TLS

Question

I am trying to set up my LTM so that it will only accept TLS connections.  They are asking that we do away with SSLv3 completely.  I am not sure how to do that without causing interruptions, we have REST and JSON coming in as well as HTTP traffic.
For most services, I run a separate port to the servers, I have one that run 443.  That server is ColdFusion, and running SSLv3, and I have not been able to get it to run the proper cypher suite to the LTM.
Any suggestions?&nbsp;

andy_mcgrath · Answer

SSL protocol and ciphersuite configuration is under the client ssl profiles (for clientside) and server ssl profiles (for serverside), within the profiles you have the option of setting ciphersuite and protocol the following links should help you.&nbsp;
sol13163: SSL ciphers supported on BIG-IP platforms (11.x - 12.x)&nbsp;
sol15194: Overview of the BIG-IP SSL/TLS cipher suite&nbsp;
sol8802: Using SSL ciphers with BIG-IP Client SSL and Server SSL profiles&nbsp;
sol13171: Configuring the cipher strength for SSL profiles (11.x) - Configuring the SSL profile to block a specific SSL version&nbsp;
If you're running 11.5.0 or above SSLv3 is disabled in the 'DEFAULT' ciphersuite list, anything earlier changing the ciphersuite setting in the ssl profile to 'DEFAULT:!SSLv3' should work.&nbsp;

Forum Discussion

TLS

1 Reply

Recent Discussions

F5Access | MacOS Sonoma

Transaction looks successful but file not downloading

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

F5 Access Guard Deprecated: ZTA APM

F5 loadbalancer not working

Related Content

Fingerprinting TLS Clients with JA4 on F5 BIG-IP

F5 CIS, TLS Extensions, and troubleshooting

Decrypting TLS traffic on BIG-IP

What is Mutual TLS (mTLS)?

Decrypting TLS with the tcpdump sslprovider