HTTP/2 DoS mitigation

September 14, 2021

Contributed by:

S S

The Http/2 Denial-of-Service (DoS) attacks no longer have any impact on a Citrix ADC appliance. If the appliance receives frames more than the maximum limit, the appliance silently closes the connection.

To mitigate attacks, HTTP profile enables you to change the default configuration of frames received in a HTTP/2 connection.

TheHTTP/2 DoS mitigationtable shows the list of HTTP/2 DoS attacks and its mitigation.

Configure the maximum limit for HTTP/2 frames to mitigate DoS attacks by using the command line interface

At the command prompt, type the following:

set ns httpprofile - http2MaxEmptyFramesPerMin -http2MaxPingFramesPerMin -http2MaxSettingsFramesPerMin -http2MaxResetFramesPerMin

Example:

set ns httpprofile profile1 -http2MaxEmptyFramesPerMin 20 -http2MaxPingFramesPerMin 20 -http2MaxSettingsFramesPerMin 20 -http2MaxResetFramesPerMin 20

Configure the maximum limit for frames received in a HTTP/2 connection by using the Citrix ADC GUI

Follow the steps given below to configure the maximum limit for frames received in a HTTP/2 connection:

On the navigation pane, expandSystemand then clickProfiles.
On theProfilepage, select theHTTP Profilestab.
In theHTTP Profilestab page, clickAdd.
In theConfigure HTTP Profilepage, set the following parameter.
1. http2MaxPingFramesPerMin. Set the maximum PING frames received per connection in a minute. If the number of PING frames exceed configuration limit, the appliance silently drops packets on the connection.
2. http2MaxSettingsFramesPerMin. Set the maximum SETTINGS frames received per connection in a minute. If the number of SETTINGS frames exceed configuration limit, ADC silently drops packets on the connection.
3. http2MaxResetFramesPerMin. Set the maximum RESET frames sent per connection in a minute. If the number of RESET frames exceed configuration limit, ADC silently drops packets on the connection.
4. http2MaxEmptyFramesPerMin. Set the maximum empty frames sent per connection in a minute. If the number of empty frames exceed configuration limit, ADC silently drops packets on the connection.
ClickOKandClose.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

HTTP/2 DoS mitigation

September 14, 2021

Contributed by:

S S

September 14, 2021

Contributed by:

S S

HTTP/2 DoS mitigation

Configure the maximum limit for HTTP/2 frames to mitigate DoS attacks by using the command line interface

Configure the maximum limit for frames received in a HTTP/2 connection by using the Citrix ADC GUI

In this article