For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Andrea_110925's avatar
Andrea_110925
Icon for Nimbostratus rankNimbostratus
Jul 02, 2014

BIGIP LTM SSL offloading statistics

Hi guys,

 

I'd like know statistics about which SSL/TLS suite is used by client in session with ltm.

 

I have many vip for which ltm makes ssl-offload, associated to them there are different ssl profile in which I define the SSL/TLS suite to accept or refuse (e.g. I refuse SSLv2). I'd like encrease the security level accepting TLSv1.1 only, but I don't how many client, now, are connected with SSLv3 or TLSv1.0. If I have a statistic I can be sure about this.

 

Thanks in advance, Andrea

 

application delivery
LTM
security

6 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Jul 02, 2014

    isn't it in show ltm profile client-ssl?

    [root@ve11a:Active:In Sync] config  tmsh show ltm profile client-ssl clientssl | grep -i Protocol
Protocol
  SSL Protocol Version 2                                            0
  SSL Protocol Version 3                                            0
  TLS Protocol Version 1.0                                          0
  TLS Protocol Version 1.1                                          0
  TLS Protocol Version 1.2                                          0
  DTLS Protocol Version 1                                           0
  • Andrea_110925's avatar
    Andrea_110925
    Icon for Nimbostratus rankNimbostratus
    Jul 02, 2014

    Thanks nitass,

    I have this output for the command you suggest:

    Protocol                               
  SSL Protocol Version 2                           0
  SSL Protocol Version 3                      231657
  TLS Protocol Version 1.0                   4841104
  TLS Protocol Version 1.1                    154773
  TLS Protocol Version 1.2                   9992868
  DTLS Protocol Version 1                          0

    Now I have new question: when that statistics were reset? During last reboot?

    In addition, I found interesting the output of the entire command "tmsh show ltm profile client-ss", where I can find the explanetion of all statistics? Not only protocol.

    Thanks in advance, Andrea

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Jul 02, 2014

    when that statistics were reset? During last reboot?

    you can manually reset it or yes it will be rest when rebooting.

     tmsh reset-stats ltm profile client-ssl clientssl

    I found interesting the output of the entire command "tmsh show ltm profile client-ss", where I can find the explanetion of all statistics? Not only protocol.

    if it is not documented anywhere, you may try to post here (in case someone knows) or open a support case. 🙂

  • Daniel_Rodrigue's avatar
    Daniel_Rodrigue
    Icon for Nimbostratus rankNimbostratus
    Jun 29, 2018

    Hello, is it any OID to get this values?

    Protocol                               
  SSL Protocol Version 2                           0
  SSL Protocol Version 3                      231657
  TLS Protocol Version 1.0                   4841104
  TLS Protocol Version 1.1                    154773
  TLS Protocol Version 1.2                   9992868
  DTLS Protocol Version 1                          0

    Thank you