Forum Discussion

JD_Tomzak's avatar
JD_Tomzak
Icon for Cirrus rankCirrus
Jan 14, 2020

Irule to help root out TLS 1.0 and 1.1 connecting clients?

Hello,

 

I've been asked to assist the dev team in removing TLS 1.0 and 1.1 from our internet facing applications. In order to figure out what clients are still accessing at this level I've been asked to provide two things. Source IP with requested URL/URL for each of the weaker TLS protocol connections. Has anyone ever attempted to build an Irule to log this kind of info? Thanks, -JD

BIG-IP
iRules
security
  • iaine's avatar
    iaine
    Icon for Nacreous rankNacreous
    Jan 15, 2020

    Hi

    Something like this could be a good starting point.

    when HTTP_REQUEST {
 
if {([SSL::cipher version] == "TLSv1.1") || ([SSL::cipher version] == "TLSv1.0")}{
    log local0. "Client [IP::local_addr] is accessing [HTTP::uri] with [SSL::cipher version]"
    }
}
  • JD_Tomzak's avatar
    JD_Tomzak
    Icon for Cirrus rankCirrus
    Jan 15, 2020

    Thanks! I'll give that a try.

    Now if I could just make that work in Radware...

    -JD