most major browsers had added HTTP/2 support by the end of 2015. However, I hardly ever see F5 LTM setups with HTTP/2 full proxy configured. The time has come to configure LTM with HTTP/2 as well. I would of course welcome any additions or comments. I will keep this article up-to-date. You can find the changelog at the bottom. ## Why HTTP/2? HTTP/2 is a major improvement over HTTP/1. HTTP/2 decrease latency to improve page loading speed in web browsers by considering header compression and multiplexing requests over a single tcp connection. Accelerate applications is one point that we all want to achieve with an ADC. Speed is important, but security is more important. HTTP/2 offers us more security out of the box by making HTTP Request Smuggling almost impossible. That is the second point that we all want to achieve. Read more about the Desync Endgame: [HTTP/1.1 Must Die](https://http1mustdie.com/) ## How to configure a HTTP/2 Full Proxy Setup Activating HTTP/2 Full Proxy is simple: 1. Configure a ClientSSL and a ServerSSL Profile with disabled renegotiation. SSL Renegotiation is not supported by HTTP/2 and also not for TLS1.3. 2. Configure a client-side and a server-side HTTP/2 Profile, ensure that “Enforce TLS Requirements” is enabled. It is very likely that you must increase the “Number of streams per connection” and “Header table” size settings. 3. Configure the Virtual Server with client-side and server-side SSL profile and HTTP/2 profile and active the “HTTP MRF Router” option. 4. Use a HTTP/2 Monitor for the pools: [K29224049: Overview of the BIG-IP HTTP/2 monitor](https://my.f5.com/manage/s/article/K29224049) With this setup the Virtual Server speaks HTTP/1 and HTTP/2 for client-side and server-side connections. F5 References: - [Configuring HTTP/2 Full-proxy Support on the BIG-IP System](https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-http2-full-proxy-configuration/http2-full-proxy-configuring.html) - [K000133542: HTTP/2 - MRF (Message Routing Framework) Option](https://my.f5.com/manage/s/article/K000133542) ### Some common errors - [K09644974: Configuration checks for HTTP/2 COMPRESSION\_ERROR](https://my.f5.com/manage/s/article/K09644974) - [K000141193: Application fails with ERR\_HTTP2\_PROTOCOL\_ERROR when HTTP2 is enabled on F5 BIG-IP](https://my.f5.com/manage/s/article/K000141193) - [K19447103: BIG-IP system occasionally actively close HTTP2 connection](https://my.f5.com/manage/s/article/K19447103) - [K34767034: Slow uploading/POST performance when HTTP/2 profile is applied](https://my.f5.com/manage/s/article/K34767034) ### Enable stream error logging Not easy to find, because it is only mentioned in a Bug Report. - [Bug ID 701068: HTTP/2 now provides a way to inspect stream reset causes.](https://cdn.f5.com/product/bugtracker/ID701068.html) ## Discovered issues with this setup If everything were working as usual, I wouldn’t have written this article. I tried HTTP/2 the first time with 15.1 and I quickly stopped implementing this for various reasons. I was hoping that a few years later, things would have improved somewhat. F5 itself has a support document with some gotchas: [K95032535: Detecting the use of and troubleshooting HTTP/2 traffic on the BIG-IP](https://my.f5.com/manage/s/article/K95032535) Notable ones for my setups are: - The HTTP/2 protocol is not compatible with NTLM protocols - OneConnect, Hash and SSL session persistence types, and Connection mirroring in High Availability (HA) configurations are not compatible with HTTP/2 in a full-proxy deployment. - [“TLS1.3 only” does not work with HTTP/2](https://cdn.f5.com/product/bugtracker/ID1341093.html) - [K000150589: Incompatibility of HTML Content Profiles with HTTP/2 and MRF Configuration](https://my.f5.com/manage/s/article/K000150589) - [Bug ID 1111377: Request-log profile does not log HTTP version when HTTP2 request comes](https://cdn.f5.com/product/bugtracker/ID1111377.html) ### APM is NOT supported An APM profile can NOT be attached to a Virtual Server with a Full Proxy setup. When I discovered this, I thought it was a bug, but F5 confirmed it. - [K03243344: HTTP MRF