Forum Discussion

Korai's avatar
Korai
Icon for Nimbostratus rankNimbostratus
Apr 02, 2020

TLS/SSL Version Test Tool

Hi,   Is there any way to test SSL/TLS version currently running through F5 so that I can disable/remove weak Ciphers and SSLV3/TLS1.0 and TLS.1.1 versions. So I need to disable SSLv3/TLS1.0 and...
BIG-IP
cloud
LTM
security
Rahul_Kaul's avatar
Rahul_Kaul
Icon for Cirrus rankCirrus
Apr 03, 2020

Hi Korai,

 

To test Ciphers you can use Wireshark to check the "Server Hello" as below to know F5 selected which ciphers from client cipher list negotiation or you can use a command in as below.

[root@lb2:Standby:In Sync] config # openssl s_client -cipher 'ECDHE-RSA-AES256-GCM-SHA384' -connect 192.168.148.184:443

 

Cipher suites are configured per SSL Profiles(Client/Server), you need to type "TLSv1_2" in cipher strings as seen below to only support TLSv1_2 ciphers.

 

You can also check via CLI by typing command to check TLSv1.2 support ciphers only as below.

[root@lb2:Standby:In Sync] config # tmm --clientcipher TLSv1_2