For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

nitass's avatar
nitass
Icon for Employee rankEmployee
Apr 18, 2014

One Quick Question nit, Currently i am using ciphers as ciphers SSLv3:TLSv1_2:TLSv1_1:!TLSv1:!RC4:!MD5:!EXP:!LOW:!EXPORT:!DES:@SPEED

next state will be like ciphers DHE+HIGH:SSLv3:TLSv1_2:TLSv1_1:!TLSv1:!RC4:!MD5:!EXP:!LOW:!EXPORT:!DES:@SPEED

you can display cipher suites using tmm --clientcipher command. and, as Pascal mentioned, sol13171 describes how to add/remove whatever cipher you want.

sol13171: Configuring the cipher strength for SSL profiles (11.x)

http://support.f5.com/kb/en-us/solutions/public/13000/100/sol13171.html?sr=36739985 
[root@B3600-R67-S42:Active:Standalone] config  tmm --clientcipher 'SSLv3:TLSv1_2:TLSv1_1:!TLSv1:!RC4:!MD5:!EXP:!LOW:!EXPORT:!DES:@SPEED'
     ID SUITE                          BITS  PROT  METHOD CIPHER MAC    KEYX
 0:  47 AES128-SHA                      128  SSL3  Native AES    SHA    RSA
 1:  47 AES128-SHA                      128  TLS1.1  Native AES    SHA    RSA
 2:  47 AES128-SHA                      128  TLS1.2  Native AES    SHA    RSA
 3:  53 AES256-SHA                      256  SSL3  Native AES    SHA    RSA
 4:  53 AES256-SHA                      256  TLS1.1  Native AES    SHA    RSA
 5:  53 AES256-SHA                      256  TLS1.2  Native AES    SHA    RSA
 6:  10 DES-CBC3-SHA                    192  SSL3  Native DES    SHA    RSA
 7:  10 DES-CBC3-SHA                    192  TLS1.1  Native DES    SHA    RSA
 8:  10 DES-CBC3-SHA                    192  TLS1.2  Native DES    SHA    RSA
 9:  51 DHE-RSA-AES128-SHA              128  SSL3  Native AES    SHA    EDH/RSA
10:  51 DHE-RSA-AES128-SHA              128  TLS1.1  Native AES    SHA    EDH/RSA
11:  51 DHE-RSA-AES128-SHA              128  TLS1.2  Native AES    SHA    EDH/RSA
12:  57 DHE-RSA-AES256-SHA              256  SSL3  Native AES    SHA    EDH/RSA
13:  57 DHE-RSA-AES256-SHA              256  TLS1.1  Native AES    SHA    EDH/RSA
14:  57 DHE-RSA-AES256-SHA              256  TLS1.2  Native AES    SHA    EDH/RSA
15:  22 DHE-RSA-DES-CBC3-SHA            192  SSL3  Native DES    SHA    EDH/RSA
16:  22 DHE-RSA-DES-CBC3-SHA            192  TLS1.1  Native DES    SHA    EDH/RSA
17:  22 DHE-RSA-DES-CBC3-SHA            192  TLS1.2  Native DES    SHA    EDH/RSA
18:  60 AES128-SHA256                   128  TLS1.2  Native AES    SHA256 RSA
19:  61 AES256-SHA256                   256  TLS1.2  Native AES    SHA256 RSA

[root@B3600-R67-S42:Active:Standalone] config  tmm --clientcipher 'DHE+HIGH:SSLv3:TLSv1_2:TLSv1_1:!TLSv1:!RC4:!MD5:!EXP:!LOW:!EXPORT:!DES:@SPEED'
     ID SUITE                          BITS  PROT  METHOD CIPHER MAC    KEYX
 0:  47 AES128-SHA                      128  SSL3  Native AES    SHA    RSA
 1:  47 AES128-SHA                      128  TLS1.1  Native AES    SHA    RSA
 2:  47 AES128-SHA                      128  TLS1.2  Native AES    SHA    RSA
 3:  53 AES256-SHA                      256  SSL3  Native AES    SHA    RSA
 4:  53 AES256-SHA                      256  TLS1.1  Native AES    SHA    RSA
 5:  53 AES256-SHA                      256  TLS1.2  Native AES    SHA    RSA
 6:  10 DES-CBC3-SHA                    192  SSL3  Native DES    SHA    RSA
 7:  10 DES-CBC3-SHA                    192  TLS1.1  Native DES    SHA    RSA
 8:  10 DES-CBC3-SHA                    192  TLS1.2  Native DES    SHA    RSA
 9:  51 DHE-RSA-AES128-SHA              128  SSL3  Native AES    SHA    EDH/RSA
10:  51 DHE-RSA-AES128-SHA              128  TLS1.1  Native AES    SHA    EDH/RSA
11:  51 DHE-RSA-AES128-SHA              128  TLS1.2  Native AES    SHA    EDH/RSA
12:  57 DHE-RSA-AES256-SHA              256  SSL3  Native AES    SHA    EDH/RSA
13:  57 DHE-RSA-AES256-SHA              256  TLS1.1  Native AES    SHA    EDH/RSA
14:  57 DHE-RSA-AES256-SHA              256  TLS1.2  Native AES    SHA    EDH/RSA
15:  57 DHE-RSA-AES256-SHA              256  DTLS1  Native AES    SHA    EDH/RSA
16:  22 DHE-RSA-DES-CBC3-SHA            192  SSL3  Native DES    SHA    EDH/RSA
17:  22 DHE-RSA-DES-CBC3-SHA            192  TLS1.1  Native DES    SHA    EDH/RSA
18:  22 DHE-RSA-DES-CBC3-SHA            192  TLS1.2  Native DES    SHA    EDH/RSA
19:  22 DHE-RSA-DES-CBC3-SHA            192  DTLS1  Native DES    SHA    EDH/RSA
20:  60 AES128-SHA256                   128  TLS1.2  Native AES    SHA256 RSA
21:  61 AES256-SHA256                   256  TLS1.2  Native AES    SHA256 RSA