BEAST ATTACK

Have you seen this:

F5 Threat Mitigation: BEAST

Enforcing TLSv1.2 is one option, but ultimately to protect against the underlying CSRF and not alienate a bunch of customers that can't support TLSv1.2, you need a web application firewall like ASM.