For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Cyril's avatar
Cyril
Icon for Nimbostratus rankNimbostratus
Jan 23, 2014

Cipher suit

Hi All,   Please let me know the strongest cipher suit that can be configured in the LTM to over come all the vulnerabilities.   Thanks in advance.   -Cyril  
security
nitass's avatar
nitass
Icon for Employee rankEmployee
Jan 26, 2014

you can use tmm --clientciphers to check.

e.g.

[root@ve11a:Active:In Sync] config  tmm --clientciphers 'EDH+AESGCM:EDH+AES:AESGCM:AES:-SSLv3:EDH+AES:EDH+3DES:AES:RC4:3DES:!ADH:!ECDH:!DSS:!MD5:!PSK:!eNULL:!aNULL:!SRP:!EXP:!DES'
       ID  SUITE                            BITS PROT    METHOD  CIPHER  MAC     KEYX
 0:    51  DHE-RSA-AES128-SHA               128  TLS1    Native  AES     SHA     EDH/RSA
 1:    51  DHE-RSA-AES128-SHA               128  TLS1.1  Native  AES     SHA     EDH/RSA
 2:    51  DHE-RSA-AES128-SHA               128  TLS1.2  Native  AES     SHA     EDH/RSA
 3:    57  DHE-RSA-AES256-SHA               256  TLS1    Native  AES     SHA     EDH/RSA
 4:    57  DHE-RSA-AES256-SHA               256  TLS1.1  Native  AES     SHA     EDH/RSA
 5:    57  DHE-RSA-AES256-SHA               256  TLS1.2  Native  AES     SHA     EDH/RSA
 6:    47  AES128-SHA                       128  TLS1    Native  AES     SHA     RSA
 7:    47  AES128-SHA                       128  TLS1.1  Native  AES     SHA     RSA
 8:    47  AES128-SHA                       128  TLS1.2  Native  AES     SHA     RSA
 9:    47  AES128-SHA                       128  DTLS1   Native  AES     SHA     RSA
10:    53  AES256-SHA                       256  TLS1    Native  AES     SHA     RSA
11:    53  AES256-SHA                       256  TLS1.1  Native  AES     SHA     RSA
12:    53  AES256-SHA                       256  TLS1.2  Native  AES     SHA     RSA
13:    53  AES256-SHA                       256  DTLS1   Native  AES     SHA     RSA
14:    60  AES128-SHA256                    128  TLS1.2  Native  AES     SHA256  RSA
15:    61  AES256-SHA256                    256  TLS1.2  Native  AES     SHA256  RSA
16: 49171  ECDHE-RSA-AES128-CBC-SHA         128  TLS1    Native  AES     SHA     ECDHE_RSA
17: 49171  ECDHE-RSA-AES128-CBC-SHA         128  TLS1.1  Native  AES     SHA     ECDHE_RSA
18: 49171  ECDHE-RSA-AES128-CBC-SHA         128  TLS1.2  Native  AES     SHA     ECDHE_RSA
19: 49172  ECDHE-RSA-AES256-CBC-SHA         256  TLS1    Native  AES     SHA     ECDHE_RSA
20: 49172  ECDHE-RSA-AES256-CBC-SHA         256  TLS1.1  Native  AES     SHA     ECDHE_RSA
21: 49172  ECDHE-RSA-AES256-CBC-SHA         256  TLS1.2  Native  AES     SHA     ECDHE_RSA
22:    51  DHE-RSA-AES128-SHA               128  SSL3    Native  AES     SHA     EDH/RSA
23:    57  DHE-RSA-AES256-SHA               256  SSL3    Native  AES     SHA     EDH/RSA
24:    22  DHE-RSA-DES-CBC3-SHA             192  TLS1    Native  DES     SHA     EDH/RSA
25:    22  DHE-RSA-DES-CBC3-SHA             192  TLS1.1  Native  DES     SHA     EDH/RSA
26:    22  DHE-RSA-DES-CBC3-SHA             192  TLS1.2  Native  DES     SHA     EDH/RSA
27:    22  DHE-RSA-DES-CBC3-SHA             192  SSL3    Native  DES     SHA     EDH/RSA
28:    47  AES128-SHA                       128  SSL3    Native  AES     SHA     RSA
29:    53  AES256-SHA                       256  SSL3    Native  AES     SHA     RSA
30:     5  RC4-SHA                          128  TLS1    Native  RC4     SHA     RSA
31:     5  RC4-SHA                          128  TLS1.1  Native  RC4     SHA     RSA
32:     5  RC4-SHA                          128  TLS1.2  Native  RC4     SHA     RSA
33:     5  RC4-SHA                          128  SSL3    Native  RC4     SHA     RSA
34:    10  DES-CBC3-SHA                     192  TLS1    Native  DES     SHA     RSA
35:    10  DES-CBC3-SHA                     192  TLS1.1  Native  DES     SHA     RSA
36:    10  DES-CBC3-SHA                     192  TLS1.2  Native  DES     SHA     RSA
37:    10  DES-CBC3-SHA                     192  DTLS1   Native  DES     SHA     RSA
38: 49170  ECDHE-RSA-DES-CBC3-SHA           192  TLS1    Native  DES     SHA     ECDHE_RSA
39: 49170  ECDHE-RSA-DES-CBC3-SHA           192  TLS1.1  Native  DES     SHA     ECDHE_RSA
40: 49170  ECDHE-RSA-DES-CBC3-SHA           192  TLS1.2  Native  DES     SHA     ECDHE_RSA
41:    10  DES-CBC3-SHA                     192  SSL3    Native  DES     SHA     RSA