Forum Discussion

Alex_f5's avatar
Alex_f5
Icon for Altostratus rankAltostratus
Jan 20, 2018

help with irule to use specific SSL profile based on source IP and cipher strength, log required

Hello f5 community, I do have a virtual server with an SSL profile that allows medium (128bit) and high ciphers (256bit), however need to upgrade this VS to use only 256 bit ciphers except for a l...
application delivery
iRules
LTM
Niels_van_Sluis's avatar
Niels_van_Sluis
Icon for MVP rankMVP
Jan 20, 2018

According to the diagram in this article, the CLIENTSSL_HANDSHAKE event occurs after a successful handshake.

 

https://devcentral.f5.com/questions/irule-event-order-https-ssl-client-server-side

 

In case of an client connecting with a medium cipher suite that isn’t whitelisted, the handshake will fail and never trigger the event CLIENTSSL_HANDSHAKE. To make your iRule work, you will need to allow all medium cipher suite connections and reject them for example in the HTTP_REQUEST event.