Arista EOS (security ACL vs NAT rule interaction): TENANT ISOLATION: a security ACL drop rule is bypassed when a NAT

Impact

TENANT ISOLATION: a security ACL drop rule is bypassed when a NAT ACL permit rule matches the same packet. Traffic you explicitly denied is forwarded. Same class of problem as the VXLAN ACL bug — the enforcement does not match the config, so your segmentation audit passes while the boundary is open.

Who can reach it

Any source whose traffic matches both a NAT permit and a security deny. Requires NAT to be configured on the device, which is common on the cluster's egress or storage-gateway leaves.

What to do

EOS upgrade plus reload. Interim: avoid overlapping NAT and security ACL match spaces on the same device, and verify enforcement with actual traffic tests rather than reading the config. Live config change.

References