HTTP/2 Inspection: Support for Cleartext HTTP/2 Traffic
Cleartext HTTP/2 Inspection Overview
Cleartext (plaintext) HTTP/2 inspection allows the system to analyze unencrypted HTTP/2 traffic. It recognizes an HTTP/2 connection early, manages it as a single TCP connection, and tracks each HTTP/2 stream independently. The system performs Layer 7 inspection and policy enforcement on each stream, enabling granular visibility and control of individual transactions within the same connection.
The following features are supported with cleartext HTTP/2, with the same behavior as with encrypted HTTP/2:
- Firewall authentication works with HTTP/2 traffic.
- Web authentication via HTTPD supports HTTP/2.
- UserFW can redirect HTTP/2 users to auth pages or allow pass-through.
- General UserFW (user-based policies, identity) works with HTTP/2.
- URL and web filtering policies are enforced on HTTP/2 flows.
- Content filtering (example: file types, keywords) works with HTTP/2.
- Transparent and explicit proxy modes support HTTP/2.
- JDPI correctly classifies HTTP/2 at both the connection level and the stream level.
- Works with both unified and non‑unified security policy models.
- Benefits of Clear-Text HTTP/2 Inspection
- How Clear-Text HTTP/2 Inspection Works
- Dependency on Application Identification
Benefits of Clear-Text HTTP/2 Inspection
-
Extends Layer 7 controls to cleartext HTTP/2, enabling the application of the same Web filtering, content inspection, authentication, and anomaly detection policies used for encrypted HTTP/2 traffic.
-
Preserves stream-level enforcement by inspecting each HTTP/2 stream independently, even when multiple concurrent requests share one TCP connection.
-
Improves policy consistency across encrypted and cleartext HTTP/2 by using the same inspection pipeline and decision points.
How Clear-Text HTTP/2 Inspection Works
When cleartext HTTP/2 inspection is turned on, the security device looks at cleartext TCP connections to see if they might be using HTTP/2. If they are, it can treat them like HTTP traffic and inspect them.
- At the start of a new TCP session, the system checks the first data packet.
- It looks for the HTTP/2 client connection preface (a specific sequence that
all HTTP/2 clients send first).
- If this preface is present in the first packet, the system classifies the flow as clear-text HTTP/2 and HTTP/2 inspection is enabled for that connection.
- If the preface is not in the first packet: The system assumes it is not clear-text HTTP/2 and the traffic is forwarded without HTTP/2 per-stream inspection.
Once HTTP/2 is identified, the system treats the TCP connection as a single HTTP/2 session.
HTTP/2 traffic consists of multiple independent streams, each identified by a unique stream ID. The system uses these stream IDs to distinguish and track individual HTTP transactions within the same connection. A new stream is typically identified when the first HEADERS frame for that stream is observed.
For each stream, the system performs Layer 7 inspection and policy evaluation on the corresponding request and response. After inspection, permitted traffic and any service-driven modifications are forwarded while maintaining the HTTP/2 protocol structure.
See HTTP/2 Protocol for details on HTTP/2 potocol.
Dependency on Application Identification
Cleartext HTTP/2 inspection also depends on application identification. If HTTP/2 application identification is disabled, the system does not engage HTTP/2 proxy processing. As a result, HTTP/2 inspection does not occur for either encrypted HTTP/2 or cleartext HTTP/2 traffic.
Configuration and Operational Verification
- Enable Clear-Text HTTP/2
- Disable HTTP/2 Application Identification
- Verify Enablement and Status
- Monitor Clear-Text HTTP/2
Enable Clear-Text HTTP/2
HTTP/2 cleartext processing is not supported by default. Following configuration is needed to enable the functionality.
[edit] user@host# set security application-services http2 plain-text
In addition, you must also set HTTP/2 on in SSL proxy global configuration as shown in following command:
[edit] user@host# set services ssl proxy global config http2 on
Disable HTTP/2 Application Identification
Disable HTTP/2 application identification. This configuration prevents HTTP/2 proxy processing and blocks cleartext HTTP/2 inspection):
user@host> request services application-identification application disable junos:HTTP2
Application cache behavior remains unchanged.
