Disabling Specific Weak Cipher Suites
I need help disabling specific cipher suites for a client. I've read the documentation but don't know enough about these chipher suites to come up with the correct string to disable them in the SSL profile.
Part two of my question is, what this impacts. Does this impact the suites used from F5 to the server or just the connection between client and F5 or both?
These are the cipher suites being deprecated on the server side behind F5:
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH secp384r1 (eq. 7680 bits RSA) FS WEAK
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH secp384r1 (eq. 7680 bits RSA) FS WEAK
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH secp384r1 (eq. 7680 bits RSA) FS WEAK
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) ECDH secp384r1 (eq. 7680 bits RSA) FS WEAK
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) WEAK
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) WEAK
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) WEAK
Thanks!
Zach
This would the server side SSL profile then. Usually be default a generic SSL profile is used on server side, but you can create a specific one for this particular application.
Now, there is one more concern. You can disable the ciphers on the server and don't have to on the F5. Why? Both the F5 and server need to both support and agree upon a cipher version. So if the server is not presenting it as available in the initial handshake, the F5 simply will not use/select it. That said... have you asked the server team what ciphers are still supported? You want to make sure the F5 supports what the server is requesting now... newer versions of BIG-IP support newer ciphers, so maybe a newer software BIGIP version may be needed to support what the servers now advertise.