Forum Discussion

ToonVA's avatar
ToonVA
Icon for Cirrus rankCirrus
Dec 07, 2018

tmsh command to list client-ssl profiles - Full noted values

I am working on a project to remove TLS1.0 from our F5 BIG-IP systems. The company want first a good overview where TLS1.0 is still used (which VIP's) so i exported those with tmsh command but if the...
BIG-IP
security
TMSH
Shaun_Simmons1's avatar
Shaun_Simmons1
Icon for Altostratus rankAltostratus
Dec 07, 2018

The F5 is security focused and will always negotiate at the highest cipher first, TLS1.2.

 

Profiles -> SSL -> Client -> clientssl (pick whichever parent is used) Ciphers-> "Default" --Will negotiate at TLS1.2

 

Caveat: If the client / server / application cannot negotiate at TLS1.2, it is due to the server not allowing a TLS1.2 cipher or is configured to force a less secure cipher due to compatibility issues.