BugZero | Cisco BugID CSCup32700 - FlexVPN spoke to spoke tunnels do not apply Author...

Loading...

Operational Defect Database

A free repository of operational (non-security) bugs centralized through custom integrations with leading IT vendors.

Product

BugZero Prevent
BugZero Plan
Operational Risk Scoring
Vendor Integrations

Company

Plans
Value Guide
About
Contact us
Legal

Resources

Blog
ServiceNow App
Trust Center
Risk Management
NIST
DORA

Operational Defect Database

A free repository of operational (non-security) bugs centralized through custom integrations with leading IT vendors.

Product

BugZero Prevent
BugZero Plan
Operational Risk Scoring
Vendor Integrations

Company

Plans
Value Guide
About
Contact us
Legal

Resources

Blog
ServiceNow App
Trust Center
Risk Management
NIST
DORA

©2025 BugZero. All Rights Reserved.

Privacy Policy Terms of Service

BugZero | Cisco BugID CSCup32700 - FlexVPN spoke to spoke tunnels do not apply Author...

ODD
Cisco
CSCup32700

Cisco - Defect ID: CSCup32700

FlexVPN spoke to spoke tunnels do not apply Authorization attributes

ODD
Cisco
CSCup32700

Cisco - Defect ID: CSCup32700

FlexVPN spoke to spoke tunnels do not apply Authorization attributes

Last updated on February 24th, 2026

BugZero Risk Score
6.1 Medium

Overall: 6.1

Severity: 6.4

Lifecycle: 9.1

Popularity: 4.6

What is the BugZero Risk Score?

Cisco Integration

Learn more about where this data comes from

Cisco Integration

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Bug Details

Description

Symptom

When building spoke to spoke tunnels the spokes always send aaa authorization requests to radius to obtain attributes, however they do not always apply the attributes to the configuration. Sometimes they do and sometimes they don't. When building hub to spoke tunnels, the virtual-access interfaces on the hub always have the proper attributes from radius assigned to them. Here is an example of a spoke to spoke tunnel that did honor the attributes: *Jun 11 19:15:00.439: RADIUS: Received from id 1645/5 10.0.0.1:1645, Access-Accept, len 129 *Jun 11 19:15:00.439: RADIUS: User-Name [1] 23 "spoke2.naaustin.local" *Jun 11 19:15:00.439: RADIUS: Cisco AVpair [1] 48 "ip:interface-config=description Spoke to Spoke" Derived configuration : 342 bytes ! interface Virtual-Access1 description Spoke to Spoke <<<<< ip unnumbered GigabitEthernet0/0 Here is the same device with the same remote spoke tested again, and this time it did not honor the attributes, you can see there is no description on the interface. *Jun 11 20:12:43.655: RADIUS: Received from id 1645/11 10.0.0.1:1645, Access-Accept, len 129 *Jun 11 20:12:43.655: RADIUS: User-Name [1] 23 "spoke2.naaustin.local" *Jun 11 20:12:43.655: RADIUS: Cisco AVpair [1] 48 "ip:interface-config=description Spoke to Spoke" Derived configuration : 277 bytes ! interface Virtual-Access1 ip unnumbered GigabitEthernet0/0

Conditions

FlexVPN utilizing Spoke to Spoke tunnels AAA Authorization applied to IKEv2 profiles on spokes using radius

Workaround

None. AAA Authorization Attributes are only supported on Hub-Spoke Tunnels and their application on Spoke to Spoke Tunnels is currently not supported.

