Forum Discussion

w2kask_122702's avatar
w2kask_122702
Icon for Nimbostratus rankNimbostratus
Jan 30, 2013

Cipher suite question

Hi Friends, We are using TMOS 10.2.4 in our LTM box

 

I saw the following cipher command in my current VIP's SSL profile cipher column. Would like to know what is the meaning of NATIVE command ? Also may i know whether TLSv1 is supported with the following command, my auditor told not to use TLSv1 but use TLSv1.1 or TLSv1.2 but I am not sure whether the following include TLSv1 or not

 

NATIVE:TLSv1_1:@SPEED:@STRENGTH

 

Also we plan to use the following new cipher commands, may I know what is mean by !LOW, it mean exclude Cipher strength of 64 bits right ? So is the TLSv1 are those 64bits strength or lower ?

 

New Cipher

 

ALL:!ADH:!EXPORT40:!EXP:!SSLV2:!NULL:!LOW:!MD5:TLSv1_1:@SPEED:@STRENGTH

 

Cipher suite supported in our TMOS 10.2.4

 

[user1@LTM] ~ tmm --clientciphers 'DEFAULT'

 

ID SUITE BITS PROT METHOD CIPHER MAC KEYX

 

0: 5 RC4-SHA 128 SSL3 Native RC4 SHA RSA

 

1: 5 RC4-SHA 128 TLS1 Native RC4 SHA RSA

 

2: 5 RC4-SHA 128 TLS1.2 Native RC4 SHA RSA

 

3: 47 AES128-SHA 128 SSL3 Native AES SHA RSA

 

4: 47 AES128-SHA 128 TLS1 Native AES SHA RSA

 

5: 47 AES128-SHA 128 TLS1.2 Native AES SHA RSA

 

6: 47 AES128-SHA 128 DTLS1 Native AES SHA RSA

 

7: 53 AES256-SHA 256 SSL3 Native AES SHA RSA

 

8: 53 AES256-SHA 256 TLS1 Native AES SHA RSA

 

9: 53 AES256-SHA 256 TLS1.2 Native AES SHA RSA

 

10: 53 AES256-SHA 256 DTLS1 Native AES SHA RSA

 

11: 10 DES-CBC3-SHA 192 SSL3 Native DES SHA RSA

 

12: 10 DES-CBC3-SHA 192 TLS1 Native DES SHA RSA

 

13: 10 DES-CBC3-SHA 192 TLS1.2 Native DES SHA RSA

 

14: 10 DES-CBC3-SHA 192 DTLS1 Native DES SHA RSA

 

15: 60 AES128-SHA256 128 TLS1.2 Native AES SHA256 RSA

 

16: 61 AES256-SHA256 256 TLS1.2 Native AES SHA256 RSA

 

config
design

1 Reply

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Jan 30, 2013
    Have a look at:

     

     

    SOL7815: Configuring the cipher strength for SSL profile (9.x - 10.x)

     

    https://support.f5.com/kb/en-us/solutions/public/7000/800/sol7815.html

     

     

    SOL10262: SSL ciphers used in the default SSL profiles (10.x)

     

    https://support.f5.com/kb/en-us/solutions/public/10000/200/sol10262.html

     

     

    SOL11444: SSL ciphers supported by BIG-IP SSL profiles (10.x)

     

    https://support.f5.com/kb/en-us/solutions/public/11000/400/sol11444.html

     

     

    NATIVE:TLSv1_1:@SPEED:@STRENGTH

     

     

    This string essentially says, use the natively supported ciphers for 10.2.4, include TLSv1.1, order by speed, then order by strength. Looking at SOL11444, it appears that TLSv1.1 isn't in the native list, so not sure if it'll work. And I think you're tmm output confirms this.

     

     

    ALL:!ADH:!EXPORT40:!EXP:!SSLV2:!NULL:!LOW:!MD5:TLSv1_1:@SPEED:@STRENGTH

     

     

    This means: use all the ciphers in the default SSL stack, but exclude ADH ciphers, EXPORT grade (weak) ciphers, ciphers with 40 or 56 bit export strengths, SSLv2, NULL ciphers, 64 bit ciphers, and MD5. Also include TLSv1.1 (probably not supported) and order by speed and then again by strength.