Router Option breaks APM virtual server](https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-clientcompatmatrix-16-1-3.html) ### No security for gRPC gRPC uses natively HTTP/2, we can not secure the this protocol with ASM or APM. - [HTTP/2 + ASM + GRPC is not supported](https://my.f5.com/s/article/K000135679) - [Bug ID 1531729: Request-log profile breaks GRPC](https://cdn.f5.com/product/bugtracker/ID1531729.html) ### Websocket Profile not supported You can not attach a Websocket Profile to a HTTP/2 enabled Virtual Server. HTTP/2 and Websocket support are exclusive options. I do not know why this can not be configured, but a Websocket profile is required as soon as you attach an ASM policy. It would be useful to have a single Virtual Server that can handle HTTP/2 connections and Websockets over HTTP/1. There is now a RFE for to support this, the Internal Tracking ID is: RQ-LTM-0002399. F5 References: - [K81313105: HTTP2 and Websocket not working](https://my.f5.com/manage/s/article/K81313105) - [K84421441: WebSocket traffic does not work on a virtual server with transparent security policy without wss profile](https://my.f5.com/manage/s/article/K84421441) ### No possibility to enforce server-side HTTP/2 I have no clue how to enforce server-side HTTP/2 to mitigate the security issues with HTTP/1. However, HTTP/2 is automatically preferred. ### Bot Defense blocks Bot defense blocks traffic with anomaly Invalid HTTP Headers Presence or Order. The root cause is that the headers are all lower case in HTTP/2. - [K58581034: Bot defense blocks traffic with anomaly “Invalid HTTP Headers Presence or Order”](https://my.f5.com/manage/s/article/K58581034) ### Missing iRule Event The “HTTP\_REQUEST\_SEND” event is not triggering in a HTTP/2 full proxy setup and there is no full replacement event for it. You must rewrite your iRules to not use this event. I have not found any documentation about this, but F5 support confirmed this and it will not be fixed. ### ASM unblocking not working A simple “ASM::unblock” throws an error and the connection is reset. F5 support confirmed that this is a bug. - [Bug ID 1196505: BIG-IP might RST HTTP2 connection with F5RST:mrhttp\_proxy bad transition when ASM is in use](https://cdn.f5.com/product/bugtracker/ID1196505.html) ### iRule Variable Scope issues Kai has discovered this issue some time ago: [Dealing with iRule $variables for HTTP2 workload while HTTP MRF Router is enabled](https://community.f5.com/topic/306626) F5 References: - [K24532424: HTTP/2 full proxy iRule local variable scope](https://my.f5.com/manage/s/article/K24532424) I opened a support call to clarify the observations and point out the desired behavior and there is a bug or not. The outcome was that a variable set in the HTTP\_REQUEST event should never been seen in the server side events like SERVER\_CONNECTED. That this is working if you not set a variable in the CLIENT\_ACCEPTED event is the bug. We have the same variable scope for client-side and server-side of the tcp connection. Events like CLIENT\_ACCEPTED, CLIENTSSL\_CLIENTHELO and SERVER\_CONNECTED are sharing the scope. We have then for each HTTP/2 stream another variable scope that is a carbon copy of the parent tcp connection scope. Events like HTTP\_REQUEST and HTTP\_RESPONSE\_RELEASE are sharing this scope. At time of writing I found no workaround for this problem and F5 engineering is working on this case. F5 Internal Bug ID is: 2064069 ## Conclusion I’m sorry to say this, but I can not recommend a HTTP/2 Full Proxy setup. There are far too many bugs and not supported features in the HTTP/2 Full Proxy implementation. ## Changelog - **Update 2026-03-11** - Bug ID 1111377 (Thanks ​Alexandre) - **Update 2026-03-10** - RFE for Websocket Profile (Thanks Alexandre) - **Update 2026-02-25** - Add Bug ID for iRule Variable Scope Issues - **Update 2026-01-29** - No APM Profile can be attached (Discovered by Kai) - GRPC is not supported (Discovered by Nikoolayy1) - TLS1.3 only is not supported (Discovered by Nikoolayy1) - Stream error debugging - **Update 2026-02-02** - gRPC section (Hint from F5 Support) - HTML Content Profile (Hint from F5 Support) ---
**Author:** ![Daniel\_Wolf](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/daniel_wolf/32/1119_2.png) [@Daniel\_Wolf](https://community.f5.com/u/Daniel_Wolf)\ **Post date:** [November 5, 2025, 6:00pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/2 "2025-11-05T18:00:38Z")
Excellent summary of where we are at with HTTP/2 the moment. ---
**Author:** ![svs](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/svs/32/4755_2.png) [@svs](https://community.f5.com/u/svs)\ **Post date:** [December 8, 2025, 12:06pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/3 "2025-12-08T12:06:42Z")
Hey Juergen, thanks for this great article! 👍 You can add [Bug ID 1196505](https://cdn.f5.com/product/bugtracker/ID1196505.html) (see [BIG-IP 17.5.1.3 Fixes and Known Issues | BIG-IP Documentation](https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/relnote-supplement-bigip-17-5-1-3.html#A1196505-2)) to the list of known issues as well, which makes Full-Stack HTTP/2 almost unusable in many environments. 😒 Hit me today and feels like a little snitch: Reset on the server-side, without releasing the request on the client-side. ASM logs even report the response status code. 😵 Greetings, Sven ---
**Author:** ![Nikoolayy1](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nikoolayy1/32/3589_2.png) [@Nikoolayy1](https://community.f5.com/u/Nikoolayy1)\ **Post date:** [December 8, 2025, 7:33pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/4 "2025-12-08T19:33:26Z")
F5 needs to work on AWAF with HTTP/2 for 21.x hopefully as  [https://my.f5.com/s/article/K000135679](https://my.f5.com/s/article/K000135679) gRPC is also not supported on HTTP/2 but Nginx App Protect WAF that is again the bd process as BIG-IP AWAF supports it and I find that strange. ---
**Author:** ![Juergen\_Mang](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/juergen_mang/32/12756_2.png) [@Juergen\_Mang](https://community.f5.com/u/Juergen_Mang)\ **Post date:** [December 9, 2025, 8:18am UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/5 "2025-12-09T08:18:04Z")
Hi Sven, I discovered this Bug already in the combination with the ASM::unblock in iRules. The known issues list is terrifying long… ---
**Author:** ![svs](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/svs/32/4755_2.png) [@svs](https://community.f5.com/u/svs)\ **Post date:** [December 9, 2025, 8:35am UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/6 "2025-12-09T08:35:54Z")
Ah…sorry. I’ve overseen this reference. But at least I found it outside of iRules. 😄 > However, I hardly ever see F5 LTM setups with HTTP/2 full proxy configured. Maybe because of the _terrifying long list of known issues_ or bad experience 😉. I’ve never had good results with HTTP/2, neither measurable nor felt. Either because of buggy HTTP/2 configuration in the backend or because of the perceived lack of support on the BIG-IP or known issues… ---
**Author:** ![Juergen\_Mang](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/juergen_mang/32/12756_2.png) [@Juergen\_Mang](https://community.f5.com/u/Juergen_Mang)\ **Post date:** [December 10, 2025, 7:45am UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/7 "2025-12-10T07:45:28Z")
> Ah…sorry. I’ve overseen this reference. But at least I found it outside of iRules. This makes it even worse. I hope this article will encourage F5 to prioritize addressing the issues with HTTP/2. In any case, I would prefer to see the known issues list worked through rather than new features being introduced. ---
**Author:** ![Nikoolayy1](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nikoolayy1/32/3589_2.png) [@Nikoolayy1](https://community.f5.com/u/Nikoolayy1)\ **Post date:** [January 23, 2026, 11:54am UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/8 "2026-01-23T11:54:31Z")
To add to this wonderful list @Juergen_Mang TLS1.3 with HTTP/2 has issues [https://cdn.f5.com/product/bugtracker/ID1341093.html](https://cdn.f5.com/product/bugtracker/ID1341093.html)  and [https://my.f5.com/manage/s/article/K000137705](https://my.f5.com/manage/s/article/K000137705) ---
