Quick Links:
Avi as a Load Balancer supports connections via HTTP2. This is an option on our Virtual Services which can be enabled.
Once enabled, Avi can be attacked via the CVE-2023-44487, but has by default the following protections in place.
Avi is protected from HTTP/2 attack by configuring the following parameters in the HTTP Application profile of the Virtual Service:
max_http2_concurrent_streams_per_connection
Maximum number of concurrent streams over a client side HTTP/2 connection.
Default Value: 128
The recommended setting is to keep it at 128 concurrent streams per connection.
max_http2_requests_per_connection
Maximum number of requests over a client side HTTP/2 connection.
Default Value: 1000
The recommended setting is to keep it at 1000 requests.
To learn more about the configuration of these settings, see HTTP/2 Support on NSX Advanced Load Balancer.