ltm profile client-ssl client_ssl_luno {
    alert-timeout indefinite
    allow-dynamic-record-sizing disabled
    allow-expired-crl disabled
    allow-non-ssl disabled
    app-service none
    authenticate once
    authenticate-depth 9
    ca-file none
    cache-size 262144
    cache-timeout 3600
    cert default.crt
    cert-extension-includes { basic-constraints subject-alternative-name }
    cert-key-chain {
        default {
            app-service none
            cert default.crt
            chain none
            key default.key
            ocsp-stapling-params none
            passphrase none
        }
    }
    cert-lifespan 30
    cert-lookup-by-ipaddr-port disabled
    chain none
    ciphers RSA+AES+SHA256:@STRENGTH:RSA:AES:RSA+3DES:!SSLv3:!ECDHE:!AES-GCM
    client-cert-ca none
    crl-file none
    defaults-from clientssl
    description none
    destination-ip-blacklist none
    destination-ip-whitelist none
    forward-proxy-bypass-default-action intercept
    generic-alert enabled
    handshake-timeout 10
    hostname-blacklist none
    hostname-whitelist none
    inherit-certkeychain true
    key default.key
    max-active-handshakes indefinite
    max-aggregate-renegotiation-per-minute indefinite
    max-renegotiations-per-minute 5
    maximum-record-size 16384
    mod-ssl-methods disabled
    mode enabled
    options { dont-insert-empty-fragments }
    partition Common
    passphrase none
    peer-cert-mode ignore
    peer-no-renegotiate-timeout 10
    proxy-ca-cert none
    proxy-ca-key none
    proxy-ca-passphrase none
    proxy-ssl disabled
    proxy-ssl-passthrough disabled
    renegotiate-max-record-delay indefinite
    renegotiate-period indefinite
    renegotiate-size indefinite
    renegotiation enabled
    retain-certificate true
    secure-renegotiation require
    server-name none
    session-mirroring disabled
    session-ticket disabled
    session-ticket-timeout 0
    sni-default false
    sni-require false
    source-ip-blacklist none
    source-ip-whitelist none
    ssl-forward-proxy disabled
    ssl-forward-proxy-bypass disabled
    ssl-sign-hash any
    strict-resume disabled
    unclean-shutdown enabled
}
ltm profile client-ssl clientssl-secure {
    alert-timeout indefinite
    allow-dynamic-record-sizing disabled
    allow-expired-crl disabled
    allow-non-ssl disabled
    app-service none
    authenticate once
    authenticate-depth 9
    ca-file none
    cache-size 262144
    cache-timeout 3600
    cert default.crt
    cert-extension-includes { basic-constraints subject-alternative-name }
    cert-key-chain {
        default {
            app-service none
            cert default.crt
            chain none
            key default.key
            ocsp-stapling-params none
            passphrase none
        }
    }
    cert-lifespan 30
    cert-lookup-by-ipaddr-port disabled
    chain none
    ciphers RSA+AES:RSA+3DES:!SSLv2:!SSLv3:!DHE:!LOW:!RC4:!DES:!MD5:!COMPAT:!LOW:!EXP:!EXPORT
    client-cert-ca none
    crl-file none
    defaults-from clientssl
    description none
    destination-ip-blacklist none
    destination-ip-whitelist none
    forward-proxy-bypass-default-action intercept
    generic-alert enabled
    handshake-timeout 10
    hostname-blacklist none
    hostname-whitelist none
    inherit-certkeychain false
    key default.key
    max-active-handshakes indefinite
    max-aggregate-renegotiation-per-minute indefinite
    max-renegotiations-per-minute 5
    maximum-record-size 16384
    mod-ssl-methods disabled
    mode enabled
    options { no-ssl }
    partition Common
    passphrase none
    peer-cert-mode ignore
    peer-no-renegotiate-timeout 10
    proxy-ca-cert none
    proxy-ca-key none
    proxy-ca-passphrase none
    proxy-ssl disabled
    proxy-ssl-passthrough disabled
    renegotiate-max-record-delay indefinite
    renegotiate-period indefinite
    renegotiate-size indefinite
    renegotiation disabled
    retain-certificate true
    secure-renegotiation require
    server-name none
    session-mirroring disabled
    session-ticket disabled
    session-ticket-timeout 0
    sni-default false
    sni-require false
    source-ip-blacklist none
    source-ip-whitelist none
    ssl-forward-proxy disabled
    ssl-forward-proxy-bypass disabled
    ssl-sign-hash any
    strict-resume disabled
    unclean-shutdown enabled
}
ltm profile client-ssl clientssl-secure-no-waf-no-ids {