Verify Enablement and Status
Enter the following command to verify cleartext HTTP/2 status:
user@host> show security application-services status HTTP Proxy status: Encrypted HTTP2: Enabled/Disabled Plain-text HTTP2: Enabled/Disabled Bypass services: No Push streams: Disabled RFC 7540 priorities: Disabled Compression: Enabled Max concurrent streams: 10 Max header table size: 4096 Initial window size: 65535 Maximum header size: 8192 Trace options: Enabled
The command output displays the status, enabled features, and key protocol limits of HTTP proxy services running on the device including:
Encrypted HTTP2: Indicates whether HTTP/2 over TLS (HTTPS) is enabled or disabled.Plain-text HTTP2: Indicates whether clear‑text HTTP/2 is enabled or disabled.
Monitor Clear-Text HTTP/2
Enter the following command to monitor cleartext HTTP/2 status:
user@host> show security application-services monitoring
FPC 0
PIC 0
Current session HTTP2 parent: 0
Current session HTTP2 child: 0
Current plaint text session HTTP2 parent: 0
Current plain text session HTTP2 child: 0
Total HTTP2 Session Creation Per Second (for last 96 seconds on average): 0
HTTP2 Parent Session Creation Per Second (for last 96 seconds on average): 0
HTTP2 Child Session Creation Per Second (for last 96 seconds on average): 0
Total HTTP2 plain text Session Creation Per Second (for last 96 seconds on average): 0
HTTP2 plain text Parent Session Creation Per Second (for last 96 seconds on average): 0
HTTP2 plain text Child Session Creation Per Second (for last 96 seconds on average): 0
The command output shows details for HTTP/2 application‑service sessions including:
Current session HTTP2 parent: Number of active encrypted HTTP/2 connection‑level sessionsCurrent session HTTP2 child: Number of active encrypted HTTP/2 stream‑level sessions.Current plaint text session HTTP2 parent: Number of active clear‑text HTTP/2 connection-level sessions.Current plain text session HTTP2 child: Number of active clear‑text HTTP/2 stream sessions.
Troubleshooting Cleartext HTTP/2
If cleartext HTTP/2 traffic is not processed as expected, use the following steps to verify status, monitor behavior, and disable the feature if required.
- Verify Is HTTP/2 is Enabled.
- Monitor HTTP/2 Sessions and Activity
- Disable Clear-Text HTTP/2 (for Isolation)
- Check HTTP/2 Session Logging
Verify Is HTTP/2 is Enabled.
Check whether cleartext HTTP/2 is enabled using the show security
application-services status command.
The command displays the following output:
user@host> show security application-services status HTTP Proxy status: Encrypted HTTP2: Enabled/Disabled Plain-text HTTP2: Enabled/Disabled Bypass services: No Push streams: Disabled RFC 7540 priorities: Disabled Compression: Enabled Max concurrent streams: 10 Max header table size: 4096 Initial window size: 65535 Maximum header size: 8192
Look for:
- Plain-text HTTP2: Enabled/Disabled
- Encrypted HTTP2: Enabled/Disabled
Monitor HTTP/2 Sessions and Activity
Use the show security application-services monitoring
command to verify whether HTTP/2 traffic is being processed:
user@host> show security application-services monitoring
FPC 0
PIC 0
Current session HTTP2 parent: 0
Current session HTTP2 child : 0
Current session Plaintext HTTP2 parent: 0
Current session Plaintext HTTP2 child : 0
Total HTTP2 Session Creation Per Second (for last 96 seconds on average): 0
HTTP2 Parent Session Creation Per Second (for last 96 seconds on average): 0
HTTP2 Child Session Creation Per Second (for last 96 seconds on average): 0
Total HTTP2 Plaintext Session Creation Per Second (for last 96 seconds on average): 0
HTTP2 Parent Plaintext Session Creation Per Second (for last 96 seconds on average): 0
HTTP2 Child Plaintext Session Creation Per Second (for last 96 seconds on average): 0
Interpreting the Counters
- One HTTP/2 connection established—
Current session HTTP2 parentincrements by 1. - Multiple concurrent HTTP requests (streams) over same
connection—
Current session HTTP2 childincreases (one per stream). - New connections initiated—Parent session creation rate increases.
