How can I find what clients are using TLS 1.0

you can do it in an iRule pretty easily:

when CLIENTSSL_HANDSHAKE {
        switch -glob [SSL::cipher version] {
                "*1.1*" -
                "*1.2*" {
                        log local0. "[IP::client_addr] Good guy."
                }
                default {
                        log local0. "[IP::client_addr] is a horrible ludite."
                }

        }
}

May I ask why you're thinking about disabling TLS1.0 at this point? Is it your self-initiative, or is there an applicable regulation pushing you?

The point in PCI DSS 3.1 which says that TLS1.0 must not be supported is still valid, but the enforcement of the ruling was postponed by 2 years. This means the new deadline for disabling TLS1.0 is 2018 June 30 (this applies to all existing services).

Source: http://blog.pcisecuritystandards.org/migrating-from-ssl-and-early-tls

I'd say go for it, if you feel like doing so. Just keep in mind that there will be considerable impact mainly due to IE10 users (IE10 does not support TLS1.1/1.2 with default configuration). There are also those who use IE8 and IE9 these days. You may estimate that disabling TLS1.0 today will cut off about 1.2% of customer base, out of which 0.7% are legacy IE users and another 0.5% who use another obsolete web browser. (Source: http://www.w3schools.com/browsers/browsers_explorer.asp)

Tip: If you want a decent level of security, and cut off as little customer base as possible, the best tip is to not be more restrictive than large retail banks :). None of the biggest 4 have disabled TLS1.0 at this point.

May I ask why you're thinking about disabling TLS1.0 at this point? Is it your self-initiative, or is there an applicable regulation pushing you?

The point in PCI DSS 3.1 which says that TLS1.0 must not be supported is still valid, but the enforcement of the ruling was postponed by 2 years. This means the new deadline for disabling TLS1.0 is 2018 June 30 (this applies to all existing services).

Source: http://blog.pcisecuritystandards.org/migrating-from-ssl-and-early-tls

I'd say go for it, if you feel like doing so. Just keep in mind that there will be considerable impact mainly due to IE10 users (IE10 does not support TLS1.1/1.2 with default configuration). There are also those who use IE8 and IE9 these days. You may estimate that disabling TLS1.0 today will cut off about 1.2% of customer base, out of which 0.7% are legacy IE users and another 0.5% who use another obsolete web browser. (Source: http://www.w3schools.com/browsers/browsers_explorer.asp)

Tip: If you want a decent level of security, and cut off as little customer base as possible, the best tip is to not be more restrictive than large retail banks :). None of the biggest 4 have disabled TLS1.0 at this point.

I use a different iRule that provides some further information in diagnosing issues like this. The other iRule is just as good but depends on the information you want to collect 🙂

when HTTP_REQUEST {

    if { [info exists logged] && $logged == 1 }{
         Do nothing. Already logged for this connection
    } else {
        set logged 1
        log "Rule DEV_CIPHER_logging fired, from [IP::remote_addr] to vip [IP::local_addr] Cipher [SSL::cipher name]:[SSL::cipher version]:[SSL::cipher bits] Client:[HTTP::header "User-Agent"]:[HTTP::host]"
    }
}

I need to keep the impact on the logs as small as possible until we can get logging going to a separate device. Worse, I do not have full access to the device and must submit my rule for deployment. The vendor does not support irules so it's a long process if something goes wrong. I tried the below but something is wrong:

when CLIENTSSL_HANDSHAKE { switch -glob [SSL::cipher version] { "1.0" - { { log local0. "[IP::client_addr] Old." }

}

The logs show the following: TCL error: tls_1.0_test - extra switch pattern with no body while executing "switch -glob [SSL::cipher version] { "1.0" - { log local0. "[IP::client_addr] Old." } }"

Where did I go wrong?

I fixed my syntax error but the rule does not work. In fact, the website failed to load altogether. Is it possible this rule won't work with 10.2.4?

ltm rule tls_1.0_test { when CLIENTSSL_HANDSHAKE { switch -glob [SSL::cipher version] { "1.0" - { log local0. "[IP::client_addr] Old." } } } }

this might help

when CLIENTSSL_HANDSHAKE { switch -glob [SSL::cipher version] { "1" { log local0. "[IP::client_addr] OLD." } } }