For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

dw_888_212625's avatar
dw_888_212625
Icon for Nimbostratus rankNimbostratus
Feb 02, 2016

how to disable all weak ciphers and tlsv1 in ltm11.5.3 globally

it is not advisable to modify the default ssl profile, however if we would really need to disable all weak ciphers and tlsv1 protocol globally for all virtual servers, please advise beside creating a...
LTM
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Feb 02, 2016

None of the firmware versions specifically disable TLSv1.0 by default. As for modifying the default SSL profile, you're definitely correct that it isn't advisable, but certainly doable. An alternative would be to create a new client SSL profile and assign that as the parent (or explicit) SSL profile of each VIP. If that's untenable, and you're also not inclined to scripting, then modifying the default cipher string in the default SSL profile might not be a bad option after all.

 

Take a look at the following for guidance on what's provided, by default, in client SSL profile ciphers per version:

 

https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13171.html?sr=51244991