- New streams within existing connection—Child session creation rate increases.
If these counters are zero, it indicates that:
- No clear-text HTTP/2 traffic is being detected
- Or HTTP/2 inspection is not active
Disable Clear-Text HTTP/2 (for Isolation)
If issues are suspected with HTTP/2 inspection, disable the feature to isolate the problem:
user@host# set security application-services http2 plain-text disable
Or disable HTTP/2 application identification:
user@host> request services application-identification application disable junos:HTTP2
Disabling HTTP/2 helps confirm whether the issue is related to HTTP/2 processing or general traffic handling.
Check HTTP/2 Session Logging
Session logs represent the HTTP/2 connection, while stream logs represent individual HTTP transactions, enabling granular visibility into per-stream activity, policy enforcement, and traffic behavior.
Ensure that you have enabled logging for HTTP/2 parent sessions. Check HTTP/2 Protocol and Security Log for HTTP/2 Trafficfor details.
Example HTTP/2 Session Logs
- Is HTTP/2
working?
Stream create: 2023-05-19T18:20:37.630+08:00 flow-srx4600-01 RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.35 source-address="192.168.1.101" source-port="33883" destination-address="192.168.2.101" destination-port="443" service-name="junos-https" nat-source-address="192.168.1.101" nat-source-port="33883" nat-destination-address="192.168.2.101" nat-destination-port="80" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="6" policy-name="sec_policy" source-zone-name="trust" destination-zone-name="untrust" session-id-32="80000058" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/1.0" application="HTTP2" nested-application="N/A" encrypted="yes" conn-tag="0"]
In the above sample, the fields
application="HTTP2"andencrypted="yes"confirm that HTTP/2 traffic is identified. - Is inspection happening per
stream?
Stream create: 2023-05-19T18:20:37.630+08:00 flow-srx4600-01 RT_FLOW - RT_FLOW_STREAM_CREATE [junos@2636.1.1.1.2.35 source-address=”192.168.1.101” source-port=”33883” destination-address=”192.168.2.101” destination-port=”443” service-name=”junos-https” nat-source-address=”192.168.1.101” nat-source-port=”33883” nat-destination-address=”192.168.2.101” nat-destination-port=”80” src-nat-rule-name=”None” dst-nat-rule-name=”None” protocol-id=”6” policy-name=”sec_policy” source-zone-name=”trust” destination-zone-name=”untrust” session-id-32=”80000059” username=”N/A” roles=”N/A” packet-incoming-interface=”ge-0/0/1.0” application=”HTTP” nested-application=”facebook” encrypted=”no” conn-tag=”0” parent-session-id=”80000058” client-side-stream-id=”102” server-side-stream-id=”102”]
The fields
parent-session-idandstream-idshow sessions are linked using explicit identifiers.The fields
policy-name=”sec_policy”,application=”HTTP”,nested-application=”facebook”confirm from a policy is applied successfully and application identified (AppID working). - What is traffic
volume?
Stream close: 2023-05-19T18:25:37.630+08:00 flow-srx4600-01 RT_FLOW - RT_FLOW_STREAM_CLOSE [junos@2636.1.1.1.2.35 reason="TCP FIN" source-address=”192.168.1.101” source-port=”33883” destination-address=”192.168.2.101” destination-port=”443” service-name=”junos-https” nat-source-address=”192.168.1.101” nat-source-port=”33883” nat-destination-address=”192.168.2.101” nat-destination-port=”80” src-nat-rule-name=”None” dst-nat-rule-name=”None” protocol-id=”6” policy-name=”sec_policy” source-zone-name=”trust” destination-zone-name=”untrust” session-id-32=”80000059” username=”N/A” roles=”N/A” frames-from-client="2" bytes-from-client="356" frames-from-server="247" bytes-from-server="247145" elapsed-time="213" application=”HTTP” nested-application=”facebook” username="N/A" roles="N/A" packet-incoming-interface=”ge-0/0/1.0” encrypted=”no” conn-tag=”0” parent-session-id=”80000058” client-side-stream-id=”102” server-side-stream-id=”102”]
In the above sample, the fields
frames-from-client="2"andframes-from-server="247"help identify data flow direction and whether the server responded.