If the output of the show ip nat statistics command does not list any interfaces, NAT is not active on the device.Īlternatively, issue the show running-config command in the CLI to assess whether NAT commands are present in the device configuration. Total active translations: 1 (0 static, 1 dynamic 0 extended) The following example shows the output of the show ip nat statistics command for a device where NAT is active: Router# show ip nat statistics
If NAT is active, the Outside interfaces and Inside interfaces sections of the command output will include at least one interface. To determine whether NAT is active on a device (preferred method), administrators can log in to the device and use the show ip nat statistics command in the CLI. Determine the Device Configurationĭetermine Whether a Device is Configured to Perform NAT Catalyst 8500 Series Edge Platforms models C8500-12X4QC and C8500-12Xįor information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.ASR 1000 Series Embedded Services Processors models ESP 100-X and ESP 200-X.
The DNS ALG feature is enabled as soon as NAT is configured on the device. This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS XE Software that is configured for NAT operation and has the DNS ALG for TCP feature enabled.
For a complete list of the advisories and links to them, see Cisco Event Response: September 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. This advisory is part of the September 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. This advisory is available at the following link: There are no workarounds that address this vulnerability.
This vulnerability cannot be exploited by sending IPv6 traffic.Ĭisco has released software updates that address this vulnerability. Note: This vulnerability can be exploited only by sending IPv4 TCP packets through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition on the affected device. An attacker could exploit this vulnerability by sending crafted DNS packets through the affected device that is performing NAT for DNS packets. This vulnerability is due to a logic error that occurs when an affected device inspects certain TCP DNS packets. A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload.
0 kommentar(er)
