# F5XC TLS security-level cipher mapper

> Map an F5 Distributed Cloud TLS security level to its exact TLS versions and cipher suites, or paste a cipher to see which levels include it - from F5's verbatim TLS Reference.

- Tool: https://ronutz.com/en/tools/f5xc-tls-security-level-mapper
- Family: TLS & transport

---

## What it does

This tool maps between F5 Distributed Cloud (XC) TLS security levels and the cipher suites they negotiate, in both directions. Pick a level - **High**, **Medium**, or **Low** - and it shows the exact minimum and maximum TLS versions and the full cipher list, with each suite annotated by key exchange, forward secrecy, and strength. Or paste a cipher suite (IANA `TLS_*` or OpenSSL dash form) or a whole scanner line, and it tells you which levels include that cipher. Everything runs in your browser.

## The table it is built on

The cipher lists are transcribed verbatim from F5's TLS Reference. Two things about that table catch people out. First, **Default is the High level**: it is minimum TLS 1.2, maximum TLS 1.3, and it is what an HTTPS load balancer with an automatic certificate uses. Second, the levels are **cumulative** - Medium is every High cipher plus four ECDHE-CBC suites, and Low is every Medium cipher plus four static-RSA suites. Every level maxes out at TLS 1.3.

## Why your scanner flags a load balancer

Two field questions come up constantly, and the tool answers both. If a scanner reports **TLS 1.0 or 1.1 enabled**, the load balancer is on **Medium or Low** - those levels are minimum TLS 1.0. The Default/High level is minimum TLS 1.2, so it will not present the old protocols (K000148226). If a scanner reports **weak ciphers**, it is almost always the **static-RSA suites the Low level adds** - they have no forward secrecy, which is exactly what a scanner grades down (K000148079).

## Reading the annotations

Every cipher is tagged with its key exchange (TLS 1.3, ECDHE-ECDSA, ECDHE-RSA, or RSA), whether it provides forward secrecy (PFS), and a strength grade. The ECDHE suites are PFS; the static-RSA suites are not. TLS 1.3 and the AEAD (GCM / ChaCha20) suites are strong; the CBC-SHA suites are medium; the static-RSA suites are weak.

## Standards and references

- [F5 Distributed Cloud: TLS Reference (predefined security levels and cipher suites)](https://docs.cloud.f5.com/docs-v2/web-app-and-api-protection/reference/tls-reference) - the verbatim cipher table: Default/High (min TLS 1.2), Medium and Low (min TLS 1.0), all max TLS 1.3, cumulative
- [F5 Distributed Cloud: Create TCP Load Balancer (TLS security level semantics)](https://docs.cloud.f5.com/docs-v2/multi-cloud-app-connect/how-to/load-balance/create-tcp-load-balancer) - High = TLS 1.2 + PFS + strong; Medium = TLS 1.0 + PFS + medium; Low = TLS 1.0 + non-PFS + weak
- [F5 K000148226: Why is TLSv1.0/1.1 enabled for F5 XC HTTP LB](https://my.f5.com/manage/s/article/K000148226) - TLS 1.0/1.1 appears when a lower level (Medium/Low, min TLS 1.0) is selected; the Default/High level is min TLS 1.2
- [F5 K000148079: Weak ciphers presented by Load Balancer](https://my.f5.com/manage/s/article/K000148079) - the Low level presents non-PFS static-RSA ciphers that scanners flag as weak

## Related reading

- [F5XC TLS Security Levels Decoded: What High/Medium/Low Negotiate, and Why Your Scanner Flags a Load Balancer](https://ronutz.com/en/learn/f5xc-tls-security-levels-explained.md): The three predefined XC TLS levels plus Custom, why Default is the High level (min TLS 1.2), how the cipher lists are cumulative, why a scanner reports TLS 1.0/1.1 on Medium or Low, and why the Low level's static-RSA ciphers are flagged as weak.