SSL Ciphers

Do you mean for WebUI access or for SSL offloading? The approach varies slightly according to which you intend to change.

You should find the following solution articles instructive:

• SOL8802: Using SSL ciphers with BIG-IP Client SSL and Server SSL profiles
• SOL13163: SSL ciphers supported on BIG-IP platforms (11.x)
• SOL15194: Overview of the BIG-IP SSL/TLS cipher suite
• SOL13171: Configuring the cipher strength for SSL profiles (11.x)
• SOL13156: SSL ciphers used in the default SSL profiles (11.x)
• SOL13405: Restricting Configuration utility access to clients using high encryption SSL ciphers (11.x)

Do you mean for WebUI access or for SSL offloading? The approach varies slightly according to which you intend to change.

You should find the following solution articles instructive:

• SOL8802: Using SSL ciphers with BIG-IP Client SSL and Server SSL profiles
• SOL13163: SSL ciphers supported on BIG-IP platforms (11.x)
• SOL15194: Overview of the BIG-IP SSL/TLS cipher suite
• SOL13171: Configuring the cipher strength for SSL profiles (11.x)
• SOL13156: SSL ciphers used in the default SSL profiles (11.x)
• SOL13405: Restricting Configuration utility access to clients using high encryption SSL ciphers (11.x)

This should get you what you need:

!SSLv3:!EXPORT:RSA+AES:RSA+AES-GCM:ECDHE+3DES:@strength

Which produces the following cipher list:

AES256-SHA256                    256  TLS1.2  Native  AES       SHA256  RSA       
AES256-SHA                       256  TLS1    Native  AES       SHA     RSA       
AES256-SHA                       256  TLS1.1  Native  AES       SHA     RSA       
AES256-SHA                       256  TLS1.2  Native  AES       SHA     RSA       
AES256-SHA                       256  DTLS1   Native  AES       SHA     RSA       
AES256-GCM-SHA384                256  TLS1.2  Native  AES-GCM   SHA384  RSA       
ECDHE-RSA-DES-CBC3-SHA           192  TLS1    Native  DES       SHA     ECDHE_RSA 
ECDHE-RSA-DES-CBC3-SHA           192  TLS1.1  Native  DES       SHA     ECDHE_RSA 
ECDHE-RSA-DES-CBC3-SHA           192  TLS1.2  Native  DES       SHA     ECDHE_RSA 
AES128-SHA256                    128  TLS1.2  Native  AES       SHA256  RSA       
AES128-SHA                       128  TLS1    Native  AES       SHA     RSA       
AES128-SHA                       128  TLS1.1  Native  AES       SHA     RSA       
AES128-SHA                       128  TLS1.2  Native  AES       SHA     RSA       
AES128-SHA                       128  DTLS1   Native  AES       SHA     RSA       
AES128-GCM-SHA256                128  TLS1.2  Native  AES-GCM   SHA256  RSA

Because of the recent Logjam vulnerabilities targeting Diffie-Helman

https://weakdh.org/

A recommended course of action is to simply prefer ECDHE (instead of DHE). So a good cipher string would be something like this:

!SSLv2:!EXPORT:ECDHE+AES-GCM:ECDHE+AES:ECDHE+3DES:RSA+AES-GCM:RSA+AES:RSA+3DES:-MD5:-SSLv3:-RC4

Ah, do you have any hotfixes applied to 11.5.1?

A fix has been applied to 11.5.1 HF6 and 11.6.0, so you'll need to get there soon. In the meantime, per:

https://devcentral.f5.com/articles/cve-2014-3566-poodle-vs-cve-2014-8730-tls-poodle

and

https://support.f5.com/kb/en-us/solutions/public/15000/800/sol15882.html

the workaround cipher string is:

!SSLv3:AES-GCM:RC4-SHA

This cipher string !SSLv3:AES-GCM:RC4-SHA also gives Grade F

until i upgrade my big-ip do you have a cipher string for ver 11.5.1 that will give a least grade B?

Unfortunately you're best bet is probably to patch. Any workaround cipher string will severely limit access to older clients. On an 11.6.0 box the DEFAULT stack should get you a B.

Did you try the first cipher string?

!SSLv3:!EXPORT:RSA+AES:RSA+AES-GCM:ECDHE+3DES:@strength