Forum Discussion

Jibinpv_254622's avatar
Jibinpv_254622
Icon for Nimbostratus rankNimbostratus
Jul 26, 2017

Enforce TLS1.0 & TLS1.1 to TLS1.2

Hi Team,

 

We have a scenario on our set up where we are accepting only TLS 1.2 connections to the applications and denies all other TLS.This we are doing via irule.

 

However Is there a way we can enforce any of the client connections with are coming as TLS1.0 or TLS1.2 to TLS1.2 on the F5 side with any irule?

 

As like we uses the redirect can we be able to do a TLS versions redirect ? So if someone comes with TLS1 irule will pick it up and force or redirect to TLS1.2 ?

 

I have tried couple of attempts with no luck - Any expert inputs will be of great help.

 

application delivery
iRules
LTM

2 Replies

Sort By
  • Ilian_Ivanov's avatar
    Ilian_Ivanov
    Icon for Nimbostratus rankNimbostratus
    Jul 27, 2017

    Hello,

     

    I dont think that you need iRule to achieve that. You can simply change the ciphers in your clientssl profile.

     

    Example: Use "TLSv1_2" for your clientssl cipher and you will force F5 to negotiate with the clients only with TLSv1.2. In that way you don`t need to redirect anything :)

     

    If I understood you correctly this will work for you.

     

    Regards