Can I route or block traffic based on TLS version or cipher?

Short answer

Yes, when TLS is terminated on TR7 (Encrypted (HTTPS) on an HTTP vService, TCP + TLS on an L7 TCP vService). To never accept certain versions and ciphers, the version and cipher settings in the TLS Security Profile are used; the connection drops in the handshake. To separate the accepted connections, SSL Version and SSL Cipher conditions are created: they are routed to different Backend Services with Conditional Backend Services, and blocked with the Block action on an HTTP vService and with the TCP Connection Management action on an L7 TCP vService. In passthrough, since TLS is not decrypted, this information cannot be read.

Problem: Old Clients Must Be Handled Separately

Clients that arrive with old TLS versions or weak ciphers may need to be rejected, redirected to a warning page or sent to separate, isolated servers as required by the security policy. For this, a decision needs to be made based on the TLS properties of the connection.

Solution: Four Methods

Your situation	Suitable method
Certain versions or ciphers should not be accepted at all	Method 1: TLS Security Profile
To different servers based on version or cipher	Method 2: Conditional Backend Services
Rejecting with a status code on an HTTP vService	Method 3: Block action
Cutting the connection on an L7 TCP vService	Method 4: TCP Connection Management

Method 1: TLS Security Profile Recommended

• How it works Clients that fall outside the lowest and highest version range and the cipher list in the profile are rejected in the handshake; the connection never reaches the conditions.
• Where it is openedCertificates & PKI → TLS Security Profiles
• Requirement An encrypted frontend row on the vService (Encrypted (HTTPS) or TCP + TLS)
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the profile form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → TLS Security Profiles screen, Add is clicked (how to add). If an existing profile is to be changed, the profile is selected and Edit is clicked. Security Profile Name is entered.

2

Adım 2 Set the version range

In the TLS Settings (Frontend & Backend) section, Min. SSL Version is set to the lowest version to be accepted (e.g. TLSv1.2). If TLS 1.3 needs to be disabled, Max. SSL Version is turned on and TLSv1.2 is selected; it is off by default, and no upper limit is applied.

3

Adım 3 Select the cipher set

In the Cipher Algorithms field, one of the ready-made sets is selected, or the Algorithm List is built manually with Manual (How do I disable weak ciphers?). The cipher list determines connections with TLS 1.2 and below.

4

Adım 4 Save the profile

Add at the bottom of the form is clicked (Edit if an existing profile is being edited).

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

6

Adım 6 Select the profile

In the Details panel, the SSL Security box under Frontend Settings is checked and the profile from step 4 is selected (Profile selection on the vService). The box is listed only while an encrypted protocol is selected in at least one frontend row.

7

Adım 7 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1HandshakeClient side

A connection is made with a version outside the profile; the client's own security level is lowered so that it does not block the old version.

Command: openssl s_client -connect 203.0.113.10:443 -servername www.example.com -tls1_1 -cipher 'DEFAULT@SECLEVEL=0'

Expectedalert protocol version · the handshake does not complete

Method 2: Conditional Backend Services

• How it works Connections that match the SSL Version or SSL Cipher condition are sent to separate Backend Services; those that do not match go to the Default Backend Services.
• Where it is openedLoad Balancer → Conditions · vService → Conditional Backend Services
• Requirement TLS terminated on TR7; a Backend Service for the separated traffic
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the condition form

On the Load Balancer → Conditions screen, Add is clicked (how to add).

2

Adım 2 Define the condition

Condition Name is entered (e.g. eski-tls). To separate by version, Criteria = SSL Version is selected and the version is selected from the SSL Protocol list: TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2. To separate by cipher, Criteria = SSL Cipher is selected and the full cipher name is written in the Query field (e.g. ECDHE-RSA-AES128-SHA); the match is the exact name and is case-sensitive.

3

Adım 3 Save the condition

Add is clicked. If more than one version or cipher is to be separated, steps 1–3 are repeated for each; Add & Repeat keeps the form open.

4

Adım 4 Prepare the Backend Services

If the servers to which the separated traffic will go are not defined yet, they are added with Add on the Load Balancer → Backend Services screen (How is a Backend Service added; which information is required?).

