Technical Tip: FortiOS unencrypted/encrypted HTTP/2 support in proxy

Description
This article describes feature to support HTTP/2 in FortiOS proxy mode.

Related document.
https://docs.fortinet.com/document/fortigate/7.0.0/new-features/710924/http-2-support-in-proxy-mode-ssl-inspection
Solution

Starting from FortiOS 7.0, HTTP/2 is supported in proxy mode with condition the traffic is secured by TLS 1.2 or 1.3.

 

This is being achieved by using the Application-Layer Protocol Negotiation (ALPN) extension.

 

The configuration can be done in command line interface:

 

To set the ALPN support.

 

# config firewall ssl-ssh-profile

    edit <profile>

set supported-alpn {all | http1-1 | http2 | none}

    next

end

 

However, it needs to be taken notes that HTTP/2 with plain text is not supported yet in FortiOS proxy mode. 

Hence, it might not work correctly if HTTP/2 unencrypted traffic is sent to process by FortiOS in proxy mode.