diff --git a/ansible/roles/haproxy/templates/haproxy.cfg.j2 b/ansible/roles/haproxy/templates/haproxy.cfg.j2
index fffe96fa89..4d87acde80 100644
--- a/ansible/roles/haproxy/templates/haproxy.cfg.j2
+++ b/ansible/roles/haproxy/templates/haproxy.cfg.j2
@@ -16,7 +16,7 @@ global
   stats socket /var/lib/kolla/haproxy/haproxy.sock group kolla mode 660
 {% if kolla_enable_tls_external | bool %}
   ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES
-  ssl-default-bind-options no-sslv3 no-tlsv10
+  ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
   tune.ssl.default-dh-param 4096
 {% endif %}
 
diff --git a/releasenotes/notes/disable_tlsv11-51d6be67d593f7ab.yaml b/releasenotes/notes/disable_tlsv11-51d6be67d593f7ab.yaml
new file mode 100644
index 0000000000..e8ee865ca1
--- /dev/null
+++ b/releasenotes/notes/disable_tlsv11-51d6be67d593f7ab.yaml
@@ -0,0 +1,5 @@
+---
+security:
+  - |
+    Disable TLS 1.1 on haproxy for external network if
+    tls is enabled.