| name | cis-azure-foundations-7.13 |
| description | Ensure 'HTTP2' is set to 'Enabled' on Azure Application Gateway |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","networking","application-gateway"] |
| cis_id | 7.13 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-7.10","cis-azure-foundations-7.12"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure 'HTTP2' is set to 'Enabled' on Azure Application Gateway
Description
Enable HTTP/2 for improved performance, efficiency, and security.
HTTP/2 protocol support is available to clients that connect to application gateway listeners only. Communication with backend server pools is always HTTP/1.1.
Rationale
Enabling HTTP/2 supports use of modern encrypted connections.
Impact
Clients and backend services that do not support HTTP/2 will fall back to HTTP/1.1.
Audit Procedure
Using Azure Portal
- Go to
Application gateways.
- Click the name of an application gateway.
- Under
Settings, click Configuration.
- Ensure
HTTP2 is set to Enabled.
- Repeat steps 1-4 for each application gateway.
Using Azure CLI
Run the following command to list application gateways:
az network application-gateway list
For each application gateway, run the following command to get the HTTP2 setting:
az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query enableHttp2
Ensure true is returned.
Using PowerShell
Run the following command to list application gateways:
Get-AzApplicationGateway
Run the following command to get the application gateway in a resource group with a given name:
$gateway = Get-AzApplicationGateway -ResourceGroupName <resource-group> -Name <application-gateway>
Run the following command to get the HTTP2 setting:
$gateway.EnableHttp2
Ensure True is returned.
Repeat for each application gateway.
Expected Result
All Application Gateways should have HTTP2 set to Enabled (enableHttp2 = true).
Remediation
Remediate from Azure Portal
- Go to
Application gateways.
- Click the name of an application gateway.
- Under
Settings, click Configuration.
- Under
HTTP2, click .