    alert-timeout indefinite
    allow-dynamic-record-sizing disabled
    allow-expired-crl disabled
    allow-non-ssl disabled
    app-service none
    authenticate once
    authenticate-depth 9
    ca-file none
    cache-size 262144
    cache-timeout 3600
    cert default.crt
    cert-extension-includes { basic-constraints subject-alternative-name }
    cert-key-chain {
        default {
            app-service none
            cert default.crt
            chain none
            key default.key
            ocsp-stapling-params none
            passphrase none
        }
    }
    cert-lifespan 30
    cert-lookup-by-ipaddr-port disabled
    chain none
    ciphers ECDHE+AES-GCM:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE+AES:RSA+AES-GCM:RSA+AES+SHA256:RSA+AES:ECDHE+3DES:RSA+3DES:!SSLv3
    client-cert-ca none
    crl-file none
    defaults-from clientssl
    description none
    destination-ip-blacklist none
    destination-ip-whitelist none
    forward-proxy-bypass-default-action intercept
    generic-alert enabled
    handshake-timeout 10
    hostname-blacklist none
    hostname-whitelist none
    inherit-certkeychain false
    key default.key
    max-active-handshakes indefinite
    max-aggregate-renegotiation-per-minute indefinite
    max-renegotiations-per-minute 5
    maximum-record-size 16384
    mod-ssl-methods disabled
    mode enabled
    options { dont-insert-empty-fragments no-sslv2 no-sslv3 }
    partition Common
    passphrase none
    peer-cert-mode ignore
    peer-no-renegotiate-timeout 10
    proxy-ca-cert none
    proxy-ca-key none
    proxy-ca-passphrase none
    proxy-ssl disabled
    proxy-ssl-passthrough disabled
    renegotiate-max-record-delay indefinite
    renegotiate-period indefinite
    renegotiate-size indefinite
    renegotiation enabled
    retain-certificate true
    secure-renegotiation require
    server-name none
    session-mirroring disabled
    session-ticket disabled
    session-ticket-timeout 0
    sni-default false
    sni-require false
    source-ip-blacklist none
    source-ip-whitelist none
    ssl-forward-proxy disabled
    ssl-forward-proxy-bypass disabled
    ssl-sign-hash any
    strict-resume disabled
    unclean-shutdown enabled
}
ltm profile client-ssl ssl_eight {
    alert-timeout indefinite
    allow-dynamic-record-sizing disabled
    allow-expired-crl disabled
    allow-non-ssl disabled
    app-service none
    authenticate once
    authenticate-depth 9
    ca-file none
    cache-size 262144
    cache-timeout 3600
    cert none
    cert-extension-includes { basic-constraints subject-alternative-name }
    cert-key-chain {
        eight_dsa {
            app-service none
            cert eight_dsa
            chain nglab_dsa_2048_int_2a_g1
            key eight_dsa
            ocsp-stapling-params none
            passphrase none
        }
        eight_ecc {
            app-service none
            cert eight_ecc
            chain nglab_ecc_prime256v1_int_2a_g2
            key eight_ecc
            ocsp-stapling-params none
            passphrase none
        }
        eight_rsa {
            app-service none
            cert eight_rsa
            chain nglab_rsa_2048_int_2b_gi-bundle.crt
            key eight_rsa
            ocsp-stapling-params none
            passphrase none
        }
    }
    cert-lifespan 30
    cert-lookup-by-ipaddr-port disabled
    chain none
    ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-ECDSA-AES256-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-DSS-AES128-GCM-SHA256:DHE-DSS-AES256-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:DHE-DSS-AES256-SHA:DHE-DSS-AES256-SHA:DHE-DSS-AES256-SHA:DHE-DSS-AES128-SHA:DHE-DSS-AES128-SHA:DHE-DSS-AES128-SHA:DHE-DSS-AES128-SHA:DEFAULT
    client-cert-ca none
    crl-file none
    defaults-from clientssl
    description none
    destination-ip-blacklist none
    destination-ip-whitelist none
    forward-proxy-bypass-default-action intercept
    generic-alert enabled
    handshake-timeout 10
    hostname-blacklist none
    hostname-whitelist none
    inherit-certkeychain false
    key none
    max-active-handshakes indefinite
    max-aggregate-renegotiation-per-minute indefinite
    max-renegotiations-per-minute 5
    maximum-record-size 16384
    mod-ssl-methods disabled
    mode enabled
    options { dont-insert-empty-fragments }
    partition Common
    passphrase none
