BugZero | Cisco BugID CSCvx44834 - ASR1K - ACE entry added after object-group is miss...

Loading...

Operational Defect Database

A free repository of operational (non-security) bugs centralized through custom integrations with leading IT vendors.

Product

BugZero Prevent
BugZero Plan
Operational Risk Scoring
Vendor Integrations

Company

Plans
Value Guide
About
Contact us
Legal

Resources

Blog
ServiceNow App
Trust Center
Risk Management
NIST
DORA

Operational Defect Database

A free repository of operational (non-security) bugs centralized through custom integrations with leading IT vendors.

Product

BugZero Prevent
BugZero Plan
Operational Risk Scoring
Vendor Integrations

Company

Plans
Value Guide
About
Contact us
Legal

Resources

Blog
ServiceNow App
Trust Center
Risk Management
NIST
DORA

©2025 BugZero. All Rights Reserved.

Privacy Policy Terms of Service

BugZero | Cisco BugID CSCvx44834 - ASR1K - ACE entry added after object-group is miss...

ODD
Cisco
CSCvx44834

Cisco - Defect ID: CSCvx44834

ASR1K - ACE entry added after object-group is missing in hardware causing packets drops

ODD
Cisco
CSCvx44834

Cisco - Defect ID: CSCvx44834

ASR1K - ACE entry added after object-group is missing in hardware causing packets drops

Last updated on February 24th, 2026

BugZero Risk Score
7.8 High

Overall: 7.8

Severity: 8.2

Lifecycle: 9.1

Popularity: 4.6

What is the BugZero Risk Score?

Cisco Integration

Learn more about where this data comes from

Cisco Integration

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Bug Details

Description

Symptom

In a large scale ACL config using object-group, any ACE added after the OBG are not added to the hardware table, thereby causing the rule to be missing and the enforcement ignored. The described behavior in this bug can be seen if the supported scale number of ACEs in an ACL is exceeded. As a result, stuck objects and fp download error messages may be generated and not recover without reload. Also, the PI command will not be able to correctly display the total number of ACEs configured once the box enters the broken state.

Conditions

This is seen when object-group is used in combination with regular ACEs. And the root cause is that maximum ACEs in expanded OGACL exceeds the supported maximum, and the platform resources such as memory and TCAM cannot handle it.

Workaround

Delete the ACL, reconfigure it by moving the singular ACEs above the object-group before re-applying on the interface. This can make the new singular ACE work. Or scale can be reduced by removing some OG ACEs to fit the maximum 81920 limit for total expanded ACEs. For OG ACE, each ACE will be expanded to service OG entries * source OG network entries * destination OG network entries.

Further Problem Description

The issue is not seen when the maximum PI limit

Change history

2024-04-02 Added: 16.12.5, 17.3.2

Relevant Products

Click on a version to see all relevant bugs

Affected versions:16.12.5, 17.3.2

Fixed versions: 16.1.0, 16.1.1, 16.1.2, 16.1.3, 16.12.10, 16.12.10a, 16.12.6, 16.12.6a, 16.12.7, 16.12.8, 16.12.9, 16.2.1, 16.2.2, 16.3.1, 16.3.10, 16.3.11, 16.3.1a, 16.3.2, 16.3.3, 16.3.3a, 16.3.4, 16.3.5, 16.3.5a, 16.3.5b, 16.3.5c, 16.3.6, 16.3.7, 16.3.8, 16.3.9, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.10, 16.6.1a, 16.6.2, 16.6.2s, 16.6.3, 16.6.4, 16.6.4a, 16.6.4s, 16.6.5, 16.6.5a, 16.6.5b, 16.6.6, 16.6.7, 16.6.7a, 16.6.8, 16.6.9, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.7.4, 16.8.1, 16.8.1a, 16.8.1b, 16.8.1c, 16.8.1d, 16.8.1e, 16.8.1s, 16.8.2, 16.8.3, 16.9.1, 16.9.1a, 16.9.1b, 16.9.1c, 16.9.1d, 16.9.1s, 16.9.2, 16.9.2a, 16.9.2s, 16.9.3, 16.9.3a, 16.9.3h, 16.9.3s, 16.9.4, 16.9.4c, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 16.9.8, 16.9.8a, 16.9.8b, 17.10.1, 17.10.1a, 17.10.1b, 17.11.1, 17.11.1a, 17.12.02a, 17.12.1, 17.12.1w, 17.12.1x, 17.12.2, 17.12.2a, 17.12.3, 17.13.1, 17.13.1a, 17.3.4, 17.3.4a, 17.3.4b, 17.3.4c, 17.3.5, 17.3.5a, 17.3.5b, 17.3.6, 17.3.7, 17.3.8, 17.3.8a, 17.6.1, 17.6.1a, 17.6.1w, 17.6.1x, 17.6.1y, 17.6.1z, 17.6.1z1, 17.6.2, 17.6.3, 17.6.3a, 17.6.4, 17.6.5, 17.6.5a, 17.6.6, 17.6.6a, 17.7.1, 17.7.1a, 17.7.1b, 17.7.2, 17.8.1, 17.8.1a, 17.9.1, 17.9.1a, 17.9.1w, 17.9.1x, 17.9.1x1, 17.9.1y, 17.9.1y1, 17.9.2, 17.9.2a, 17.9.3, 17.9.3a, 17.9.4, 17.9.4a, 17.9.5, 17.9.5a

