For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

amolari's avatar
amolari
Icon for Cirrostratus rankCirrostratus
Aug 12, 2014

v11.3 > v11.4.1 server ssl profile change of behaviour? TLS1.2 used by default

Hi using the default server SSL profile in v11.3 (hf8), we see that the bigip uses tls1.0 towards the server. After an upgrade to 11.4.1 (hf4), we see that tls 1.2 is used (rejected by server in our case).

 

  • I haven't found any document on AskF5 listing such change of behaviour, anyone could point me to some if any? Or a document that list the default behaviour (no cipher but tls version).

     

  • We do not want to change the server ssl profile because we use APM and there are several backend servers involved. How can I change/force the TLS version serverside in an iRule?

     

Thanks. Alex

 

application delivery
BIG-IP Access Policy Manager (APM)
deployment
devops
iRules
security
ssl

3 Replies

  • Dan_L1's avatar
    Dan_L1
    Icon for Nimbostratus rankNimbostratus
    Aug 12, 2014

    TLS 1.0 was/is vulnerable to BEAST, pretty sure that's why it defaults to 1.2 in newer code levels.. see: SOL13400

     

  • Sulaiman_85782's avatar
    Sulaiman_85782
    Icon for Nimbostratus rankNimbostratus
    Aug 12, 2014

    We experienced a similar issue. We created a new Server Side SSL profile, where we enabled the No TLSv1.1 and No TLSv1.2 options.

     

    Once we enabled this on the ServerSide SSL Profile our apps started working.

     

  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    Aug 12, 2014

    You can change the cipher string in your server SSL profile like this, as Sulaiman has done:

     

    DEFAULT:!TLSv1_2:!TLSv1_1