For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Parveez_70209's avatar
Parveez_70209
Icon for Nimbostratus rankNimbostratus
Feb 04, 2015

No TLSv1: Will this Disable only TLS1.0 while allow TLS1.1/TLS1.2/TLS1.3 ?

Hi Team,   We are in a process of disabling all SSL plus TLS1.0 version, and we are running 10.2.4 version.   Kindly confirm whether by saying No TLSv1: Will this Disable only TLS1.0 while allo...
Brad_Parker's avatar
Brad_Parker
Icon for Cirrus rankCirrus
Mar 24, 2015

Yes, No TLSv1 will still allow TLSv1.2. According to https://support.f5.com/kb/en-us/solutions/public/11000/400/sol11444.html TLSv1.1 is not included in 10.2.4.

As for the cipher lists you could use 

DEFAULT:!SSLv3:!TLSv1
. This will disable both SSLv3 and TLSv1 while still allowing TLSv1.2(TLSv1.1 is availabel in 11.x)

https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13163.html

Default cipher lists https://support.f5.com/kb/en-us/solutions/public/10000/200/sol10262.html https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13156.html

Ken_McGarrahan_'s avatar
Ken_McGarrahan_
Icon for Nimbostratus rankNimbostratus
Mar 24, 2015
A-ha! Order is the key. Add the ciphers you'll allow at the start of the list, and remove the ones you don't through specification of "-" options, as you've noted above. For example, to allow only AES256-SHA and AES128-SHA over TLSv1.1 or TLSv1.2 or DTLSv1 by removing SSLv3 and TLSv1.0: AES128-SHA:AES256-SHA:-SSLv3:-TLSv1