Forum Discussion

jomedusa's avatar
jomedusa
Icon for Cirrus rankCirrus
Jul 23, 2026

LTM policy to x forward the cipher suite used for TLS

We currently have a policy that will send the TLS version that is negotiated on a TLS connection to the back end server for logging via X Forward For.  We would like add what cipher suite is being used so we can report on any weak ciphers being used.

 

To send the TLS version we use:

tcl:[SSL::cipher version] in the policy and it logs within IIS as a customer log entry.

 

I have searched for the valid tcl SSL options are but haven't had much luck.

 

Any assistance/help would be appreciated.

 

Thanks,

Joe

application delivery

1 Reply

  • Daniel_Wolf's avatar
    Daniel_Wolf
    Icon for MVP rankMVP
    Jul 23, 2026

    Hi jomedusa​,

    take a look at this K article: K14525024: Log negotiated SSL cipher suite used by Client and Virtual Server

    I recommend using iRules over LTM policies for logging and adding/modifying HTTP headers, because of their flexibility.
    You can log TLS version and cipher suite used in two different custom headers,like X-TLS-Cipher-Version and X-TLS-Cipher-Name, instead of abusing the XFF header for logging.

    when HTTP_REQUEST {
        # Only makes sense on an TLS-terminated virtual server
        HTTP::header insert X-TLS-Cipher-Name [SSL::cipher name]
        HTTP::header insert X-TLS-Cipher-Version [SSL::cipher version]
}

    Cheers

    Daniel