Forum Discussion
gdoyle
Cirrostratus
CirrostratusUse iFile to when only TLS1.0 is being used.
I want to display a custom message to people who are using only TLS1.0 in their browsers as to why they cannot access the website. I used the code below to attempt to do what I wanted after uploading the ifile to the BigIP. Unfortunately I am still able to access the website when testing and am not redirected to the ifile.
How can I redirect users based on their TLS settings?
Thanks!
when HTTP_REQUEST {
if { not ([SSL::cipher version] starts_with "TLSv1.") } {
HTTP::respond 200 content [ifile get message.html] noserver "Content-Type" "text/html" "Cache-Control" "no-cache, must-revalidate" Connection Close
}
}
Yann_DesmarestCirrus
Hi,
You should try adding a log in your irule to make sure that you negociate SSL using TLS1.0
when HTTP_REQUEST { log local0. "[virtual] - SSL version=[SSL::cipher version], client_ip=[IP::client_addr]" if { not ([SSL::cipher version] starts_with "TLSv1.") } { log local0. "[virtual] - SSL version=[SSL::cipher version], client_ip=[IP::client_addr], invalid SSL version" HTTP::respond 200 content [ifile get message.html] noserver "Content-Type" "text/html" "Cache-Control" "no-cache, must-revalidate" Connection Close } }
gdoyleStupid question: How do I view the log? Also, I discovered the the ifile was in the right place on the BigIP apparently. Once I added it there the website is being blocked, but the custom message is not being displayed. Once I can view the log I will see if the SSL/TLS is being negotiated.- Yann_DesmarestYou can go to System >> Logs >> Local Traffic
- Yann_Desmarestor using cli, you can execute the following command to get insight live : tailf /var/log/ltm
Yann_Desmarest_Nacreous
Hi,
You should try adding a log in your irule to make sure that you negociate SSL using TLS1.0
when HTTP_REQUEST { log local0. "[virtual] - SSL version=[SSL::cipher version], client_ip=[IP::client_addr]" if { not ([SSL::cipher version] starts_with "TLSv1.") } { log local0. "[virtual] - SSL version=[SSL::cipher version], client_ip=[IP::client_addr], invalid SSL version" HTTP::respond 200 content [ifile get message.html] noserver "Content-Type" "text/html" "Cache-Control" "no-cache, must-revalidate" Connection Close } }- gdoyleStupid question: How do I view the log? Also, I discovered the the ifile was in the right place on the BigIP apparently. Once I added it there the website is being blocked, but the custom message is not being displayed. Once I can view the log I will see if the SSL/TLS is being negotiated.
- Yann_Desmarest_You can go to System >> Logs >> Local Traffic
- Yann_Desmarest_or using cli, you can execute the following command to get insight live : tailf /var/log/ltm
- gdoyle
It turns out I am having the same issue that I was having attempting to do this via an irule. There are other rules in place and they don't seem to agree perfectly.
Ah well.
- Yann_DesmarestDo you have some errors on the logs ?