<p>There are workarounds that address some of these vulnerabilities. </p> <h3>CVE-2021-27853</h3> <p>Administrators may drop packets that cannot have their <strong>ethertype</strong> detected using a Layer 2 access control list (ACL) or where tags are not expected to drop tagged traffic. If a single dot1P header is received, it will still be processed correctly if the network operating system supports it.</p> <p>The following are examples of Layer 2 ACLs that could be implemented on access ports where FHS has been configured:</p> <p><strong>Cisco IOS Software - Switches</strong></p> <blockquote> <pre>!<br>mac access-list extended CSCwa14271<br> permit any any 0x86DD 0x0<br> permit any any 0x800 0x0<br> permit any any 0x806 0x0<br> deny any any<br>!<br>interface GigabitEthernet1/0/1<br> switchport access vlan 5<br> switchport voice vlan dot1p<br> ipv6 nd raguard attach-policy HOSTS<br> mac access-group CSCwa14271 in<br>!</pre> </blockquote> <p><strong>Cisco IOS XE Software - Switches</strong></p> <p>For Cisco IOS XE Software on switches, impact to all FHS features occurs on Cisco IOS Software releases 17.6.1 and later, but earlier than the first fixed release. The issue will not be seen if the access port VLAN also has an active switched virtual interface (SVI). If there are access ports in VLAN 5, for example, this issue will be observed only if <strong>interface vlan 5</strong> is not configured. To mitigate this issue for vulnerable releases of Cisco IOS Software, administrators can ensure that each VLAN assigned to access ports has a corresponding SVI configured. </p> <p>For Cisco IOS XE Software on switches, Dynamic ARP Inspection is affected on all releases. Administrators can configure static ARP entries for the default gateways and critical servers and hosts off the segments that are being protected to protect the critical assets in the environment.</p> <p><strong>Cisco IOS XE Software - Routers</strong></p> <p>For configurations that have a service instance with <strong>encapsulation priority-tagged</strong> and where the environment needs to examine only the first tag (depending on the platform), administrators can either add the keyword <strong>exact </strong>after the <strong>encapsulation priority-tagged </strong>or filter on the <strong>ethertype</strong> field with <strong>encapsulation priority-tagged etype ipv4 , ipv6</strong>.</p> <p>For environments that do not have <strong>encapsulation priority-tagged </strong>assigned to a service instance, to prevent packets that are tagged with <strong>dot1p</strong> at the front of the headers from being forwarded, administrators can configure a service instance that is not assigned to a bridge domain with <strong>encapsulation priority-tagged.</strong></p> <p><strong>Cisco IOS XR Software</strong></p> <p>For configurations that have an l2transport<em> </em>sub interface configured with <strong>encapsulation dot1q|dot1ad priority-tagged </strong>and where the environment needs to examine only the first tag (depending on the platform), administrators can add the keyword <strong>exact </strong>after the <strong>encapsulation dot1q|dot1ad priority-tagged.</strong></p> <p>For environments that do not have <em><strong>e</strong></em><strong>ncapsulation dot1q|dot1ad priority-tagged </strong>assigned to an l2transport sub interface, to prevent packets that are tagged with<strong> dot1p</strong> at the front of the headers from being forwarded, administrators can configure l2transport sub interfaces that are not assigned to a bridge domain with <strong>encapsulation dot1q priority-tagged </strong>and <strong>encapsulation dot1ad priority-tagged</strong>.</p> <p><strong>Cisco NX-OS Software</strong></p> <blockquote> <pre>!<br>mac access-list drop_three_tags<br> deny any any 0x8100<br> deny any any 0x88a8<br> permit any any <br>!<br>interface ethernet 1/4<br> mac port access-group drop_three_tags<br>! </pre> </blockquote> <p><strong>Cisco Small Business Switches</strong></p> <p>To ensure that FHS works correctly on access ports, install a MAC ACL to deny only tagged frames (because they are not to be expected on an access port) or to permit only ARP, IPv4, and IPv6 on all access ports. The following is an example from the Cisco Sx250, 350, and 550 Series Smart Switches and the Cisco Business 250 and 350 Series Smart Switches:</p> <blockquote> <pre>mac access-list extended arp-ip-ip6<br> permit any any 806 0000 ace-priority 1<br> permit any any 800 0000 ace-priority 2<br> permit any any 86dd 0000 ace-priority 3</pre> </blockquote> <p> </p> <h3>CVE-2021-27861</h3> <p>The principle for mitigating CVE-2021-27861 is to drop any packets that cannot have their Layer 3 protocol detected using a Layer 2 ACL.</p> <p>The following are examples of Layer 2 ACLs that could be implemented on access ports where FHP has been configured:</p> <p><strong>Cisco IOS Software - Switches</strong></p> <p>No mitigations or workarounds.</p> <p><strong>Cisco IOS XR Software</strong></p> <p>No mitigations or workarounds.</p> <p><strong>Cisco NX-OS Software</strong></p> <blockquote> <pre>!<br>interface Ethernet1/3<br> switchport<br> switchport access vlan 5<br> mac port access-group drop_non<br> ipv6 nd raguard attach-policy HOSTS<br>!<br>interface Ethernet1/4<br> switchport<br> switchport access vlan 5<br> mac port access-group drop_non<br> ipv6 nd raguard attach-policy CSCvw92154<br>!<br>mac access-list drop_non<br> 10 permit any any 0x86dd<br> 20 permit any any ip<br> 30 permit any any 0x806<br> 35 permit any 0100.0ccc.cccc 0000.0000.0000<br> 40 deny any any<br>!</pre> </blockquote> <p><strong>Cisco Small Business Switches</strong></p> <p>No mitigations or workarounds.</p> <p>While these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.</p>