Further Problem Description

Change history

2026-02-24 Added: 16.1.0, 16.1.1, 16.1.2, 16.1.3, 16.10.1, 16.10.1a, 16.10.1b, 16.10.1c, 16.10.1d, 16.10.1e, 16.10.1i, 16.10.1s, 16.11.1, 16.11.1a, 16.2.1, 16.2.2, 16.3.1, 16.3.1a, 16.3.2, 16.3.3, 16.3.3a, 16.3.4, 16.3.5, 16.3.5a, 16.3.5b, 16.3.5c, 16.3.6, 16.3.7, 16.3.8, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.1a, 16.6.2, 16.6.2s, 16.6.3, 16.6.4, 16.6.4a, 16.6.4s, 16.6.5, 16.6.5a, 16.6.5b, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.8.1, 16.8.1a, 16.8.1b, 16.8.1c, 16.8.1d, 16.8.1e, 16.8.1s, 16.8.2, 16.8.3, 16.9.1, 16.9.1a, 16.9.1b, 16.9.1c, 16.9.1d, 16.9.1s, 16.9.2, 16.9.2a, 16.9.2s, 16.9.3, 16.9.3h, 3.15.4S_V155_2_S4_FC1, 3.16.2S_V155_3_S2_FC2, 3.16.2aS_V155_3_S2A_FC1, 3.16.2bS_V155_3_S2B_FC1, 3.16.3aS_V155_3_S3A_FC1, 3.16.4S_V155_3_S4_FC1, 3.16.4aS_V155_3_S4A_FC1, 3.16.4bS_V155_3_S4B_FC1, 3.16.4cS_V155_3_S4C_FC1, 3.16.4dS_V155_3_S4D_FC2, 3.16.4eS_V155_3_S4E_FC1, 3.16.4gS_V155_3_S4G_FC1, 3.16.5S_V155_3_S5_FC2, 3.16.5aS_V155_3_S5A_FC3, 3.16.5bS_V155_3_S5B_FC1, 3.16.6S, 3.16.6bS_V155_3_S6B_FC4, 3.16.7S_V155_3_S7_FC1, 3.16.7aS_V155_3_S7A_FC1, 3.16.7bS_V155_3_S7B_FC1, 3.16.8S_V155_3_S8_FC2, 3.16.9S_V155_3_S9_FC3, 3.17.1S_V156_1_S1_FC3, 3.17.1aS_V156_1_S1A_FC1, 3.17.2S_V156_1_S2_FC1, 3.17.3S_V156_1_S3_FC2, 3.17.4S_V156_1_S4_FC2, 3.18.0SP_V156_2_SP_FC2, 3.18.0S_V156_2_SP_FC2, 3.18.0aS_V156_2_S0A_FC1, 3.18.1SP_V156_2_SP1_FC3, 3.18.1S_V156_2_SP1_FC3, 3.18.1aSP_V156_2_SP1A_FC1, 3.18.1bSP_V156_2_SP1B_FC2, 3.18.1cSP_V156_2_SP1C_FC1, 3.18.1gSP_V156_2_SP1G_FC1, 3.18.1hSP_V156_2_SP1H_FC1, 3.18.1iSP_V156_2_SP1I_FC3, 3.18.2SP_V156_2_SP2_FC2, 3.18.2S_V156_2_SP2_FC2, 3.18.2aSP_V156_2_SP2A_FC3, 3.18.3SP_V156_2_SP3_FC4, 3.18.3S_V156_2_SP3_FC4, 3.18.3aSP_V156_2_SP3A_FC1, 3.18.3bSP_V156_2_SP3B_FC2, 3.18.4SP_V156_2_SP4_FC4, 3.18.4S_V156_2_SP4_FC4, 3.18.5SP_V156_2_SP5_FC4, 3.18.6SP_V156_2_SP6_FC4