**Author:** ![Juergen\_Mang](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/juergen_mang/32/12756_2.png) [@Juergen\_Mang](https://community.f5.com/u/Juergen_Mang)\ **Post date:** [January 23, 2026, 2:01pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/9 "2026-01-23T14:01:18Z")
Do I read it correctly? “TLS1.3 only” does not work with HTTP/2? ---
**Author:** ![Juergen\_Mang](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/juergen_mang/32/12756_2.png) [@Juergen\_Mang](https://community.f5.com/u/Juergen_Mang)\ **Post date:** [January 29, 2026, 11:56am UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/10 "2026-01-29T11:56:51Z")
An updated article is coming soon, it requires only the approval. ---
**Author:** ![Nikoolayy1](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nikoolayy1/32/3589_2.png) [@Nikoolayy1](https://community.f5.com/u/Nikoolayy1)\ **Post date:** [January 29, 2026, 2:08pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/11 "2026-01-29T14:08:43Z")
@Juergen_Mang   Still no official statement from F5 but from what I get TLS1..3 does not work with HTTP/2 and I tested TLS1.2 cipher group with “ECDHE-RSA-AES256-GCM-SHA384/TLS1.2, DTLS1.2” and I got again the error “profile ‘/Common/tls-1-2-tes’; cipher ECDHE-RSA-AES128-GCM-SHA256 must be available”. This suggests that TLS1.2 is with limited support for HTTP/2  as well​❓ ---
**Author:** ![Juergen\_Mang](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/juergen_mang/32/12756_2.png) [@Juergen\_Mang](https://community.f5.com/u/Juergen_Mang)\ **Post date:** [January 29, 2026, 2:14pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/12 "2026-01-29T14:14:56Z")
@Nikoolayy1 I am curious, let me test in my lab setup. Changed my Cipher group to: ![image_345264.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/a/2/a2a51876053ace7bb52c747d6cd660fcf20551f8.png) And I get this error (the same as you?) ![image_345264.png](https://d20hrnpixdzcsd.cloudfront.net/optimized/3X/3/b/3b4421d4214946cfcf1ffc7dc6669b64d41dd1ae_2_690x42.png) Also disables TLS1.2 with the options in the ssl client profile does not work. It seems TLS1.2 is required for HTTP/2 Full Proxy Setups. Enabling only TLS1.2 and disable all other versions works. As far I know the RFC says: Implementations of HTTP/2 MUST use TLS version 1.2 [TLS12] **or higher** for HTTP/2 over TLS. ---
**Author:** ![Nikoolayy1](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nikoolayy1/32/3589_2.png) [@Nikoolayy1](https://community.f5.com/u/Nikoolayy1)\ **Post date:** [January 29, 2026, 3:30pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/13 "2026-01-29T15:30:39Z")
Yes TLS1.2 but only with specific ciphers it seems to me and no TLS1.3 actually. Also the same errors for serverside TLS as it is not the clientside only. ---
**Author:** ![Juergen\_Mang](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/juergen_mang/32/12756_2.png) [@Juergen\_Mang](https://community.f5.com/u/Juergen_Mang)\ **Post date:** [February 2, 2026, 7:03am UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/14 "2026-02-02T07:03:27Z")
Added some further limitations after contact with F5 support. ---
**Author:** ![Nikoolayy1](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nikoolayy1/32/3589_2.png) [@Nikoolayy1](https://community.f5.com/u/Nikoolayy1)\ **Post date:** [April 2, 2026, 2:38pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/15 "2026-04-02T14:38:36Z")
Short update HTTP/2 with TLS1.3 only is supported by some F5 vodo cipher rules magic and they will fix it in 21.1 as to not have to use the Voodoo magic. Other than that [Bug ID 1196505](https://cdn.f5.com/product/bugtracker/ID1196505.html) should be solved in 21.2. We are getting at a working TLS1.3 with HTTP/2 and AWAF/ASM. ---
**Author:** ![Juergen\_Mang](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/juergen_mang/32/12756_2.png) [@Juergen\_Mang](https://community.f5.com/u/Juergen_Mang)\ **Post date:** [August 28, 2026, 6:10pm UTC](https://community.f5.com/t/the-state-of-http-2-full-proxy-with-f5-ltm/76637/16 "2026-08-28T18:10:31Z")
@Nikoolayy1 Have you tested 21.1?