BugZero | Cisco BugID CSCvv05221 - BGP session with TCP AO auth stays down post reloa...

Cisco - Defect ID: CSCvv05221

BGP session with TCP AO auth stays down post reload on standby

Cisco - Defect ID: CSCvv05221

BGP session with TCP AO auth stays down post reload on standby

Last updated on August 13th, 2023

BugZero Risk Score
7.7 High

Overall: 7.7

Severity: 8.2

Lifecycle: 9.1

Popularity: 3.7

What is the BugZero Risk Score?

Cisco Integration

Learn more about where this data comes from

Cisco Integration

Learn more

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

Learn more

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Learn more

Bug Details

Views: 29

Description

General

+++++++ In Steady state +++++++++ BGP neighbor is configured with TCP AO to use type6 key-chain specifically and BGP session are NSR ready. +++++++ Trigger ++++++++++++++ switch-over or RP Fail-over (RPFO) +++++++ Impact +++++++++++++ Post switch-over, On new Standby, TCP is not able to authenticate the incoming BGP packets of the same neighbor which was configured with TCP AO using specifically the type6 key-chain because TCP finds that it has no valid key to authenticate this packet and it drops the packet by logging the below message on console. RP/0/RP1/CPU0:Jun 13 15:38:41.534 IST: tcp[131]: %IP-TCP-3-BADAUTH : Invalid AO digest from 11.1.1.3:49043 to 11.1.1.4:179 for vrf:default (0x60000000) So the impact is only on the standby side w.r.t TCP AO functionality especially with the use of type6 keychain and the NSR of the concerned BGP neighbor (configured with TCP AO using type6 key-chain) session will be impacted. Note - The other BGP neighbors configured with TCP AO using non-type6 key-chain are not impacted. On Active node side, there is no impact at all and TCP will continue to receive and authenticate the incoming BGP packets and forwards them to BGP application. BGP sessions continues to be steady as expected, so there is no traffic impact. ++++++++ Frequency of hitting this issue ++++++++ Rare - 1 out of 5 attempts ----

Symptom

Post switchover, on new standby we can check the following show command to see whether we hit this issue on new standby. +++ show tcp authentication keychain all detail location ++++ Keychain name: bgp-AO-rsp4, configured for tcp-ao Desired key not yet available No notification received from keychain yet Total number of keys: 1 Key details: Key ID: 1, Active, Invalid, reason: config incomplete <<<<< key is invalid due to config incomplete - this shows that we hit this issue Active_state: 1, invalid_bits: 0x1, state: 0x2 Key is configured for tcp-ao, Send ID: 254, Receive ID: 254 Crypto algorithm: AES_128_CMAC_96, key string chksum: 00000000 <<<< see key string is 0. this means TCP could not get key string (password which type6 encrypted) from keychain module during config replay of standby bootup -- this shows that we hit this issue. No notification received from keychain yet No valid overlapping key No keys invalidated No key is usable (i.e. Valid and Active): <<<< No key is usable Now if you see the same show command in new active, AO keychain config is replayed correctly without any error. +++ show tcp authentication keychain all detail location ++++ Keychain name: bgp-AO-rsp4, configured for tcp-ao Desired key: 1 No notification received from keychain yet Total number of keys: 1 Key details: Key ID: 1, Active, Valid <<<< key is valid and active. Active_state: 1, invalid_bits: 0x0, state: 0x3 Key is configured for tcp-ao, Send ID: 254, Receive ID: 254 Crypto algorithm: AES_128_CMAC_96, key string chksum: 010132c7 <<< key string is non-zero means TCP could get the key string (passoword type6) from keychain module without any error. No notification received from keychain yet No valid overlapping key No keys invalidated Total number of usable (Active & Valid) keys: 1 <<< see usable key is 1. Keys: 1,

Conditions

This issue is only seen in case of type6 keychain configured with TCP AO

Workaround

None.

Further Problem Description

Recovery is process restart of tcp on standby node.

Relevant Products

Click on a version to see all relevant bugs

Affected versions:No known affected versions

Fixed versions: 6.7.3, 6.7.35, 6.7.4, 6.8.1, 6.8.2, 6.9.1, 6.9.2, 7.1.25, 7.1.3, 7.2.2, 7.3.0, 7.3.1, 7.3.15, 7.3.16, 7.3.2, 7.3.25, 7.3.26, 7.3.27, 7.3.3, 7.3.4, 7.3.5, 7.4.1, 7.4.15, 7.4.16, 7.4.2, 7.5.1, 7.5.12, 7.5.2, 7.5.3, 7.5.4, 7.6.1, 7.6.15, 7.6.2, 7.7.1, 7.7.2, 7.7.21, 7.8.1, 7.8.2, 7.8.22, 7.9.1, 7.9.2

Relevant Products

Click on a version to see all relevant bugs

Affected versions:No known affected versions

Top Cisco Defects

9.7Defect ID: CSCwq79831
Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution Vulnerability
9.7Defect ID: CSCvv15096
9200L: SYS-3-CPUHOG: Task is running for (2843)msecs, more than (2000)msecs process = SAUtilReport.
9.7Defect ID: CSCwd45843
Auth Step latency for policy evaluation due to Garbage Collection activity.
9.7Defect ID: CSCvm90995
ASR1000-RP2: Rommon fails to boot Cisco IOS software of 1GB size
9.7Defect ID: CSCwa70008
Expired certs cause Security Intelligence updates to fail

Ready to prevent the next vendor outage?

Get a demo

Cisco - Defect ID: CSCvv05221

BGP session with TCP AO auth stays down post reload on standby

Cisco - Defect ID: CSCvv05221

BGP session with TCP AO auth stays down post reload on standby

Last updated on August 13th, 2023

BugZero Risk Score7.7 High

Bug Details

General

Symptom

Conditions

Workaround

Further Problem Description

Top Cisco Defects

Ready to prevent the next vendor outage?

Links

BugZero Risk Score
7.7 High