anchor.diff:  ---
  -title: Supporting HTTP/2
  +title: Configuring HTTP/2 Support
   owner: CF for VMs Networking
   ---
   
  -This topic describes how operators can configure their <%= vars.app_runtime_first %> deployment to support HTTP/2.
  +This topic describes how operators can configure their <%= vars.app_runtime_first %> deployment to support HTTP/2 from ingress to egress.
   
   ## <a id="overview"></a> Overview
   
  
positive.code: 
  After you map a route with HTTP/2 support enabled, the Gorouter sends all traffic to that app over HTTP/2, even traffic that ingresses to the Gorouter over HTTP/1.1.
  
  To map a route to the app with HTTP/2 support, run:
  
  ```
  cf map-route MY-APP EXAMPLE.COM --destination-protocol=http2
  Creating route MY-APP.EXAMPLE.COM for org my-org / space my-space as admin...
  OK
  ```
  Where:
  
  - `MY-APP` is the name of your app.
  - `EXAMPLE.COM` is the route you want to map to your app.
  
  ## <a id="security"></a> Security Considerations
  
  If you use a firewall or other tools to monitor network traffic,
  ensure that those tools support HTTP/2 connections.
  If your network monitoring tools do not support HTTP/2 connections, configuring HTTP/2 can cause problems with protecting and analyzing traffic on your network.
  
  <%= vars.recommended_by %> recommends that you become familiar with common vulnerabilities in apps that support HTTP/2.
  For example, HTTP/1.1 has vulnerabilities such as request smuggling and desync attacks, but these might be more prevalent in HTTP/2 environments.
  
negative.code: 
  However, some features like gRPC require all segments to use HTTP/2.
  While browsers and other clients might indicate a request is being served over HTTP/2,
  operators must ensure that all network hops use HTTP/2 to support gRPC.
  
  
  ## <a id="prerequisites"></a> Prerequisites
  
  Before you can configure your <%= vars.app_runtime_abbr %> deployment to support HTTP/2, you must enable TLS.
  
  Most implementations of HTTP/2 require TLS with Application-Layer Protocol Negotiation (ALPN).
  For more information about ALPN, see [RFC 7301: Transport Layer Security (TLS) Application-Layer Protocol Negotiation Extension](https://datatracker.ietf.org/doc/html/rfc7301).
  
  ### <a id="security"></a> Security Considerations
  
  If you use a firewall or other tools to monitor network traffic,
  ensure that those tools support HTTP/2 connections.
  If your network monitoring tools do not support HTTP/2 connections, configuring HTTP/2 can cause problems with protecting and analyzing traffic on your network.
  
  <%= vars.recommended_by %> recommends that you become familiar with common vulnerabilities in apps that support HTTP/2.
  For example, HTTP/1.1 has vulnerabilities such as request smuggling and desync attacks, but these might be more prevalent in HTTP/2 environments.
  
  
  ## <a id="enabling"></a> Enable End-to-End HTTP/2
  
  This section describes how to enable HTTP/2 in your deployment from ingress to egress.
  To enable end-to-end HTTP/2, you must configure the load balancers, the <%= vars.app_runtime_abbr %> platform, and the app.
  
  ### <a id="load-balancer"></a> Configure Load Balancers
  