Forum Discussion

SSesostris_3458's avatar
SSesostris_3458
Icon for Nimbostratus rankNimbostratus
May 03, 2018

Issue on disabling TLS 1.0 / TLS 1.1

Hello,

 

We have a problem with an LTM (Local Trafic Manager) when we turn off TLS 1.0 and 1.1. Indeed when protocols are disabled in SSL profiles, the F5 does not return any error to the client. We would like to disable these protocols and returning a html code to our clients when he goes on the website.

 

We have prepared an irule that looks like this:

 

when HTTP_REQUEST {

 

if {[SSL :: cipher version]! = "TLSv1.2"}

 

{HTTP :: respond 503 content {

 

 

my html

 

 

}

 

}

 

This irule works if we don’t disable both protocols directly in the SSL profile. On the other hand, when this is the case, the F5 does not even read the irule. I think it is the trigger condition of the irule that is wrong, when the handshake fail, there is no HTTP request.

 

We are looking for a solution to setup an irule that would return a html code or that makes a redirection to another url in case of SSL handshake failure.

 

Someone can help me ?

 

iRules
LTM
security

5 Replies

Sort By
  • Lee_Sutcliffe's avatar
    Lee_Sutcliffe
    Icon for Nacreous rankNacreous
    May 03, 2018

    The problem you have is that SSL negotiation happens prior to HTTP_REQUEST. So if you have disabled TLS 1.0 and the client only uses TLS 1.0, the session will never be established, it will be terminated before you reach the HTTP request event... hence being unable to send an HTTP::response command.

     

    It is by design that you do not receive an error in this instance. You would see in the SSL handshake that the version is not supported but this is not obvious to your users unless they are capturing the request using Wireshark for example.

     

    What is your actual requirement?

     

  • Surgeon's avatar
    Surgeon
    Ret. Employee
    May 03, 2018

    If you use SSL, browser expect to finish ssl handshake 1st. You will not be able to receive html code if ssl handshake fails. You need to get ssl handshake established and only then you can send and receive html.

     

    This is just TCP/IP stack rules. If lower level protocols fails, upper level will not work. What you can do, you can wait until ssl handshake established and then terminate it if ssl version is lower then tls 1.2. You can implement it via iRule

     

  • Mike_62127's avatar
    Mike_62127
    Icon for Nimbostratus rankNimbostratus
    Jul 26, 2018

    this iRule works well for what you are asking.

        if { [SSL::cipher version] ne "TLSv1.2" } {
    HTTP::respond 200 content "Your browser must support TLSv1.2"
    • Mike_62127's avatar
      Mike_62127
      Icon for Nimbostratus rankNimbostratus
      Jul 26, 2018

      I should have added that you need to keep TLSv 1.0 & 1.1 enabled in the SSL Profile. this will terminate any non TLSv 1.2 connections at the LTM and send the custom error message to the client.

       

    • Surgeon's avatar
      Surgeon
      Ret. Employee
      Jul 28, 2018

      But be aware that this solution requires tls1.0 and tls1.1 to be enabled and may impact your rank on ssllabs. You need to decide which option to use.

       

      See Lee Sutcliffe's replies earlier