Description
This article describes feature to support HTTP/2 in FortiOS proxy mode.
Related document.
https://docs.fortinet.com/document/fortigate/7.0.0/new-features/710924/http-2-support-in-proxy-mode-...
Solution
Starting from FortiOS 7.0, HTTP/2 is supported in proxy mode with condition the traffic is secured by TLS 1.2 or 1.3.
This is being achieved by using the Application-Layer Protocol Negotiation (ALPN) extension.
The configuration can be done in command line interface:
To set the ALPN support.
# config firewall ssl-ssh-profile
edit <profile>
set supported-alpn {all | http1-1 | http2 | none}
next
end
However, it needs to be taken notes that HTTP/2 with plain text is not supported yet in FortiOS proxy mode.
Hence, it might not work correctly if HTTP/2 unencrypted traffic is sent to process by FortiOS in proxy mode.
