For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

pedinopa_170325's avatar
pedinopa_170325
Icon for Nimbostratus rankNimbostratus
Apr 28, 2017

HSTS not enabled

I found the iRules for implementing HSTS. They are inserting the headers but according to SSL labs the header is disabled. Why is this>   1: iRule for HSTS HTTP Virtuals 2: 3: when HTTP...
iRules
security
PSilva's avatar
PSilva
Ret. Employee
Apr 28, 2017

Hi~

 

It seems, according to these articles, that the default is disabled. Maybe check settings to enable?

 

check out:

 

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-profiles-reference-13-0-0/2.html

 

https://support.f5.com/csp/article/K40243113

 

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ssl-inbound-data-protection-how-to-12-0-0/2.html

 

About 2/3 down that last link has steps on how to enable and this video (https://youtu.be/2ykG3f4Kg_0) shows how to enable HSTS in a HTTP profile.

 

Hope that helps

 

ps