    peer-cert-mode ignore
    peer-no-renegotiate-timeout 10
    proxy-ca-cert none
    proxy-ca-key none
    proxy-ca-passphrase none
    proxy-ssl disabled
    proxy-ssl-passthrough disabled
    renegotiate-max-record-delay indefinite
    renegotiate-period indefinite
    renegotiate-size indefinite
    renegotiation enabled
    retain-certificate true
    secure-renegotiation require
    server-name none
    session-mirroring disabled
    session-ticket disabled
    session-ticket-timeout 0
    sni-default false
    sni-require false
    source-ip-blacklist none
    source-ip-whitelist none
    ssl-forward-proxy disabled
    ssl-forward-proxy-bypass disabled
    ssl-sign-hash any
    strict-resume disabled
    unclean-shutdown enabled
}
ltm profile client-ssl ssl_eight_test {
    alert-timeout indefinite
    allow-dynamic-record-sizing disabled
    allow-expired-crl disabled
    allow-non-ssl disabled
    app-service none
    authenticate once
    authenticate-depth 9
    ca-file none
    cache-size 262144
    cache-timeout 3600
    cert eight_rsa
    cert-extension-includes { basic-constraints subject-alternative-name }
    cert-key-chain {
        eight {
            app-service none
            cert eight_rsa
            chain nglab_rsa_2048_int_2b_gi-bundle.crt
            key eight_rsa
            ocsp-stapling-params none
            passphrase none
        }
    }
    cert-lifespan 30
    cert-lookup-by-ipaddr-port disabled
    chain nglab_rsa_2048_int_2b_gi-bundle.crt
    ciphers DEFAULT
    client-cert-ca none
    crl-file none
    defaults-from clientssl
    description none
    destination-ip-blacklist none
    destination-ip-whitelist none
    forward-proxy-bypass-default-action intercept
    generic-alert enabled
    handshake-timeout 10
    hostname-blacklist none
    hostname-whitelist none
    inherit-certkeychain false
    key eight_rsa
    max-active-handshakes indefinite
    max-aggregate-renegotiation-per-minute indefinite
    max-renegotiations-per-minute 5
    maximum-record-size 16384
    mod-ssl-methods disabled
    mode enabled
    options { dont-insert-empty-fragments }
    partition Common
    passphrase none
    peer-cert-mode ignore
    peer-no-renegotiate-timeout 10
    proxy-ca-cert none
    proxy-ca-key none
    proxy-ca-passphrase none
    proxy-ssl disabled
    proxy-ssl-passthrough disabled
    renegotiate-max-record-delay indefinite
    renegotiate-period indefinite
    renegotiate-size indefinite
    renegotiation enabled
    retain-certificate true
    secure-renegotiation require
    server-name none
    session-mirroring disabled
    session-ticket disabled
    session-ticket-timeout 0
    sni-default false
    sni-require false
    source-ip-blacklist none
    source-ip-whitelist none
    ssl-forward-proxy disabled
    ssl-forward-proxy-bypass disabled
    ssl-sign-hash any
    strict-resume disabled
    unclean-shutdown enabled
}
ltm profile client-ssl ssl_test {
    alert-timeout indefinite
    allow-dynamic-record-sizing disabled
    allow-expired-crl disabled
    allow-non-ssl disabled
    app-service none
    authenticate once
    authenticate-depth 9
    ca-file none
    cache-size 262144
    cache-timeout 3600
    cert none
    cert-extension-includes { basic-constraints subject-alternative-name }
    cert-key-chain {
        ssl_dsa {
            app-service none
            cert eight_dsa
            chain nglab_dsa_2048_int_2a_g1
            key eight_dsa
            ocsp-stapling-params none
            passphrase none
        }
        ssl_rsa {
            app-service none
            cert eight_rsa
            chain nglab_rsa_2048_int_2b_gi-bundle.crt
            key eight_rsa
            ocsp-stapling-params none
            passphrase none
        }
    }
    cert-lifespan 30
    cert-lookup-by-ipaddr-port disabled
    chain none
    ciphers DEFAULT
    client-cert-ca none
    crl-file none
    defaults-from clientssl
    description none
    destination-ip-blacklist none
    destination-ip-whitelist none
    forward-proxy-bypass-default-action intercept
    generic-alert enabled
    handshake-timeout 10
    hostname-blacklist none
    hostname-whitelist none
    inherit-certkeychain false
    key none
    max-active-handshakes indefinite
    max-aggregate-renegotiation-per-minute indefinite
    max-renegotiations-per-minute 5
    maximum-record-size 16384
