Forum Discussion

w2kask_122702's avatar
w2kask_122702
Icon for Nimbostratus rankNimbostratus
Jan 30, 2013

Cipher suite question

Hi Friends, We are using TMOS 10.2.4 in our LTM box   I saw the following cipher command in my current VIP's SSL profile cipher column. Would like to know what is the meaning of NATIVE command...
config
design
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Jan 30, 2013
Have a look at:

 

 

SOL7815: Configuring the cipher strength for SSL profile (9.x - 10.x)

 

https://support.f5.com/kb/en-us/solutions/public/7000/800/sol7815.html

 

 

SOL10262: SSL ciphers used in the default SSL profiles (10.x)

 

https://support.f5.com/kb/en-us/solutions/public/10000/200/sol10262.html

 

 

SOL11444: SSL ciphers supported by BIG-IP SSL profiles (10.x)

 

https://support.f5.com/kb/en-us/solutions/public/11000/400/sol11444.html

 

 

NATIVE:TLSv1_1:@SPEED:@STRENGTH

 

 

This string essentially says, use the natively supported ciphers for 10.2.4, include TLSv1.1, order by speed, then order by strength. Looking at SOL11444, it appears that TLSv1.1 isn't in the native list, so not sure if it'll work. And I think you're tmm output confirms this.

 

 

ALL:!ADH:!EXPORT40:!EXP:!SSLV2:!NULL:!LOW:!MD5:TLSv1_1:@SPEED:@STRENGTH

 

 

This means: use all the ciphers in the default SSL stack, but exclude ADH ciphers, EXPORT grade (weak) ciphers, ciphers with 40 or 56 bit export strengths, SSLv2, NULL ciphers, 64 bit ciphers, and MD5. Also include TLSv1.1 (probably not supported) and order by speed and then again by strength.