Disabling Ciphers

Question

Guys,&nbsp;
We are deploying Skype at work.  The Skype team would like me to disable the "Weak" Ciphers and only enable the others.  I know you can disable / enable them in the clientssl profile under Advanced.  But, what is the correct context to do this?&nbsp;
Thank You&nbsp;
Here is the list&nbsp;
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) ECDH secp384r1 (eq. 7680 bits RSA) FS256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH secp384r1 (eq. 7680 bits RSA) FS128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH secp384r1 (eq. 7680 bits RSA) FS256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH secp256r1 (eq. 3072 bits RSA) FS128&nbsp;
TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) WEAK256&nbsp;
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) WEAK128&nbsp;
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) WEAK256&nbsp;
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) WEAK128&nbsp;
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) WEAK112&nbsp;
TLS 1.1 (suites in server-preferred order)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH secp384r1 (eq. 7680 bits RSA) FS256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH secp256r1 (eq. 3072 bits RSA) FS128&nbsp;
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) WEAK256&nbsp;
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) WEAK128&nbsp;
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) WEAK112&nbsp;
TLS 1.0 (suites in server-preferred order)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH secp384r1 (eq. 7680 bits RSA) FS256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH secp256r1 (eq. 3072 bits RSA) FS128&nbsp;
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) WEAK256&nbsp;
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) WEAK128&nbsp;
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) WEAK112&nbsp;

samir_jha_52506 · Accepted Answer

@Rob, Do you want to disable only Weak cipher, which you have pasted in Question section. Let us know.&nbsp;

simon_blakely · Answer

Yes, you need to set this in the clientSSL profile applied to the virtual.  
&nbsp;
You can also create a clientssl profile that specifies your selected ciphers, and use that profile as the parent profile for the Virtual server specific clientssl profiles. 
Then if you need to change the ciphers set for all your virtuals, you can update the parent and change all the child profiles at once. &nbsp;
Do NOT modify the default clientSSL profile&nbsp;

rob_higginbotha · Answer

I want to disable only the ciphers I noted as weak&nbsp;
Thanks&nbsp;

samir_jha_52506 · Answer

Disable below cipher in-order to eliminate weak cipher list. I have tested in v12 and all weak cipher gone. Suggest you to test in LAB environment and share feedback. Most important thing, don't play with default client-ssl profile which has pointed by @SBlakely
Find the weak cipher list as per above question . 
    AES256-SHA256
    AES128-SHA256
    AES256-SHA
    AES128-SHA
    DES-CBC3-SHA

TLS 1.1 (Weak suites in server-preferred order)
    AES256-SHA
    AES128-SHA
    DES-CBC3-SHA

TLS 1.0 (Weak suites in server-preferred order)
    AES256-SHA
    AES128-SHA
    DES-CBC3-SHA

rob_higginbotha · Answer

My Apologies for being dumb - So, I copy the above list in the "Ciphers" section in the clientssl profile that I created?  Anything else?  What am I missing?&nbsp;
Thank you for your help&nbsp;
When I try this I'm getting an error&nbsp;
01070312:3: Invalid keyword ' 
aes256-sha256' in ciphers list for profile /Common/clientssl-test-cyphers&nbsp;
Cipher List to insert.&nbsp;
AES256-SHA256:
AES128-SHA256:
AES256-SHA:
AES128-SHA:
DES-CBC3-SHA:
AES256-SHA:
AES128-SHA:
DES-CBC3-SHA:
AES256-SHA:
AES128-SHA:
DES-CBC3-SHA:&nbsp;

samir_jha_52506 · Answer

Try this DEFAULT:ECDHE:!RSA:!DHE:!3DES

Forum Discussion

Disabling Ciphers

7 Replies

Recent Discussions

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

[ASM] - what is "Browser Challenge file" ?

Related Content

Disabling Weak Ciphers

Disabling Specific Weak Cipher Suites

Disable below cipher

Cipher Suites Supported (12.1.5.3)

LTM Cipher rule