    mod-ssl-methods disabled
    mode enabled
    options { dont-insert-empty-fragments }
    partition Common
    passphrase none
    peer-cert-mode ignore
    peer-no-renegotiate-timeout 10
    proxy-ca-cert none
    proxy-ca-key none
    proxy-ca-passphrase none
    proxy-ssl disabled
    proxy-ssl-passthrough disabled
    renegotiate-max-record-delay indefinite
    renegotiate-period indefinite
    renegotiate-size indefinite
    renegotiation enabled
    retain-certificate true
    secure-renegotiation require
    server-name none
    session-mirroring disabled
    session-ticket disabled
    session-ticket-timeout 0
    sni-default false
    sni-require false
    source-ip-blacklist none
    source-ip-whitelist none
    ssl-forward-proxy disabled
    ssl-forward-proxy-bypass disabled
    ssl-sign-hash any
    strict-resume disabled
    unclean-shutdown enabled
}
ltm profile client-ssl wild.example.com {
    alert-timeout indefinite
    allow-dynamic-record-sizing disabled
    allow-expired-crl disabled
    allow-non-ssl disabled
    app-service none
    authenticate once
    authenticate-depth 9
    ca-file none
    cache-size 262144
    cache-timeout 3600
    cert default.crt
    cert-extension-includes { basic-constraints subject-alternative-name }
    cert-key-chain {
        default {
            app-service none
            cert default.crt
            chain none
            key default.key
            ocsp-stapling-params none
            passphrase none
        }
    }
    cert-lifespan 30
    cert-lookup-by-ipaddr-port disabled
    chain none
    ciphers DEFAULT
    client-cert-ca none
    crl-file none
    defaults-from clientssl
    description none
    destination-ip-blacklist none
    destination-ip-whitelist none
    forward-proxy-bypass-default-action intercept
    generic-alert enabled
    handshake-timeout 10
    hostname-blacklist none
    hostname-whitelist none
    inherit-certkeychain false
    key default.key
    max-active-handshakes indefinite
    max-aggregate-renegotiation-per-minute indefinite
    max-renegotiations-per-minute 5
    maximum-record-size 16384
    mod-ssl-methods disabled
    mode enabled
    options none
    partition Common
    passphrase none
    peer-cert-mode ignore
    peer-no-renegotiate-timeout 10
    proxy-ca-cert none
    proxy-ca-key none
    proxy-ca-passphrase none
    proxy-ssl disabled
    proxy-ssl-passthrough disabled
    renegotiate-max-record-delay indefinite
    renegotiate-period indefinite
    renegotiate-size indefinite
    renegotiation enabled
    retain-certificate true
    secure-renegotiation require
    server-name none
    session-mirroring disabled
    session-ticket disabled
    session-ticket-timeout 0
    sni-default false
    sni-require false
    source-ip-blacklist none
    source-ip-whitelist none
    ssl-forward-proxy disabled
    ssl-forward-proxy-bypass disabled
    ssl-sign-hash any
    strict-resume disabled
    unclean-shutdown enabled
}
ltm profile fastl4 PROF-FASTL4-FORWARDING {
    app-service none
    client-timeout 30
    defaults-from fastL4
    description none
    explicit-flow-migration disabled
    hardware-syn-cookie enabled
    idle-timeout 3600
    ip-df-mode preserve
    ip-tos-to-client pass-through
    ip-tos-to-server pass-through
    ip-ttl-mode decrement
    ip-ttl-v4 255
    ip-ttl-v6 64
    keep-alive-interval disabled
    late-binding disabled
    link-qos-to-client pass-through
    link-qos-to-server pass-through
    loose-close disabled
    loose-initialization disabled
    mss-override 0
    partition Common
    priority-to-client pass-through
    priority-to-server pass-through
    pva-acceleration full
    pva-dynamic-client-packets 1
    pva-dynamic-server-packets 0
    pva-flow-aging enabled
    pva-flow-evict enabled
    pva-offload-dynamic enabled
    pva-offload-state embryonic
    reassemble-fragments disabled
    receive-window-size 0
    reset-on-timeout enabled
    rtt-from-client disabled
    rtt-from-server disabled
    server-sack disabled
    server-timestamp disabled
    software-syn-cookie disabled
    syn-cookie-whitelist disabled
    tcp-close-timeout 5
    tcp-generate-isn disabled
    tcp-handshake-timeout 5
    tcp-strip-sack disabled
    tcp-timestamp-mode preserve
    tcp-wscale-mode preserve
    timeout-recovery disconnect
}
ltm profile fastl4 PROF-FASTL4-FORWARDING-KEEPALIVE {
    app-service none