Relevant Products

Click on a version to see all relevant bugs

Affected versions:No known affected versions

Fixed versions: 16.1.0, 16.1.1, 16.1.2, 16.1.3, 16.10.1, 16.10.1a, 16.10.1b, 16.10.1c, 16.10.1d, 16.10.1e, 16.10.1i, 16.10.1s, 16.11.1, 16.11.1a, 16.2.1, 16.2.2, 16.3.1, 16.3.1a, 16.3.2, 16.3.3, 16.3.3a, 16.3.4, 16.3.5, 16.3.5a, 16.3.5b, 16.3.5c, 16.3.6, 16.3.7, 16.3.8, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.1a, 16.6.2, 16.6.2s, 16.6.3, 16.6.4, 16.6.4a, 16.6.4s, 16.6.5, 16.6.5a, 16.6.5b, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.8.1, 16.8.1a, 16.8.1b, 16.8.1c, 16.8.1d, 16.8.1e, 16.8.1s, 16.8.2, 16.8.3, 16.9.1, 16.9.1a, 16.9.1b, 16.9.1c, 16.9.1d, 16.9.1s, 16.9.2, 16.9.2a, 16.9.2s, 16.9.3, 16.9.3h, 3.15.4S_V155_2_S4_FC1, 3.16.2S_V155_3_S2_FC2, 3.16.2aS_V155_3_S2A_FC1, 3.16.2bS_V155_3_S2B_FC1, 3.16.3aS_V155_3_S3A_FC1, 3.16.4S_V155_3_S4_FC1, 3.16.4aS_V155_3_S4A_FC1, 3.16.4bS_V155_3_S4B_FC1, 3.16.4cS_V155_3_S4C_FC1, 3.16.4dS_V155_3_S4D_FC2, 3.16.4eS_V155_3_S4E_FC1, 3.16.4gS_V155_3_S4G_FC1, 3.16.5S_V155_3_S5_FC2, 3.16.5aS_V155_3_S5A_FC3, 3.16.5bS_V155_3_S5B_FC1, 3.16.6S, 3.16.6bS_V155_3_S6B_FC4, 3.16.7S_V155_3_S7_FC1, 3.16.7aS_V155_3_S7A_FC1, 3.16.7bS_V155_3_S7B_FC1, 3.16.8S_V155_3_S8_FC2, 3.16.9S_V155_3_S9_FC3, 3.17.1S_V156_1_S1_FC3, 3.17.1aS_V156_1_S1A_FC1, 3.17.2S_V156_1_S2_FC1, 3.17.3S_V156_1_S3_FC2, 3.17.4S_V156_1_S4_FC2, 3.18.0SP_V156_2_SP_FC2, 3.18.0S_V156_2_SP_FC2, 3.18.0aS_V156_2_S0A_FC1, 3.18.1SP_V156_2_SP1_FC3, 3.18.1S_V156_2_SP1_FC3, 3.18.1aSP_V156_2_SP1A_FC1, 3.18.1bSP_V156_2_SP1B_FC2, 3.18.1cSP_V156_2_SP1C_FC1, 3.18.1gSP_V156_2_SP1G_FC1, 3.18.1hSP_V156_2_SP1H_FC1, 3.18.1iSP_V156_2_SP1I_FC3, 3.18.2SP_V156_2_SP2_FC2, 3.18.2S_V156_2_SP2_FC2, 3.18.2aSP_V156_2_SP2A_FC3, 3.18.3SP_V156_2_SP3_FC4, 3.18.3S_V156_2_SP3_FC4, 3.18.3aSP_V156_2_SP3A_FC1, 3.18.3bSP_V156_2_SP3B_FC2, 3.18.4SP_V156_2_SP4_FC4, 3.18.4S_V156_2_SP4_FC4, 3.18.5SP_V156_2_SP5_FC4, 3.18.6SP_V156_2_SP6_FC4

