Arista EOS (VXLAN match rule in IPv4 ACL): TENANT ISOLATION: if an IPv4 access list contains a VXLAN match rule

Impact

TENANT ISOLATION: if an IPv4 access list contains a VXLAN match rule, that rule and every rule after it in the list ignore the IP protocol you specified. Your ACL silently permits or denies far more than you wrote. Anyone using ACLs to keep tenant overlays apart, or to fence off a storage VLAN, is enforcing something other than what is in the config — and show access-list will not tell you.

Who can reach it

Any traffic subject to the affected ACL. No attacker capability needed beyond being on a path the ACL was supposed to control.

What to do

EOS upgrade plus reload. Immediate mitigation: reorder access lists so VXLAN match rules come last, or split them into a separate list — a live config change that restores correct enforcement of the remaining rules. Audit every ACL in the fabric for VXLAN match rules before assuming you are unaffected.

References