Relevant Products

Click on a version to see all relevant bugs

Affected versions:16.12.5, 17.3.2

Fixed versions: 16.1.0, 16.1.1, 16.1.2, 16.1.3, 16.12.10, 16.12.10a, 16.12.6, 16.12.6a, 16.12.7, 16.12.8, 16.12.9, 16.2.1, 16.2.2, 16.3.1, 16.3.10, 16.3.11, 16.3.1a, 16.3.2, 16.3.3, 16.3.3a, 16.3.4, 16.3.5, 16.3.5a, 16.3.5b, 16.3.5c, 16.3.6, 16.3.7, 16.3.8, 16.3.9, 16.4.1, 16.4.2, 16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.10, 16.6.1a, 16.6.2, 16.6.2s, 16.6.3, 16.6.4, 16.6.4a, 16.6.4s, 16.6.5, 16.6.5a, 16.6.5b, 16.6.6, 16.6.7, 16.6.7a, 16.6.8, 16.6.9, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.7.4, 16.8.1, 16.8.1a, 16.8.1b, 16.8.1c, 16.8.1d, 16.8.1e, 16.8.1s, 16.8.2, 16.8.3, 16.9.1, 16.9.1a, 16.9.1b, 16.9.1c, 16.9.1d, 16.9.1s, 16.9.2, 16.9.2a, 16.9.2s, 16.9.3, 16.9.3a, 16.9.3h, 16.9.3s, 16.9.4, 16.9.4c, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 16.9.8, 16.9.8a, 16.9.8b, 17.10.1, 17.10.1a, 17.10.1b, 17.11.1, 17.11.1a, 17.12.02a, 17.12.1, 17.12.1w, 17.12.1x, 17.12.2, 17.12.2a, 17.12.3, 17.13.1, 17.13.1a, 17.3.4, 17.3.4a, 17.3.4b, 17.3.4c, 17.3.5, 17.3.5a, 17.3.5b, 17.3.6, 17.3.7, 17.3.8, 17.3.8a, 17.6.1, 17.6.1a, 17.6.1w, 17.6.1x, 17.6.1y, 17.6.1z, 17.6.1z1, 17.6.2, 17.6.3, 17.6.3a, 17.6.4, 17.6.5, 17.6.5a, 17.6.6, 17.6.6a, 17.7.1, 17.7.1a, 17.7.1b, 17.7.2, 17.8.1, 17.8.1a, 17.9.1, 17.9.1a, 17.9.1w, 17.9.1x, 17.9.1x1, 17.9.1y, 17.9.1y1, 17.9.2, 17.9.2a, 17.9.3, 17.9.3a, 17.9.4, 17.9.4a, 17.9.5, 17.9.5a

Top Cisco Defects

9.7Defect ID: CSCvx82406
Memory leaks in IOS_PRIV_OPER_DB
9.7Defect ID: CSCwf37271
cnssdaemon.log fills up flash partition 2, preventing AP upgrades
9.7Defect ID: CSCwi93213
9800 WLC marked "AAA Server Down" after switchover when using key 6 password encryption
9.7Defect ID: CSCwt50498
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
9.7Defect ID: CSCvz07394
2960X Stack may observe hang/freeze of member switches or complete stack.

Ready to prevent the next vendor outage?

Links

Original Vendor Announcement

Cisco Integration

Learn more about where this data comes from

Cisco Integration

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent