Big IP F5 - Weak Ciphers Disabling

[Olivier_J_]

Hello all (sorry for my english)

After a scan security, i have to disable these weak ciphers, but i don't know how to do it :(.

I inputed ECDHE+AES-GCM:ECDHE+AES:ECDHE+3DES:RSA+AES-GCM:RSA+AES:!SSLv2:!SSLv3:!DH:!ADH:!EDH:!MD5:!EXPORT:!DES:!RC4, but this Cipher string is invalid. What is the error ?

Is there a tools to generate a Cipher suite ?

TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000A)

TLS_RSA_WITH_AES_128_CBC_SHA (0x002F)

TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xC009)

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xC00A)

TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003C)

TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003D)

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xC023)

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xC024)

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xC013)

TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009C)

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xC014)

TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009D)

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xC027)

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xC028)

Thanks à lot in advance.

Have a nice day.

OJ

[Mayur_Sutare]

Hi  ,

Below article explains the usage and format of SSL/TLS cipher suites used by BIG-IP SSL profiles.

https://support.f5.com/csp/article/K15194

[Olivier_J_]

Hello Mayur,

Thanks a lot for your answer, i'going to read this article and i will come back if i won't understand it.

I wish you an happy new year 🐵

OJ