Cisco Aironet 1300 DoS condition Synopsis ======== Cisco Aironet 1300 running IOS 12.3(8)JA with default settings is vulnerable to a DoS condition. Background ============= Cisco Aironet 1300 is the state-of-art enterprise p2p wireless repeater from Cisco. Supports a wide range of features, including but not limited to vlan trunking, vlan to SSID mapping, WDS, multiple wireless networks, MAC and IP filtering, QoS, SNMP, WPA, RADIUS etc.. Its commonly used to link remote hotspot branches/clouds. =============== Tested on: ======================== Several Aironet 1200/1300 upgraded to IOS 12.3(8)JA. Aironet 1200 are NOT affected. Description ======================= IOS 12.3(8)JA default settings turn on IGMP Snooping helper and WiFi Multimedia (WMM) features even if QoS is turned off. This two combined features generate by default a huge amount of multicast packets sent to all interfaces, wired or wireless through the default vlan. In the release notes, Cisco warns customers about the possibity of degration in the 1300's performance when using these features. Aparently this possibility is underestimated. This condition happens even if the AP is upgraded from an old version. Impact ========================== Wireless connection to the AP becames impossible. Wired connection is seriously affected speccialy in networks with multiple 1300, where the IGMP packets are sent to the whole network. As the 1300 are used tipically in the p2p sections of the wireless network, the instant breakup of the wireless p2p links is a very high possibility. Depending of the topology, some 1300s may be virtually unreacheble through network. Solution ============================ Enter the global configuration mode in the IOS console and issue the following commands: no ip igmp snooping no ip igmp snooping vlan 1 (optional - just to make sure) no dot11 igmp snooping-helper int Dot11Radio0 no dot11 qos mode exit wr ________________________________ Alex Ferreira Sysadmin
