topic Re: HTTP/2 over TLS in Spark Firewall (SMB)

HTTP/2 over TLS

HristoGrigorov — Thu, 14 Nov 2019 07:00:31 GMT

Regarding inspection of HTTP/2 over TLS there is the SK116022 but what do you say? Is it valid for 77.20.87 ? Because I have HTTPS Inspection enabled and it does not look like it is inspecting that kind of traffic.

Re: HTTP/2 over TLS

G_W_Albrecht — Thu, 14 Nov 2019 10:27:34 GMT

I do not think that SK116022 was valid for 77.20.8x SMB appliances. Also, it suggests to either downgrade the traffic to http/1.1 for SSL Inspection or either drop or allow http/2 without SSL inspection. So it seems there currently is no inspection of HTTP/2 over TLS possible...

Re: HTTP/2 over TLS

HristoGrigorov — Thu, 14 Nov 2019 12:35:34 GMT

How do I "downgrade" HTTP/2 to HTTP/1.1 ?

Re: HTTP/2 over TLS

PhoneBoy — Thu, 14 Nov 2019 17:40:14 GMT

Enable HTTPS Inspection.
Otherwise you block it using App Control.

Note that HTTP/2 support is planned for R80.40, not sure when it is planned for SMB.

Re: HTTP/2 over TLS

HristoGrigorov — Thu, 14 Nov 2019 18:12:38 GMT

Hmm, I am a bit confused here. I have HTTPS Inspection enabled and it still logs application name as "HTTP/2 over TLS". Isn't it supposed to recognize the actual app encapsulated inside it ?

Also, what will happen (from user point of view) if I block it?

Re: HTTP/2 over TLS

PhoneBoy — Thu, 14 Nov 2019 19:19:52 GMT

Are you sure you are HTTPS Inspecting the traffic in question?
We don't yet parse inside HTTP/2 over TLS yet.
The browser should be smart enough to realize HTTP/2 over TLS isn't supported and downgrade to HTTP/1.1 if you block it.

Re: HTTP/2 over TLS

HristoGrigorov — Fri, 15 Nov 2019 03:34:01 GMT

Yes, I am sure HTTPS Inspection is in use. But you are most certainly right. It is decrypting but not parsing it inside. I will block it and see what happens. Thank you.

Re: HTTP/2 over TLS

HristoGrigorov — Fri, 15 Nov 2019 05:04:31 GMT

No, Blocking does just that. Blocks it. For the connection to be downgraded to HTTP/1.1, SMB must tell the browser HTTP/2 is not supported for this connection. And it is not doing that. So, that's not an option really. Too bad because HTTP/2 connections are becoming more and more common.

Re: HTTP/2 over TLS

Kaspars_Zibarts — Thu, 09 Sep 2021 07:15:05 GMT

Hi! Want to revive this old topic 🙂 We are running R80.40 T120 and most HTTP/2 logs show no actual resource. HTTPS interception is enabled as per my screenshot. Anyone has had better answers than sk116022?