CVE-2026-20171

mediumpriority · track · 0EPSS 0.005 · 40 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.47% (40th) EPSS

CVSS 6.8 · medium

Is it mine?

178 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to trigger BGP peer flaps, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect parsing of a transitive BGP attribute. An attacker could exploit this vulnerability by sending a crafted BGP update through an established BGP peer session. If the update propagates to an affected device, it could cause the device to drop the BGP session and flap with the BGP peer that is forwarding this update, resulting in a DoS condition.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco NX-OS Software 10.2(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(1q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(2a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(3t) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(3v) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(7) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(8) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(9) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.2(9) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3r) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(4h) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(99w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(99x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3e) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3t) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.6(1s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
WorkaroundCisco NX-OS Software 10.2(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(1q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(2a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(3t) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(3v) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(7) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(8) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(9) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.2(9) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3r) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(3x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(4h) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(99w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.3(99x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3e) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.5(3t) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 3000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco NX-OS Software 10.6(1s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There are two workarounds that address this vulnerability. If an affected device does not need to use the ATTR_SET attribute to carry customer edge (CE) attributes across the ISP network, RFC 6368 states that it is an optional attribute that can be discarded. To discard the attribute and add or update the prefixes that are contained in the update to the routing table, add the path-attribute discard 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute discard 128 in Alternatively, to discard the attribute and remove the prefixes that are contained in the update from the routing table, add the path-attribute treat-as-withdraw 128 in configuration command under the neighbor configuration that is sending it, as shown in the following example: router bgp 64550 neighbor 10.0.0.2 path-attribute treat-as-withdraw 128 in There is also a mitigation. To disable the enforce-first-as global BGP feature on the provider edge (PE) that is receiving the ATTR_SET attribute, configure the no enforce-first-as command, as shown in the following example. This will disable first Autonomous System Number (ASN) checking. router bgp 64550 no enforce-first-as Note: Changing default BGP behavior on Cisco NX-OS Software by disabling this feature will prevent BGP from bringing down a peer adjacency if it receives an unexpected first Autonomous System (AS) in AS_PATH, weakening a security mechanism. To apply this policy change, BGP peers will need to be reset. While these workarounds and this mitigation have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

cvss

Technical severity, 0–10. One row per scoring source.

6.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.8mediumAV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · ENISA EU

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · psirt@cisco.com USexploitability 2.2 · impact 4

v3.16.2mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · Cisco PSIRT US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-670USCWE-670US

affected products (178)

Products and version ranges known to be affected.

Cisco NX-OSall versionscert_bundDEcpe:/o:cisco:nx-os:-
Cisco Nexus 3000 Series Switchesall versionscert_bundDEcpe:/h:cisco:nexus:3000_series_switches
Cisco Nexus 9000 Series Switchesall versionscert_bundDEcpe:/h:cisco:nexus:9000_series_switches
Cisco NX-OS Software 10.2(1) when installed on Cisco Nexus 3000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(1) when installed on Cisco Nexus 9000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(1q) when installed on Cisco Nexus 9000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(2) when installed on Cisco Nexus 3000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(2) when installed on Cisco Nexus 9000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(2a) when installed on Cisco Nexus 9000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(3) when installed on Cisco Nexus 3000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(3) when installed on Cisco Nexus 9000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(3t) when installed on Cisco Nexus 3000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(3v) when installed on Cisco Nexus 3000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(4) when installed on Cisco Nexus 3000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(4) when installed on Cisco Nexus 9000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(5) when installed on Cisco Nexus 3000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(5) when installed on Cisco Nexus 9000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(6) when installed on Cisco Nexus 3000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(6) when installed on Cisco Nexus 9000 Series Switchesall versionscisco_csafUS
Cisco NX-OS Software 10.2(7) when installed on Cisco Nexus 3000 Series Switchesall versionscisco_csafUS

showing 20 of 178

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1622Cisco Nexus 3000- und 9000-Switches im Standalone-NX-OS-Modus: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-05-20csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Nexus 3000- und Nexus 9000-Switch-Serie im Standalone-NX-OS-Modus ausnutzen, um einen Denial of Service Angriff durchzuführen.
cisco-sa-bgp-iefab-3hb2pwtxCisco Nexus 3000 and 9000 Series Switches Border Gateway Protocol Denial of Service Vulnerability2026-05-20csaf · cisco_csafUS
A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to trigger BGP peer flaps, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect parsing of a transitive BGP attribute. An attacker could exploit this vulnerability by sending a crafted BGP update through an established BGP peer session. If the update propagates to an affected device, it could cause the device to drop the BGP session and flap with the BGP peer that is forwarding this update, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisco_csaf NVD CVE.org MITRE

published 2026-05-20modified 2026-07-23

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan