For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

SSesostris_3458's avatar
SSesostris_3458
Icon for Nimbostratus rankNimbostratus
May 03, 2018

Issue on disabling TLS 1.0 / TLS 1.1

Hello,   We have a problem with an LTM (Local Trafic Manager) when we turn off TLS 1.0 and 1.1. Indeed when protocols are disabled in SSL profiles, the F5 does not return any error to the client. ...
iRules
LTM
security
Lee_Sutcliffe's avatar
Lee_Sutcliffe
Icon for Nacreous rankNacreous
May 03, 2018

The problem you have is that SSL negotiation happens prior to HTTP_REQUEST. So if you have disabled TLS 1.0 and the client only uses TLS 1.0, the session will never be established, it will be terminated before you reach the HTTP request event... hence being unable to send an HTTP::response command.

 

It is by design that you do not receive an error in this instance. You would see in the SSL handshake that the version is not supported but this is not obvious to your users unless they are capturing the request using Wireshark for example.

 

What is your actual requirement?