Forum Discussion

vvskaladhar_488's avatar
vvskaladhar_488
Icon for Nimbostratus rankNimbostratus
Jun 12, 2018

Source IP details accessing TLSv1

Hello All,

 

can you please let me know how to identify Source ip or end user IP (External ) accessing TLSv1 on the VIP ? Please let me know if there is any irule that can be configured and tested.

 

6 Replies

  • Can you try:

    when CLIENTSSL_CLIENTHELLO {
    set userip [IP::client_addr]
    set SSL_version [SSL::cipher name]
    set SSL_PROTOCOL [SSL::cipher version]
    
        if {$SSL_PROTOCOL == "TLSv1"} {
    
        log local0. "Warning: $userip - $SSL_version - $SSL_PROTOCOL"
    
        }
    }
    

    Keep me in touch...

  • Hi ,

     

    I have added this irule and i will be tagging this to a required VIP. will it save logs to any specific folder or do i need to collect all the logs form filter them form var/log folder ?

     

    log local0. "Warning: $userip - $SSL_version - $SSL_PROTOCOL"

     

  • This logs are saved in /var/log/ltm.

     

    You can also send logs in a syslog server. It's more simple for search or filter some logs...

     

    How I can help you