Vulnslist

Using infrastructure access control lists (iACLs) to allow only strictly required management and control plane traffic that is destined to the affected device, as recommended in the Cisco Guide to Securing NX-OS Software Devices https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html , would prevent exploitation of this issue on Nexus devices. Customers may also consider explicitly denying all IP packets with protocol number 4 (corresponding to IP in IP packets) as part of their iACLs, if no legitimate IP in IP traffic is used in their network. A customized control plane policing (CoPP) policy may also be used to drop IP in IP traffic that is destined to an affected device; however, support for CoPP customization varies across different Nexus platforms and software releases. Customers are advised to contact their support organization for any assistance required with evaluating the feasibility of a workaround and with implementing a workaround on an affected device.

Exploitation of this issue on Cisco UCS Fabric Interconnects is only possible if NetFlow monitoring is enabled on an affected device. Customers who do not have a strict requirement of using NetFlow monitoring may evaluate the possibility of disabling it until they can perform a software upgrade to a fixed release.

Customers should first evaluate the impact of configuration changes to the device and their security policy. Customers concerned about undesired or unexpected side effects should consult with their support organization before implementing any configuration change.