CVE-2026-20171

mediumPriorität · verfolgen · 0EPSS 0.005 · 40. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.47% (40th) EPSS

CVSS 6.8 · medium

Is it mine?

178 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to trigger BGP peer flaps, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect parsing of a transitive BGP attribute. An attacker could exploit this vulnerability by sending a crafted BGP update through an established BGP peer session. If the update propagates to an affected device, it could cause the device to drop the BGP session and flap with the BGP peer that is forwarding this update, resulting in a DoS condition.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenCisco NX-OS Software 10.2(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(1q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(2a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(3t) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(3v) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(7) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(8) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(9) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.2(9) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3r) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(4h) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(99w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(99x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3e) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3t) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.6(1s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
WorkaroundCisco NX-OS Software 10.2(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(1q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(2a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(3t) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(3v) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(7) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(8) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(9) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(9) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3r) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4h) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(99w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(99x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3e) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3t) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.6(1s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.8mediumAV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · ENISA EU

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · psirt@cisco.com USAusnutzbarkeit 2.2 · Auswirkung 4

v3.16.2mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · Cisco PSIRT US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-670USCWE-670US

betroffene Produkte (178)

Betroffene Produkte und Versionsbereiche.

Cisco NX-OSalle Versionencert_bundDEcpe:/o:cisco:nx-os:-
Cisco Nexus 3000 Series Switchesalle Versionencert_bundDEcpe:/h:cisco:nexus:3000_series_switches
Cisco Nexus 9000 Series Switchesalle Versionencert_bundDEcpe:/h:cisco:nexus:9000_series_switches
Cisco NX-OS Software 10.2(1) when installed on Cisco Nexus 3000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(1) when installed on Cisco Nexus 9000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(1q) when installed on Cisco Nexus 9000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(2) when installed on Cisco Nexus 3000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(2) when installed on Cisco Nexus 9000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(2a) when installed on Cisco Nexus 9000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(3) when installed on Cisco Nexus 3000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(3) when installed on Cisco Nexus 9000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(3t) when installed on Cisco Nexus 3000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(3v) when installed on Cisco Nexus 3000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(4) when installed on Cisco Nexus 3000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(4) when installed on Cisco Nexus 9000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(5) when installed on Cisco Nexus 3000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(5) when installed on Cisco Nexus 9000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(6) when installed on Cisco Nexus 3000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(6) when installed on Cisco Nexus 9000 Series Switchesalle Versionencisco_csafUS
Cisco NX-OS Software 10.2(7) when installed on Cisco Nexus 3000 Series Switchesalle Versionencisco_csafUS

20 von 178 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-1622Cisco Nexus 3000- und 9000-Switches im Standalone-NX-OS-Modus: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-05-20csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Nexus 3000- und Nexus 9000-Switch-Serie im Standalone-NX-OS-Modus ausnutzen, um einen Denial of Service Angriff durchzuführen.
cisco-sa-bgp-iefab-3hb2pwtxCisco Nexus 3000 and 9000 Series Switches Border Gateway Protocol Denial of Service Vulnerability2026-05-20csaf · cisco_csafUS
A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to trigger BGP peer flaps, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect parsing of a transitive BGP attribute. An attacker could exploit this vulnerability by sending a crafted BGP update through an established BGP peer session. If the update propagates to an affected device, it could cause the device to drop the BGP session and flap with the BGP peer that is forwarding this update, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund cisco_csaf NVD CVE.org MITRE

veröffentlicht 2026-05-20geändert 2026-07-23

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan