Last Modified: Sep 24, 2026
Affected Product(s):
BIG-IP Install/Upgrade, LTM
Known Affected Versions:
21.1.0, 21.1.0.1, 21.1.0.2
Opened: Mar 31, 2026 Severity: 1-Blocking
After upgrading, creating or modifying a client SSL profile that contains both explicit ciphers and a cipher group results in the following error: "Profile /Common/<profile_name> contain both ciphers and a cipher group" This is commonly observed when deploying VMware VDI configurations using iApp templates, as the iApp template sets explicit ciphers in the SSL profile while the default client/server SSL profiles now include a cipher group (f5-default) due to TLS 1.3 being enabled by default.
Configurations using iApp templates (such as VMware VDI) that configure explicit ciphers in SSL profiles will be unable to deploy or create new configurations after upgrading to Pandora. This blocks VDI deployments and any iApp-based SSL profile creation that relies on the ciphers field. The severity is blocking who depend on iApp templates for automated VDI or SSL profile provisioning.
This issue occurs when all of the following conditions are met: - The BIG-IP system is running a release where TLS 1.3 is enabled by default in client/server SSL profiles. - A client SSL profile is created or modified (directly or via an iApp template such as VMware VDI) that specifies both explicit ciphers and a cipher group. - The default client/server SSL profiles now include the "f5-default" cipher group to support TLS 1.3, and any child profile inheriting from these defaults will conflict if it also sets explicit ciphers.
Option 1 (Recommended): Use cipher-group instead of ciphers with TLS 1.3 enabled Modify the iApp template or SSL profile configuration to use a cipher group instead of explicit ciphers: """ ciphers none cipher-group <cipher-group-name> """ If your cipher strings are specific, you may need to create a custom cipher group that matches your requirements. Option 2: Disable TLS 1.3 and continue using explicit ciphers Set cipher-group to none explicitly and disable TLS 1.3: """" cipher-group none options { <current-setting> no-tlsv1.3 } """" Note: "no-tlsv1.3" is added to the existing options. This restores the pre-upgrade behavior but forgoes the security benefits of TLS 1.3.
None