Forum Discussion

Dicky_Moe_13167's avatar
Dicky_Moe_13167
Icon for Nimbostratus rankNimbostratus
Nov 05, 2015

SSLv3 vs TLS 1.2 discrimination with irule

Hello All might F5 gurus!

We are going to switch to TLS 1.2 in all of our F5 VIPs, but we want to place some sort of message for some months to any customer that still uses SSLv3, instead of showing an error. Meaning, if the browser is any version lower than TLS 1.2, we want to redirect them somewhere else.

After some digging in devcentral, I've come up with this irule:

when HTTP_REQUEST {
    set cipherSuite [SSL::cipher version]
    if { $cipherSuite equals "TLSv1.2" } { 
        pool web_portal_pool    
        } 
    else {
        HTTP::redirect http://www.yahoo.com
    }
}

To test this, I've opened sessions with IE, selecting SSLv3, TLS v1.0, TLS 1.1 and TLS 1.2 It seems to work, except for TLS 1.1. When I select that to be the protocol use in IE, I get:

This page can’t be displayed

Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting to https://10.42.40.204 again. If this error persists, contact your site administrator.

Any idea on why is this happening?

Thanks! Fabian

9 Replies