For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mahjoub's avatar
mahjoub
Icon for Cirrus rankCirrus
Oct 24, 2022

Enabling TLS version

Hi, I have one request which need your assitance, the request is that, we have some applications which can't modify the TLS version to 1.2 or 1.3, these applications need to be published, so I want ...
application delivery
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 24, 2022

Most definitely. BIG-IP is a full proxy, so you can control the cipher properties on each side of the proxy independently.

  • mahjoub's avatar
    mahjoub
    Icon for Cirrus rankCirrus
    Oct 24, 2022

    Hi Kevin,

    Thanks for your reply, would you guide me how to perform this.

    Thanks in advance.

    • Kevin_Stewart's avatar
      Kevin_Stewart
      Icon for Employee rankEmployee
      Oct 24, 2022

      Configure a client SSL profile that supports TLS 1.2 and 1.3, and a separate server SSL profile that supports TLS 1.1 and 1.0.

      I the full proxy architecture, the client SSL profile works on the client side of the proxy and acts as the server to the TLS session. The client sends a Client Hello message and list of supported ciphers, and the server (BIG-IP) picks one of the ciphers to continue the TLS handshake. The server SSL profile works on the server side of the proxy and acts as the client to the TLS session. It sends a Client Hello to the server with its list of supported ciphers. This list comes from the cipher string defined in the server SSL profile.