    client-timeout 30
    defaults-from PROF-FASTL4-FORWARDING
    description none
    explicit-flow-migration disabled
    hardware-syn-cookie enabled
    idle-timeout 3600
    ip-df-mode preserve
    ip-tos-to-client pass-through
    ip-tos-to-server pass-through
    ip-ttl-mode decrement
    ip-ttl-v4 255
    ip-ttl-v6 64
    keep-alive-interval 1800
    late-binding disabled
    link-qos-to-client pass-through
    link-qos-to-server pass-through
    loose-close disabled
    loose-initialization disabled
    mss-override 0
    partition Common
    priority-to-client pass-through
    priority-to-server pass-through
    pva-acceleration full
    pva-dynamic-client-packets 1
    pva-dynamic-server-packets 0
    pva-flow-aging enabled
    pva-flow-evict enabled
    pva-offload-dynamic enabled
    pva-offload-state embryonic
    reassemble-fragments disabled
    receive-window-size 0
    reset-on-timeout enabled
    rtt-from-client disabled
    rtt-from-server disabled
    server-sack disabled
    server-timestamp disabled
    software-syn-cookie disabled
    syn-cookie-whitelist disabled
    tcp-close-timeout 5
    tcp-generate-isn disabled
    tcp-handshake-timeout 5
    tcp-strip-sack disabled
    tcp-timestamp-mode preserve
    tcp-wscale-mode preserve
    timeout-recovery disconnect
}
ltm profile fastl4 PROF-FASTL4-FORWARDING-UDP {
    app-service none
    client-timeout 30
    defaults-from fastL4
    description none
    explicit-flow-migration disabled
    hardware-syn-cookie enabled
    idle-timeout 120
    ip-df-mode preserve
    ip-tos-to-client pass-through
    ip-tos-to-server pass-through
    ip-ttl-mode decrement
    ip-ttl-v4 255
    ip-ttl-v6 64
    keep-alive-interval disabled
    late-binding disabled
    link-qos-to-client pass-through
    link-qos-to-server pass-through
    loose-close disabled
    loose-initialization disabled
    mss-override 0
    partition Common
    priority-to-client pass-through
    priority-to-server pass-through
    pva-acceleration full
    pva-dynamic-client-packets 1
    pva-dynamic-server-packets 0
    pva-flow-aging enabled
    pva-flow-evict enabled
    pva-offload-dynamic enabled
    pva-offload-state embryonic
    reassemble-fragments disabled
    receive-window-size 0
    reset-on-timeout enabled
    rtt-from-client disabled
    rtt-from-server disabled
    server-sack disabled
    server-timestamp disabled
    software-syn-cookie disabled
    syn-cookie-whitelist disabled
    tcp-close-timeout 5
    tcp-generate-isn disabled
    tcp-handshake-timeout 5
    tcp-strip-sack disabled
    tcp-timestamp-mode preserve
    tcp-wscale-mode preserve
    timeout-recovery disconnect
}
ltm profile http PROF-http {
    accept-xff disabled
    app-service none
    basic-auth-realm none
    defaults-from http
    description none
    encrypt-cookie-secret $M$nt$uuoRXXRLSpoQIhQMGO9vez+8urYyTm5EhURnH3SCBeY=
    encrypt-cookies { b1p }
    enforcement {
        excess-client-headers reject
        excess-server-headers reject
        known-methods { CONNECT DELETE GET HEAD LOCK OPTIONS POST PROPFIND PUT TRACE UNLOCK }
        max-header-count 64
        max-header-size 32768
        max-requests 0
        oversize-client-headers reject
        oversize-server-headers reject
        pipeline allow
        truncated-redirects disabled
        unknown-method allow
    }
    explicit-proxy {
        bad-request-message none
        bad-response-message none
        connect-error-message none
        default-connect-handling deny
        dns-error-message none
        dns-resolver none
        host-names none
        route-domain none
        tunnel-name none
    }
    fallback-host none
    fallback-status-codes none
    header-erase none
    header-insert none
    hsts {
        include-subdomains enabled
        maximum-age 16070400
        mode disabled
    }
    insert-xforwarded-for disabled
    lws-separator none
    lws-width 80
    oneconnect-transformations enabled
    partition Common
    proxy-type reverse
    redirect-rewrite none
    request-chunking preserve
    response-chunking selective
    response-headers-permitted none
    server-agent-name BigIP
    sflow {
        poll-interval 0
        poll-interval-global yes
        sampling-rate 0
        sampling-rate-global yes
    }
    via-host-name none
    via-request preserve
    via-response preserve
    xff-alternative-names none
}
