DHE key exchange: why is ephemeral key only 1024bit long?

11.6 will have a reduced set of lower level ciphers in the default config but any existing config is still supported. BigIP supports different levels because it has to account for many different configurations, like the COMPAT cipher list.

Check out SOL8802 for a good list of 11.x based SSL articles, but you'll specifically want to read SOL13171 to configure only strong ciphers if that's the need. I can only assume that your VIP is using a an SSL profile that allows these lower level strings for negotiation fall back.

But really review the SOL8802 and that will give you not only the possible ciphers that you'll want to support, but also how to configure the profile to use ONLY TLS 1.2 approved cipher strengths.