enable tls1.2 on management interface on F5 ltm running version 10.x
Hi Experts , Legacy F5 is having below image and we would like to enable tls1.2 for httpd for management interface so that we can access Web using new browsers. Sys::Version Main Package Product BIG-IP Version 10.2.4 Build 817.0 Edition Hotfix HF7 Date Mon May 20 15:08:56 PDT 2013 We are folllowing stpes mentioned in the "https://my.f5.com/manage/s/article/K40232071" , unfortunately this is for 11.x and above versions. We are getting below error while changing the ssl to tls1.2. (Active)(tmos)# modify /sys httpd ssl-ciphersuite 'ALL:!ADH:!EXPORT:!eNULL:!MD5:!DES:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1' 01070920:3: Application error for confpp: Syntax OK Error in cipher list 25658:error:140E6118:SSL routines:SSL_CIPHER_PROCESS_RULESTR:invalid command:ssl_ciph.c:836: 'ALL:!ADH:!EXPORT:!eNULL:!MD5:!DES:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1' invalid. ************************************************************* Apr 26 13:17:23 CEGP001.IN.com confpp[25610]: syntax check command FAILURE for unix_config_httpd returned: '256' [ OK ]ing httpd: [ OK ] your valuable suggestion helps us to fix GUI issues. from the Browser we are getting , The connection for this site is not secure 10.70.89.37 uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH
SMS server with BIGIP
i have sms server with login page , where you have to enter your name and phone number then you will receive the sms. i have create virtual server with public ip with pool server port 80 . the login page display as expected but i have not receive the sms .is there additionl configration? iRule ?LDAPS and renegotiation
Hello, hope everyone is well! we have a requirement to present 2 different issuer/signed certificates based on the incoming client IP. I am pretty sure from an HTTP perspective I would do something like this when CLIENT_ACCEPTED { if {([class match [IP::client_addr] eq signer_list_of_client_A_IPs]) } { SSL::profile cert_with_issuer_type_A } else { SSL::profile cert_with_issuer_type_B } } when HTTP_REQUEST { SSL::renegotiate } Question I have is whether this would work for LDAPS clients and how (if needed at all) the renegotiation step would be achieved, given that the HTTP_REQUEST will not be available. Many thanks Jon
Need help on i-rule to specific uri path
Hello All, I'm working on an i-rule that I need to do the following; given a set of specific source ip addresses, only allow access to specific uris of /ws/rest/external*. I set the specific source addresses in a data group, referencing the data group. When I apply this i-rule to the virtual server, on testing I get an Insecure HTTPS message. I am on version 15.8.1.2. We plan to upgrade to most stable release on 16 soon. Any suggestions on what I can do with the i-rule posted below? Thanks in advance. when CLIENT_ACCEPTED { if { [class match [IP::client_addr] equals Boomi_external] } { pool esd-bmapi-dc1-as01-f5.lanl.gov_8077_pool } } when HTTP_REQUEST { if ![HTTP::has_responded] { if { ([HTTP::host] equals "apigway-d.lanl.gov" or [HTTP::host] equals "apigway-d.lanl.gov") } { if { [HTTP::uri] starts_with "/ws/rest/external* " || [HTTP::uri] starts_with "/ws/rest/external*" } { pool esd-bmapi-dc1-as01-f5.lanl.gov_8077_pool } else { reject } return } } }
ASM instance creation
HI Team , I have to create an WAF instance similar to the one which is already available . I need help on creating the ASM policy similar to the one which is already used by other VIP . So my ASM policy name is ASM_NETWORK_443 and I have to create an identical policy with name ASM_DRNETWORK_443 . Is there any option to clone the ASM policy or export and import the policy and rename the Policy name ? Kindly help me on this .[ASM] - HTML5 Cross-Domain Request Enforcement - CLI command
Hi Team , 1.Is there any cli command to check if "HTML5 Cross-Domain Request Enforcement" is enabled for any ASM Policy ? 2.CLI command to check the list of allowed URL's ( to reach the below path and find if any url is already allowed ) Security > Application Security > URLs > Allowed URLs ListStable Firmware for F5
Hi All, Currently we have f5 BIG-IP i5600 appliance in our environment. The current firmware version is 15.1.10, we are planning to upgrade the firmware to the n-1 patch or next stable version. I'm new to F5. Can anyone suggest an stable version or guide how to check for the feasible firmware version. The main feature that we use in F5 is Load balancer and we enabled ASM policies for the VIPs. So there should not be any impact on the existing function. Thanks in Advance. Karmegha Kuzhali.F5 VE in Azure - troubles with Sentinel integration
Hi! I'm having F5 Act/Stb cluster - 2 VMs in Azure with 2 traffic interfaces only (external, internal). I use BIG-IP 16.1.3 build 0.0.12 I'm trying for the first time in my life integrate it with Sentinel and so far I fail to do it succesfully. When following this article:https://my.f5.com/manage/s/article/K85539421point by point: Install telemetry extension goes well. I have 1.32.0 build 2 version (downloaded today). curl check is succesful Create iRule - done Create a pool to handle telemetry traffic - ends up with down by monitor. (Manual suggests to use tcp monitor). I tried to support with hints from: https://community.f5.com/t5/technical-articles/deploying-big-ip-telemetry-streaming-with-azure-sentinel-as-its/ta-p/278738, where people suggest to add static route the via internal vlan: net route telemetry { description "Allows monitor to work" interface /Common/internal network 255.255.255.254/32 or changing port lockdown mode: "One more note: the self IP on the chose VLAN you're using for routing the 255.255.255.254 traffic needs to allow TCP 6514, either by setting the "port lockdown" to NONE or adding a custom port." I tried to finish the manual, so: Create a virtual server to listen for Telemetry traffic Create a request-log profile Attach the request logging profile to the virtual server And when it comes to deploy the declaration (which I do via curl with .json file, I get: Has anyone passed through some manual integrating F5 with Azure Sentinel succesfully? Or maybe I'm doing here some obvious mistake? Thanks in advance for your help
