This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco IOS XE Software and have IKEv1 VPN enabled:
- 1000 Series Integrated Services Routers (ISRs)
- 4000 Series ISRs
- Catalyst 8200 Series Edge Platforms
- Catalyst 8300 Series Edge Platforms
- Catalyst 8500 Series Edge Platforms
- Catalyst 8500L Series Edge Platforms
The following features are affected by this vulnerability if they are configured to use IKEv1:
- Dynamic Multipoint VPN (DMVPN)
- Remote Access IPsec VPN (RAVPN)
- Site-to-Site VPN (S2S VPN)
Note: Cisco Group Encrypted Transport VPN (GET VPN) and SSL VPN do not use IKEv1 for IPsec session establishment and are not affected by this vulnerability.
For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.
Determine the Device Configuration
1. Determine Whether IKE (v1 or v2) Is Enabled
To determine whether IKE processing is enabled, use the show ip socket | include 500 or show udp | include 500 EXEC command on the device CLI. If UDP port 500 or UDP port 4500 is open on a device, the device is processing IKE packets.
Note: UDP ports 500 or 4500 or both will be open regardless of whether IKEv1 or IKEv2 is enabled, as both use the same port and protocol numbers.
The following example shows the output of the show udp | include 500 command on a device that is processing IKE packets on UDP ports 500 and 4500 using either IPv4 or IPv6:
Router#show udp | include 500
17 --listen-- 192.168.1.10 500 0 0 2001011 0
17(v6) --listen-- --any-- 500 0 0 2020011 0
17 --listen-- 192.168.1.10 4500 0 0 2001011 0
17(v6) --listen-- --any-- 4500 0 0 2020011 0
If this command returns empty output, the device is not affected by this vulnerability. Otherwise, proceed to step 2.
2. Determine Whether IKEv1 Is Used
To determine whether IKEv1 is being actively used by the device, use the show crypto map EXEC command on the device CLI. A crypto map uses IKEv1 if it does not have an IKEv2 Profile associated. A crypto map is active if there is at least one interface using that crypto map.
The following example shows the output of the show crypto map command on a device that has crypto map CMAP1 configured to use IKEv1 (because no IKEv2 Profile is listed) and enabled on interface GigabitEthernet1:
Router1#show crypto map
Crypto Map IPv4 "CMAP1" 10 ipsec-isakmp
Peer = 192.168.1.100
Access-List SS dynamic: False
Extended IP access list 120
access-list 110 permit ip 192.168.11.0 0.0.0.255 192.168.12.0 0.0.0.255
Current peer: 192.168.1.100
Security association lifetime: 4608000 kilobytes/3600 seconds
Dualstack (Y/N): N Responder-Only (Y/N): N
PFS (Y/N): N
Mixed-mode : Disabled
Transform sets={
AESSET: { esp-256-aes esp-sha256-hmac } ,
}
Interfaces using crypto map CMAP1:
GigabitEthernet1
Router1#
This device is affected by this vulnerability.
The following example shows the output of the show crypto map command on a device that has crypto map CMAP2 configured to use IKEv2 (because an IKEv2 Profile is listed) and enabled on interface GigabitEthernet2:
Router2#show crypto map
Crypto Map IPv4 "CMAP2" 10 ipsec-isakmp
Peer = 192.168.1.200
IKEv2 Profile: profile1
Access-List SS dynamic: False
Extended IP access list 120
access-list 120 permit ip 192.168.21.0 0.0.0.255 192.168.22.0 0.0.0.255
Current peer: 192.168.1.200
Security association lifetime: 4608000 kilobytes/3600 seconds
Dualstack (Y/N): N Responder-Only (Y/N): N
PFS (Y/N): N
Mixed-mode : Disabled
Transform sets={
AESSET: { esp-256-aes esp-sha256-hmac } ,
}
Interfaces using crypto map CMAP2:
GigabitEthernet2
Router2#
If this is the only crypto map configured on the device, this device is not affected by this vulnerability.
