Forum Discussion

pstavr's avatar
pstavr
Icon for Cirrus rankCirrus
Jan 24, 2020

F5 Server SSL Profile using TLS 1.0 instead of TLS 1.2

Hi   I have an F5 virtual server that does SSL inspection so it has a client ssl profile and a server ssl profile. The backend server is running on a Windows Server 2019 / IIS and it only accepts...
application delivery
BIG-IP
Client Hello
LTM
RST ACK
server ssl profile
tls
  • pstavr's avatar
    pstavr
    Jan 31, 2020

    Hi all.

     

    I found the root cause. The problem was related to the .NET app using SNI. By default the F5 doesn't do that.

    https://devcentral.f5.com/s/articles/ssl-profiles-part-7-server-name-indication

     

    So basically I just followed the fix in the above article, I defined a server name and the backend service started sending Server Hello etc. Everything works fine now!

     

    Thank you all for your responses, as quite a few of them were helpful on identifying that the issue is with the app, and I could also spot a few things that were not proper on the negotiation part.

     

Bobow's avatar
Bobow
Icon for Cirrus rankCirrus
Mar 30, 2020

Hi pstavr,

 

Is this issue resolved? i have the same problem with this.

What solution do you use to improve from the F5 side?

 

Thanks

  • pstavr's avatar
    pstavr
    Icon for Cirrus rankCirrus
    Apr 02, 2020

    Hi Bonow.

     

    Yes, it was happening because the backend servers required SNI support. I have posted an article above from F5 where you can see the solution.

    • Bobow's avatar
      Bobow
      Icon for Cirrus rankCirrus
      Apr 03, 2020

      Well noted. Thank You Bro!

    • jaikumar_f5's avatar
      jaikumar_f5
      Icon for MVP rankMVP
      Apr 06, 2020

       , did your issue resolve. The reason I ask is, there are multiple scenarios where this could happen. One such is shared above, its not that yours could also be as same as above. If its same and issue is fixed. Good to know...