Manual Chapter : Common elements for cipher rules and groups

Applies To:

Show Versions Show Versions

BIG-IP DNS

  • 14.0.0

BIG-IP AFM

  • 14.0.0

BIG-IP Analytics

  • 14.0.0

BIG-IP PEM

  • 14.0.0

BIG-IP ASM

  • 14.0.0

BIG-IP AAM

  • 14.0.0

BIG-IP APM

  • 14.0.0

BIG-IP LTM

  • 14.0.0
Manual Chapter

Common elements for cipher rules and groups

  1. On the Main tab, click
    Local Traffic
    Ciphers
    Rules
    .
    The screen displays a list of pre-built cipher rules.
  2. Click
    Create
    .
  3. In the
    Name
    field, type a name for the cipher rule.
    Never include the prefix
    f5-
    in a cipher rule name. This prefix is reserved for pre-built cipher rules only.
    For example:
  4. In the
    Cipher Suites
    field, type one or more cipher suites.
    For example:
  5. On the Main tab, click
    Local Traffic
    Ciphers
    Groups
    .
    The screen displays a list of pre-built cipher groups.
  6. In the
    Name
    field, type a name for the cipher group.
    Never include the prefix
    f5-
    in a cipher rule name. This prefix is reserved for pre-built cipher groups only.
  7. If you created any custom rules, then in the Cipher Creation area of the screen in the
    Available Cipher Rules
    list, verify that the custom rules appear in the list.
  8. For each cipher rule in the
    Available Cipher Rules
    list, click the plus sign to view the cipher suites included in the rule.
    For example, this shows the cipher suites included in the pre-built cipher rule named
    /Common/f5-ecc
    .
  9. In the
    Available Cipher Rules
    list, select the boxes for the cipher rules you want to allow for negotiating security for SSL connections.
    We strongly recommend that you select the cipher rule
    /Common/f5-default
    , and for added security, select other cipher rules, too.
    Here's an example of a list of available cipher rules that you might see within a cipher group. Notice that we've selected both a pre-built cipher rule and a custom cipher rule:
  10. In the
    Group Details
    setting, move the selected cipher rules to the
    Allow the following
    box.
    Here we see that we're instructing the BIG-IP system to allow, during security negotiation, the cipher suites contained in the selected cipher rules:
  11. Again from the
    Available Cipher Rules
    list, select the boxes for the cipher rules you want to restrict the allowed cipher rules to when negotiating security for SSL connections.
  12. Move the selected cipher rules to the
    Restrict the Allowed list to the following
    box.
  13. If you want to exclude any cipher rules from the allowed list, then from the
    Available Cipher Rules
    list, select the boxes for the rules you want to exclude.
  14. Move the selected cipher rules to the
    Exclude the following from the Allowed list
    box.
  15. From the
    Order
    list, select the order that you want the BIG-IP system to use when negotiating SSL connections.
    The choices are:
    Default
    ,
    Speed
    ,
    Strength
    ,
    FIPS
    , and
    Hardware
    .
  16. In the
    Cryptographic Parameters
    box, view the cipher suites that the BIG-IP system will use to construct the final cipher string, based on the selections you made in the previous steps.
  17. Click
    Finished
    .
  18. Click
    Finished
    .
  19. Click
    Cancel
    .