Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What are HTTP/3 and QUIC?
Short answer
QUIC is a transport protocol that runs over UDP instead of TCP and incorporates TLS 1.3 into its own handshake; it establishes the connection with fewer round trips, and packet loss in one stream does not make the other streams wait (there is no head-of-line blocking). HTTP/3 is the version of HTTP that runs over QUIC. In TR7, HTTP/3 is not selected as a protocol on its own: on the HTTP vService, in the Frontend row, in the Protocol selector, the HTTP/1.1 or HTTP/2 option in the Encrypted (HTTPS) group that has the HTTP/3 badge is selected; TR7 listens on the same IP:port on TCP for the selected protocol and on UDP for QUIC, adds the alt-svc header to the responses, and generates a rule automatically in its own Firewall for the UDP port. Clients that support it switch to HTTP/3; the others stay on TCP.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Load Balancer → Load Balancer vService List → HTTP vService form → Frontend | Protocol → Encrypted (HTTPS) → HTTP/1.1 or HTTP/2 with the HTTP/3 badge | Offering HTTP/3 alongside the TCP protocol; the badged options are listed only on the HTTP vService and while the Virtual Hosting list is empty |
| HTTP vService form → Details → QOS | Core Engine | If the selected version does not support QUIC, HTTP/3 is not applied |
| Network → Firewall → auto-generated rules | "vService name" QUIC (HTTP/3) rule | Opening the same port on UDP |
Enabling HTTP/3, its conditions and its verification: Is HTTP/3 (QUIC) supported; how is it enabled and which conditions does it depend on?
Comparison
| HTTP/2 | HTTP/3 | |
|---|---|---|
| Transport | TCP + TLS | QUIC (UDP) |
| Packet loss in one stream | All streams on the connection wait | Only the affected stream waits |
| TLS | TLS 1.2 or 1.3, on top of TCP | TLS 1.3, inside the QUIC handshake |
| Standard | RFC 9113 | RFC 9114 (QUIC: RFC 9000) |
Common Misconceptions
- "When HTTP/3 is selected, TCP listening stops." HTTP/3 is offered in addition; HTTP/1.1 or HTTP/2 continues to serve on TCP. The client first connects to the site over TCP and switches to QUIC after it sees the
alt-svcheader. - "Opening TCP 443 is enough." QUIC uses the same port on UDP. TR7 generates the UDP rule automatically in its own Firewall; on the security devices in front of TR7, the UDP port must be opened separately.
- "HTTP/3 can be selected on every HTTP vService." The badged options are not listed on a vService whose Virtual Hosting list is filled; if the Keep Header Names action is bound to the vService, HTTP/2 and HTTP/3 are disabled.
How it is done in the documentation
