Forum Discussion

kwkyiu_53019's avatar
kwkyiu_53019
Icon for Nimbostratus rankNimbostratus
Oct 20, 2014

iRule for checking connection's SSL/TLS protocol version

Hi,

 

In view of POODLE, we are going to disable SSLv3. And we want to find out those clients that are still using it before implementation. But it seems that there are no method to check connection's SSL/TLS protocol version in iRule.

 

SSL::cipher version only tells the protocol version that introduce the negotiated cipher. And there are no event for intercepting traffic from ADC to client.

 

I wonder if there are any function in iRule that can do that.

 

application delivery
devops
iRules
LTM
poodle
security
ssl

12 Replies

Sort By
  • Ryan_80361's avatar
    Ryan_80361
    Icon for Cirrostratus rankCirrostratus
    Oct 20, 2014

    Are you looking to gauge the number of SSLv3 requests or are you wanting to intercept the connection and do something else?

     

    If it's the former, you can view statistics under Overview -> Statistics -> Local Traffic -> Statistics Type (Profile Summary) -> Client SSL

     

    • soymanue's avatar
      soymanue
      Icon for Nimbostratus rankNimbostratus
      Oct 20, 2014
      I haven't been able to find that Gauge. What version should the LTM be running?
    • kwkyiu_53019's avatar
      kwkyiu_53019
      Icon for Nimbostratus rankNimbostratus
      Oct 21, 2014
      Both v10 & v11 had it, if you want per profile stat, use "tmsh show / ltm profile client-ssl"
    • kwkyiu_53019's avatar
      kwkyiu_53019
      Icon for Nimbostratus rankNimbostratus
      Oct 21, 2014
      We are going to log those client IPs, so statistic is not we are looking for
  • Ryannnnnnnnn's avatar
    Ryannnnnnnnn
    Icon for Altocumulus rankAltocumulus
    Oct 20, 2014

    Are you looking to gauge the number of SSLv3 requests or are you wanting to intercept the connection and do something else?

     

    If it's the former, you can view statistics under Overview -> Statistics -> Local Traffic -> Statistics Type (Profile Summary) -> Client SSL

     

    • soymanue's avatar
      soymanue
      Icon for Nimbostratus rankNimbostratus
      Oct 20, 2014
      I haven't been able to find that Gauge. What version should the LTM be running?
    • kwkyiu_53019's avatar
      kwkyiu_53019
      Icon for Nimbostratus rankNimbostratus
      Oct 21, 2014
      Both v10 & v11 had it, if you want per profile stat, use "tmsh show / ltm profile client-ssl"
    • kwkyiu_53019's avatar
      kwkyiu_53019
      Icon for Nimbostratus rankNimbostratus
      Oct 21, 2014
      We are going to log those client IPs, so statistic is not we are looking for
    • kwkyiu_53019's avatar
      kwkyiu_53019
      Icon for Nimbostratus rankNimbostratus
      Oct 21, 2014
      We are using SSL termination (client SSL profile only) thus that iRule does not work. The problem is that there are no event that can intercept ADC to client traffic (we got CLIENT_DATA for client to ADC and SERVER_DATA for server to ADC)
    • kwkyiu_53019's avatar
      kwkyiu_53019
      Icon for Nimbostratus rankNimbostratus
      Oct 21, 2014
      We are using SSL termination (client SSL profile only) thus that iRule does not work. The problem is that there are no event that can intercept ADC to client traffic (we got CLIENT_DATA for client to ADC and SERVER_DATA for server to ADC)