Remove TLS_RSA for PFS?

If you are running 11.6.2 HF1, you have already mitigated ROBOT even if you continue to use RSA key Exchange.

K21905460: BIG-IP SSL vulnerability (ROBOT) CVE-2017-6168

Please be aware of the note in K21905460

Note: Fixed BIG-IP versions do not disable RSA key exchange, they eliminate the existing code flaw in our implementation of RSA key exchange. Due to influences outside the control of the BIG-IP system, some SSL rating sites and scanners may falsely report that fixed versions are vulnerable to CVE-2017-6168. In these instances you may want to contact the scanner vendor to report the false positive result.

Thanks very much S.Blakely for your response. I believed I took the necessary mitigation steps & was surprised to see a scanning site provide a false positive. I appreciate you sharing your knowledge. If I may expand on the PFS portion of the question, I just read in another post that "requiring PFS involves setting our clientssl profile cipher string to include only ECDHE and DHE (but not ADH) ciphers and to disallow RSA key exchanges. It can be as simple as setting your cipher string to DEFAULT!RSA or ECDHE:DHE". Does that approach sound correct?

Please flag the comment as answering your query, so that other users searching on this issue can find useful answers.

Thanks

As a fairly new DevCentral user, I am unsure how to flag the comment as answering my query, but I will attempt to find out how to do so & do it for other users.