Forum Discussion

Greg_Black's avatar
Greg_Black
Icon for Altostratus rankAltostratus
Apr 18, 2018

iRule for TLS 1.0 to 1.1?

Ok Guys... I have a question that is going to be sort of complex to ask so bear with me. :)

 

I have an F5 BigIP LTM running 12.1.3. I currently have all of my VIPs setup to use TLS 1.1 or greater...TLS1.0 has been disabled for all VIPs. We have an old Linux server that is in the process of being replaced, just not yet (Cent OS). This Linux server is a Send Mail device setup in our F5, but it appears it is still using TLS1.0. One of our customers is very concerned about it, since their PCI compliance is based on them NOT using TLS1.0. Is there anyway for me to set up an iRule or do something in the F5 to allow TLS1.1 and disable 1.0? Sorry, I wasn't sure on how else to ask this...

 

I'm certain I left something out that needs to be known, so if you have any question about the F5 setup please ask away.

 

Thank you for any assistance and moreover your time!

 

Greg (F5 Noob)

 

BIG-IP
iRules
security
  • Greg_Black's avatar
    Greg_Black
    Icon for Altostratus rankAltostratus
    Apr 26, 2018

    Ok, so here is what I ended up doing.

     

    I created a new VIP using the customer's outside IP address (MXToolbox) but confirmed it with them and got their subnet prefix as well. Used port 25 and then for client SSL I used the one we have in play with our cipher disabling TLS1.0. After configuring all this, I tested with the customer and all is set. It turned out to be very simple.