-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Gert,
Gert Doering wrote: > What exactly does this mean? > > - there will never be a fixed 12.0, 12.1, 12.2 or 12.3 IOS, and we > have to upgrade all routers to 12.4 IOS, which is very likely to > require DRAM and Flash upgrades, and in many cases will mean "end of > the affected device, forklift upgrade" (because there might not even > *be* a 12.4 IOS)? Each of these releases life cycle is documented in our End of Life announcements. 12.0: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps1828/prod_end-of-life_notice0900aecd80563fea.html 12.1: http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/prod_eol_notice09186a008032d55c.html 12.2: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6969/ps1835/ps4032/prod_end-of-life_notice0900aecd80330813.html 12.3: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6947/ps5187/prod_end-of-life_notice0900aecd8052e110.html 12.2 and 12.3 have reached their "End of Software Maintenance Release Date" which means we will no longer be releasing scheduled updates. However, they have not reached their last date of support, which means you can still call in and receive assistance from the TAC. If the TAC cannot assist you in deploying workarounds or upgrading to a supported version of software, they can work with your account team to request a rebuild of 12.2 or 12.3. However, since those releases are past their End of Life dates, and approaching Last Date of Support, TAC, your account team and PSIRT will all recommend you start work on a plan to upgrade your software, and if needed your hardware, to a supported release. 12.0 software came out over 10 years ago, and in order to keep our commitment to give you secure software, we must stop supporting stuff this old. It doesn't have the same architecture or support for quality coding and secure features that the later releases have. > [Yes, we could turn off all tunneling, but the tunnels are part of > our 'wash-this-traffic' IDS/IDP solution, and I don't want to lose > that functionality] > > - 12.0-fixed, 12.1-fixed, 12.2-fixed, 12.3-fixed will be shipped later? > > > If someone is listening: please provide at least fixed 12.2 and 12.3 > IOS versions, as this is quite likely going to be a LARGE installed > base of now-very-unhappy customers. 12.0 and 12.1 would be nice as well, > of course. We are indeed listening. We will consider requests for 12.2 or 12.3 software on a case by case basis, but we will not be releasing that software to a wide distribution. I urge you to work with support staff to move to a more current release. > Also, another question remains: the "malformed GRE packet" - does it > have to contain proper tunnel src + tunnel dst IP addresses (in which > cases this is easy to mitigate at our borders and with customer-facing > uRPF), or is it sufficient if the GRE packet has a destination address > that is configured "anywhere on the box", and the source address doesn't > matter? This is not fully clear from the mitigation companion document. The source and destination address must be the configured tunnel addresses. The source address does matter, but it is possible to spoof it. The destination address cannot be any address on the box, it must be the configured destination address. However, you must take into account that the source address could be spoofed. Thanks, - -Wendy Wendy Garvin Cisco PSIRT -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkq6f9AACgkQz/q+G4BEr214ugCgg6Wc7G6/nrpPAeq6CoABIjz8 qJoAnjhDiTHNmeWYmLWEWV04OXTwjKXD =ogYR -----END PGP SIGNATURE----- _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
