Forum Discussion

Skuba_85554's avatar
Skuba_85554
Icon for Nimbostratus rankNimbostratus
Feb 12, 2010

best practice for ssl ciphers

hi everyone     we've recently had a security audit and the report has recommended that we disable the following ciphers:   EXP-DES-CBC-SHA   EXP-RC2-CBC-MD5   EXP-RC4-MD5 ...
config
design
L4L7_53191's avatar
L4L7_53191
Icon for Nimbostratus rankNimbostratus
Feb 15, 2010
One thing to note: explicitly setting ciphers can affect the BigIP's ability to offload to hardware, which means you could potentially take a CPU hit. Here are some solutions for you to reference. It also may be worth confirming with support on this for the most recent info.

 

 

Cipher Overviews (basically a bunch of links to other solutions of value for SSL):

 

https://support.f5.com/kb/en-us/solutions/public/8000/800/sol8802.html

 

 

Fully accelerated Ciphers:

 

https://support.f5.com/kb/en-us/solutions/public/5000/700/sol5791.html

 

 

-Matt