Troubleshooting HTTP/2 traffic and inspection behavior in Cloud SWG

Products

Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Use this article to troubleshoot scenarios where HTTP/2 traffic is inspected unexpectedly or fails to load in Cloud SWG (formerly WSS).

Symptoms

Traffic logs show x-symc-inspection as INSPECTED despite destination-based bypass policies.
Custom categories for "Do Not Intercept" are ignored for HTTP/2 transactions.
Browser shows ERR_HTTP2_PROTOCOL_ERROR.

Environment

Product: Cloud Secure Web Gateway (Cloud SWG)
Management: Portal-managed or Universal Policy Enforcement (UPE)
Protocol: HTTP/2 (cs-version: HTTP/2)

Cause

In Cloud SWG, HTTP/2 is only supported when TLS/SSL Interception is enabled. If a client and server negotiate HTTP/2 via ALPN, the proxy must intercept the session to participate in the HTTP/2 stream. If SSL Interception is bypassed, the connection may revert to HTTP/1.1 or fail if the site strictly requires HTTP/2 features.

Resolution

Collect data:

Depending on whether you manage WSS policy with UPE (Management Center) or from the WSS Portal, you can disable HTTP/2 in one of the following ways:

(A) UPE: Disable SSL Inspection (disable HTTP/2 for a specific website)

With UPE-managed policy:

Create a CPL layer
Add this CPL policy (this will disable SSL interception):

#if enforcement=wss
<ssl-intercept>
url.domain="testsite.com" ssl.forward_proxy(no)
#endif

(B) UPE: Disable HTTP/2 (downgrade the connections to HTTP/1.1)

With UPE-managed policy:

Create a CPL layer
Add this CPL policy (SSL interception still works):

#if enforcement=wss
<proxy>
client.connection.ssl_server_name.substring=testsite.com http2.client.accept(no) http2.server.request(no)
#endif

(C) Portal: Disable SSL Inspection (disable HTTP/2 for a specific website)

With Cloud SWG (formerly known as WSS) Portal-managed policy:

Add an SSL interception bypass rule for the domain:

WSS Portal: Policy
->TLS / SSL Interception
-> TLS / SSL Interception Policy
-> Add rule where 'Destination' is the problem domain and 'Verdict' is 'Do not intercept'

(D) Portal: Disable HTTP/2 (downgrade the connections to HTTP/1.1)

With Cloud SWG (formerly known as WSS) Portal-managed policy: If SSL interception bypass is not feasible and you want to keep the SSL interception enable for the domain

To disable HTTP2 for specific domain open a case with Broadcom technical support team via the Broadcom Support Portal.

Additional Information

To validate whether the issue is related to the HTTP/2 protocol or not, disable HTTP/2 from the browser side.

If you suspect that HTTP/2 is the source of the problem, run Chrome with HTTP/2 disabled using the command below, confirm that all requests are sent with HTTP/1.1 (Developer tool HAR file) and that all works as expected.

C:\Program Files (x86)\Google\Chrome\Application> chrome.exe --disable-http2