Forum Discussion

Dicky_Moe_13167's avatar
Dicky_Moe_13167
Icon for Nimbostratus rankNimbostratus
Nov 05, 2015

SSLv3 vs TLS 1.2 discrimination with irule

Hello All might F5 gurus! We are going to switch to TLS 1.2 in all of our F5 VIPs, but we want to place some sort of message for some months to any customer that still uses SSLv3, instead of showin...
application delivery
devops
iRules
LTM
security
Dicky_Moe_13167's avatar
Dicky_Moe_13167
Icon for Nimbostratus rankNimbostratus
Nov 05, 2015

I tried DEFAULT

 

and also DEFAULT:@STRENGTH

 

Neither of the above strings worked.I've tried other websites directly with only TLS 1.1 enabled and it worked fine.

 

Fabian

 

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Nov 05, 2015
    My suggestion would be to start looking at an ssldump to see what ciphers the client is presenting. You can then cross reference the ciphers the f5 is presenting by running the tmm --clientciphers command (with your cipher strong).
  • cjunior's avatar
    cjunior
    Icon for Nacreous rankNacreous
    Nov 06, 2015
    Is your backend connection encrypted? your backend server supports TLSv1.1? run this command in ssh: openssl s_client -connect : -tls1_1 , it works?