ChatGPT / HTTP2 parsing error / HTTPS Inspection

[JPR]

Hi all,

I experience frequent loading issues on e.g. chatgpt.com.

When starting a session it usually goes fine for the first couple of prompts, but at some point the session stops and just hangs like seen below:

I get the following logs on the gateway (R82 Take 60):

Whenever I disable HTTPS Inspection for ChatGPT it works fine.

I've stumbled upon the following SK: https://support.checkpoint.com/results/sk/sk181070

But I can't really say if it's related.

Do any of you have an idea as to why I get the HTTP2 parsing error? And what might be the solution?

Best regards,

Jesper, Denmark

[zaoar]

Hi,

i have exactly the same issue. 

Did you find a solution?

Regards,

Aris

[tankp]

Please check the two limitations in https://support.checkpoint.com/results/sk/sk116022

1. The "Strict Hold" feature is enabled on the Security Gateway in the $FWDIR/conf/malware_config file (sk183840).
2. The ICAP Server is enabled in the Security Gateway object.

[Machine_Head]

Having the same issue in R1.20 JHF128. 

Strict hold or icap server not enabled.

[Lau]

I had the same problem at a customer and it was similar for Claude and Harvey. Sometimes working slow, most of the time not working at all. Was working fine on R82 JHF take 41. Experienced the issues on take 60. Went away when patched with take 91.

[zaoar]

still having the same issue on R81.20 take 127 .

The only workaround that works for me is forcing the browsers to use HTTP1.1

It feels like its related to the size of the header. maybe it hits some inspection limit or something.

Regards,

Aris

[Jerold_Schlamow]

I am not sure if this will help, but I have found sk181070 - ChatGPT does not work when HTTPS Inspection is enabled

[ItsTheFirewall]

Having the same issue. Please let us know if anyone finds a solution.

[Jerold_Schlamow]

I have also found sk180257-HTTP/2 websites do not work when the Strict Hold feature is enabled on a Security Gateway

https://support.checkpoint.com/results/sk/sk180257

It appears to be a limitation and expected behavior with "Strict Hold" and HTTP/2 websites. The only solution is to create a bypass rule or disable "Strict Hold"