Forum Discussion
Enabling "Honor Cipher Order" on F5 LTM v12.X
I was able to resolve this issue. For anyone having the same problem, here is what worked for me.
The problem I was still having after Boneyard's help was that i could not get a SSLLabs grade above "B" because the DHE Ciphers were 1024 bit. This made the list of Ciphers appear to not be in the proper order. I found a thread (https://devcentral.f5.com/questions/how-to-set-diffie-hellman-to-2048-bits-59024) that explains that the F5 does not support DHE 2K. So that explains why SSLLabs was giving me a "B".
I found another thread (https://devcentral.f5.com/questions/disable-specific-ssl-ciphers-on-f5-big-ip-55422) where someone had the same issue and solved it with the following cipher list: "!SSLv2:!EXPORT:!DHE+AES-GCM:!DHE+AES:!DHE+3DES:ECDHE+AES-GCM:ECDHE+AES:RSA+AES-GCM:RSA+AES:ECDHE+3DES:RSA+3DES:-MD5:-SSLv3:-RC4". I applied that cipher list to my ssl profile and now SSLLabs give me an "A"
To round things up, my problem was that my cipher string had DH 2048 bit ciphers and ECDHE-ECDSA-CHACHA20-POLY1305 ciphers. Neither of these ciphers are supported by the F5. Also, I did not understand the exact syntax or where the cipher string should be placed in the F5.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com