Forum Discussion

Rajendran2002_1's avatar
Rajendran2002_1
Icon for Nimbostratus rankNimbostratus
Jul 27, 2015

Assistance in cipher

Hi All   Need assistance to enable below standards in SSL enabled VIP   Standardize configuration for SSL enabled external sites to use industry best practices, such as: - Use only AES -256 ci...
application delivery
LTM
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Jul 27, 2015

So what you're looking at is the cipher string that makes up the DEFAULT stack on any given platform. For 11.2 the DEFAULT stack is:

NATIVE:!MD5:!EXPORT:!DES:!DHE:!EDH:@SPEED

which negated things like DES and MD5 but still supports SSLv3. At a minimum you'll want to extend this to negate SSLv2 and SSLv3:

DEFAULT:!SSLv2:!SSLv3

But your absolute best bet is to upgrade your system to at least 11.5.0 with all of the hotfixes.