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

6

Adım 6 Add the rule

+ Conditional Backend Services in the header of the Backend Services table is clicked; the CONDITIONAL BACKEND #1 block opens above the table (Conditional Backend Services).

7

Adım 7 Define the rule

In the block, the condition from step 3 is selected as the condition; the Backend Services from step 4 are added to the block's Backend Services table. The rules are evaluated from top to bottom, and the first matching rule is applied. Other connections go to the servers in the Default Backend Services table.

8

Adım 8 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1RoutingClient side

One request each is sent with the version in the condition (e.g. TLSv1.1) and with a current version.

Command: curl -sk --tlsv1.1 --tls-max 1.1 --ciphers 'DEFAULT@SECLEVEL=0' https://www.example.com/ · curl -sk https://www.example.com/

ExpectedThe first request receives a response from the separated Backend Service · the second from the Default Backend Services

Method 3: Block Action

• How it works HTTP requests that match the condition are rejected with the selected status code (default 403) or dropped silently with Deny Type.
• Where it is openedLoad Balancer → Actions → Block
• Requirement An SSL Version or SSL Cipher condition created with steps 1–3 of Method 2
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Prepare the condition

If there is no SSL Version or SSL Cipher condition, it is created with steps 1–3 of Method 2.

2

Adım 2 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

3

Adım 3 Define the action

Action Name is entered (e.g. eski-tls-engelle); Action Type = Block is selected. Deny Type is left as Standard and Status Code is selected (default 403). The condition from step 1 is added to the Conditions field.

4

Adım 4 Save the action

Add is clicked.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

6

Adım 6 Select the action

In the Details panel, the Actions box under Modules is checked and the action from step 4 is selected.

7

Adım 7 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1BlockingClient side

A request is sent with the version in the condition.

Command: curl -sk -o /dev/null -w '%{http_code}\n' --tlsv1.1 --tls-max 1.1 --ciphers 'DEFAULT@SECLEVEL=0' https://www.example.com/

Expected403 · requests that arrive with a current version are not affected

Method 4: TCP Connection Management

• How it works On an L7 TCP vService, a connection that matches the condition is rejected (Reject) or dropped without a response (Silent Drop).
• Where it is openedLoad Balancer → Actions → TCP Connection Management
• Requirement Protocol = TCP + TLS in the frontend row; a condition created with steps 1–3 of Method 2
• vService type L7 TCP

Step-by-Step Configuration

1

Adım 1 Prepare the condition

If there is no SSL Version or SSL Cipher condition, it is created with steps 1–3 of Method 2.

2

Adım 2 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

3

Adım 3 Define the action

Action Name is entered; Action Type = TCP Connection Management is selected. Action = Reject or Silent Drop is selected, and the condition from step 1 is added to the Conditions field.

4

Adım 4 Save the action

Add is clicked.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the L7 TCP vService is selected and Edit is clicked.

6

Adım 6 Select the action

In the Details panel, the Actions box is checked and the action from step 4 is selected.

7

Adım 7 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1BlockingClient side

A connection is made with the version in the condition.

Command: openssl s_client -connect 203.0.113.10:443 -tls1_1 -cipher 'DEFAULT@SECLEVEL=0'

ExpectedThe connection closes after the handshake · with a current version, the connection continues

Common Mistakes

• Writing a condition for a version the profile rejects. Since the profile rejects that version in the handshake, the condition is never triggered. First, which versions the profile accepts is checked; the Default Profile accepts TLSv1.1 and above.
• Applying it in passthrough. On an L7 TCP vService with Frontend Protocol = TCP, since TLS is not decrypted, there is no version or cipher information; the condition does not match.
• Looking for TLSv1.0 in the condition. The TLS 1.0 value in the SSL Protocol list is TLSv1.
• Writing a family name in the SSL Cipher condition. The condition matches by the full cipher name, case-sensitively; writing RC4 does not catch the RC4 family. To disable a family completely, Method 1 is used.

How it is done in the documentation

• SSL Version · SSL Protocol
• SSL Cipher · Query
• Block · Status Code
• TCP Connection Management · Action
• TLS Security Profiles · Min. SSL Version

Related questions

• How do I disable TLS 1.0/1.1; is TLS 1.3 supported?
• How do I disable weak ciphers?
• What is a TLS Security Profile, and what does it configure?