Relevant Products

Click on a version to see all relevant bugs

Affected versions:No known affected versions

Fixed versions: 16.1.0, 16.1.1, 16.1.2, 16.1.3, 16.10.1, 16.10.1a, 16.10.1b, 16.10.1c, 16.10.1d, 16.10.1e, 16.10.1i, 16.10.1s, 16.11.1, 16.11.1a, 16.2.1, 16.2.2, 16.3.1, 16.3.1a, 16.3.2, 16.3.3, 16.3.3a, 16.3.4, 16.3.5, 16.3.5a, 16.3.5b, 16.3.5c, 16.3.6, 16.3.7, 16.3.8, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.1a, 16.6.2, 16.6.2s, 16.6.3, 16.6.4, 16.6.4a, 16.6.4s, 16.6.5, 16.6.5a, 16.6.5b, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.8.1, 16.8.1a, 16.8.1b, 16.8.1c, 16.8.1d, 16.8.1e, 16.8.1s, 16.8.2, 16.8.3, 16.9.1, 16.9.1a, 16.9.1b, 16.9.1c, 16.9.1d, 16.9.1s, 16.9.2, 16.9.2a, 16.9.2s, 16.9.3, 16.9.3h, 3.15.4S_V155_2_S4_FC1, 3.16.2S_V155_3_S2_FC2, 3.16.2aS_V155_3_S2A_FC1, 3.16.2bS_V155_3_S2B_FC1, 3.16.3aS_V155_3_S3A_FC1, 3.16.4S_V155_3_S4_FC1, 3.16.4aS_V155_3_S4A_FC1, 3.16.4bS_V155_3_S4B_FC1, 3.16.4cS_V155_3_S4C_FC1, 3.16.4dS_V155_3_S4D_FC2, 3.16.4eS_V155_3_S4E_FC1, 3.16.4gS_V155_3_S4G_FC1, 3.16.5S_V155_3_S5_FC2, 3.16.5aS_V155_3_S5A_FC3, 3.16.5bS_V155_3_S5B_FC1, 3.16.6S, 3.16.6bS_V155_3_S6B_FC4, 3.16.7S_V155_3_S7_FC1, 3.16.7aS_V155_3_S7A_FC1, 3.16.7bS_V155_3_S7B_FC1, 3.16.8S_V155_3_S8_FC2, 3.16.9S_V155_3_S9_FC3, 3.17.1S_V156_1_S1_FC3, 3.17.1aS_V156_1_S1A_FC1, 3.17.2S_V156_1_S2_FC1, 3.17.3S_V156_1_S3_FC2, 3.17.4S_V156_1_S4_FC2, 3.18.0SP_V156_2_SP_FC2, 3.18.0S_V156_2_SP_FC2, 3.18.0aS_V156_2_S0A_FC1, 3.18.1SP_V156_2_SP1_FC3, 3.18.1S_V156_2_SP1_FC3, 3.18.1aSP_V156_2_SP1A_FC1, 3.18.1bSP_V156_2_SP1B_FC2, 3.18.1cSP_V156_2_SP1C_FC1, 3.18.1gSP_V156_2_SP1G_FC1, 3.18.1hSP_V156_2_SP1H_FC1, 3.18.1iSP_V156_2_SP1I_FC3, 3.18.2SP_V156_2_SP2_FC2, 3.18.2S_V156_2_SP2_FC2, 3.18.2aSP_V156_2_SP2A_FC3, 3.18.3SP_V156_2_SP3_FC4, 3.18.3S_V156_2_SP3_FC4, 3.18.3aSP_V156_2_SP3A_FC1, 3.18.3bSP_V156_2_SP3B_FC2, 3.18.4SP_V156_2_SP4_FC4, 3.18.4S_V156_2_SP4_FC4, 3.18.5SP_V156_2_SP5_FC4, 3.18.6SP_V156_2_SP6_FC4

Top Cisco Defects

9.7Defect ID: CSCwe44571
FMC: GEOLOCATION size is causing upgrade failures
9.7Defect ID: CSCvp16482
ASA reloads when establishing simultaneous ASDM sessions
9.7Defect ID: CSCun06260
XE3.13 Gatekeeper Hardening
9.7Defect ID: CSCvf84211
WLC dataplane reloads unexpectedly due to core 0 hung and RML interrupt handling
9.7Defect ID: CSCvf76274
Cisco APs can no longer join the WLC; CAPWAP-3-DTLS_DB_ERR

Ready to prevent the next vendor outage?

Links

Original Vendor Announcement

Cisco Integration

Learn more about where this data comes from

Cisco Integration

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent