QlikView with IIS: HTTP/2 Settings thresholds

To manage flow control, HTTP/2 uses a feature known as a SETTINGS frame.

Clients can specify any number of SETTINGS frames. Microsoft found that in IIS, too many frames can overload the server, maxing out CPU usage at 100%.

Microsoft reported:

In some situations, excessive settings can cause services to become unstable and may result in a temporary CPU usage spike until the connection timeout is reached and the connection is closed.

To address this issue, Microsoft has added the ability to define thresholds on the number of HTTP/2 SETTINGS included in a request. These thresholds must be defined by the system administrator. They are not preset by Microsoft.

For more details see: https://support.microsoft.com/en-my/help/4491420/define-thresholds-on-the-number-of-http-2-settings-parameters-exchange

 

Qlik can not recommend specific settings values for this IIS configuration.
As general recommendation for server hardening and restriction, it is recommended to apply changes in a test environment to allow for full validation prior to making changes in production environment. 
This specific scenario is related to DDoS risk. For validation of settings it is recommended to validate them against anticipated traffic and user interaction levels, by simulating traffic towards Qlik products through IIS.