Forum Discussion

DanS1234_355940's avatar
DanS1234_355940
Icon for Nimbostratus rankNimbostratus
Jul 25, 2018

Disable DHE Ciphers - SSL Parent Profile

I'm currently running 11.6.0 on most of my devices and am looking to upgrade passed version 12.0 in the near future. Looking at the iHealth Upgrade Advisor, I need to disable DHE ciphers on all of my Server SSL Profiles before upgrading.

 

I added DEFAULT:!EXPORT:!DHE to one of my Server SSL Profiles and it is no longer getting flagged in iHealth. Can I add that string to the Server SSL parent profile, or do I have to add that to each profile individually? Will updating the parent profile have any adverse effects on my other profiles, or would the Cipher settings be the only thing that changes?

 

application delivery
dhe
disable cipher
LTM
parent policy
server ssl profile
  • Simon_Blakely's avatar
    Simon_Blakely
    Icon for Employee rankEmployee
    Jul 25, 2018

    F5 recommends that you do not modify a default profile (like the serverssl profile).

     

    What you should do is create a new site-default server-ssl profile, and change the Parent Profile on all your existing server-ssl profiles to this new site-default profile.

     

    Then (in future) is you need to modify a setting on all your server-ssl profiles, you can make that change on your site-default profile and pass it to all the child profiles.

     

    You can override an inherited option in a child profile by setting the custom checkbox for a specific option.