For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

msmith1356_2932's avatar
msmith1356_2932
Icon for Nimbostratus rankNimbostratus
Jun 05, 2017

Log all TLS v1.0 Connections

I'm looking for an iRule to log all TLS v1.0 connections to a remote logging server.   I'd like to include in the logs the external client IP, VIP, and time.   I'm very new to scripting, so any...
ASM Advanced WAF
iRules
security
dwcoffin_370357's avatar
dwcoffin_370357
Icon for Nimbostratus rankNimbostratus
Aug 22, 2018

Does this break down connections by TLS1.0/1.1/1.2 or lumps all into TLSv1 Requests without specifying the specific versions?

 

jaikumar_f5's avatar
jaikumar_f5
Icon for Noctilucent rankNoctilucent
Aug 23, 2018

Hi Dwcoffin,

If you check the [article](Categorize SSL traffic by version, display as graph),it does break it down with all versions.

If you are looking for Irule for remote logging for all versions,

 

when HTTP_REQUEST {
set hsl [HSL::open -proto UDP -pool syslog_server_pool]
set time [clock format [clock seconds] -format "%d/%b/%Y:%H:%M:%S %Z"]
    if {[SSL::cipher version] equals "TLSv1"} {
        HSL::send $hsl "TLSv1 Request Detected: Time = $time, Client IP:Port = [IP::client_addr]:[TCP::client_port], F5 VIP:Port = [clientside {IP::local_addr}]:[clientside {TCP::local_port}]"
    } 
    if {[SSL::cipher version] equals "TLSv1.1" } {
        HSL::send $hsl "TLSv1.1 Request Detected: Time = $time, Client IP:Port = [IP::client_addr]:[TCP::client_port], F5 VIP:Port = [clientside {IP::local_addr}]:[clientside {TCP::local_port}]"
    }
    if {[SSL::cipher version] equals "TLSv1.2" } {
        HSL::send $hsl "TLSv1.2 Request Detected: Time = $time, Client IP:Port = [IP::client_addr]:[TCP::client_port], F5 VIP:Port = [clientside {IP::local_addr}]:[clientside {TCP::local_port}]"
    }
}