Release Highlights
This release includes the features described in this section.
AAA
AAA broadcast accounting enables you to send AAA accounting information to multiple accounting servers at the same time. To configure broadcast accounting, you create a virtual router group, and then populate the group with up to four virtual routers. When you enable broadcast accounting, the accounting records are sent to the accounting servers on the virtual routers in the specified group. The accounting information continues to be sent to the primary accounting server and to the duplicate accounting server, if one is configured.
The following commands have been added or modified to support AAA broadcast accounting:
You can use the aaa accounting immediate-update command to configure immediate accounting updates on a per-VR basis. If you enable this feature, the E-series router sends an Acct-Update message to the accounting server immediately after the subscribers' IP address has been determined and a response to the Acct-Start message has been received. The command has the following syntax:
aaa accounting immediate-update { enable | disable }no aaa accounting immediate-updateThis feature is disabled by default. Use the enable keyword to enable immediate updates and the disable keyword to halt them.
The accounting update contains 0 (zero) values for the input/output octets/packets and 0 (zero) for uptime. If you have enabled duplicate accounting, the accounting update goes to both the primary virtual router context and the duplicate virtual router context.
The show aaa accounting command output has been updated to indicate whether immediate-update is disabled or enabled:
host1#show aaa accountingNo Accounting duplication configuredsend acct-stop on ERX-AAA access deny is enabledsend acct-stop on authentication server access deny is disabledacct-interval (for PPP Clients) 0send immediate-update is disabledBGP/MPLS VPNs
The VPN-IPv6 and multicast IPv6 address families are now supported, enabling the creation of BGP/MPLS IPv6 VPNs. All features previously supported for BGP/MPLS IPv4 VPNs, such as policy-based routing, redistribution to and from other protocols, aggregation, route-flap dampening, and so on are also supported for BGP/MPLS IPv6 VPNs. Inter-AS VPNs (2547bis options A and B) and Tier 2 carriers for carrier-of-carriers VPN are both supported. ECMP for multiple equal-cost VPN-IPv6 routes is supported.
The address-family and show bgp ipv6 command syntax changed to support the new feature.
The behavior of the neighbor allowas-in command has been modified to be different for VPNv4 address families compared with other address families.
For other address families, you must configure the feature on all the peers. To reduce the provisioning overhead for VPNv4 IBGP peers, IBGP peers within the VPNv4 address family always accept routes containing their own AS number by default. Issuing this command in the VRF for such a peer has no effect on the behavior of IBGP peers in this address family, However, you must configure the feature on the peer router at the hub.
The following new field options have been added to the default-fields peer and show ip bgp summary commands:
- more-in-queue—status indicating whether any messages are waiting to be sent to the peer
- rib-version—last RIB version queued to be sent to the peer
- send-queue-length—number of messages queued to be sent to the peer
B-RAS
This feature has now been fully qualified for JUNOSe 5.3.0 and higher releases.
The JUNOSe software enables you to parse the username from the realm or domain in either a left-to-right or right-to-left direction. The ability to search from either direction gives you flexibility when nested domains are used, such as userjohn@abc.com@xyz.com. In this case, you can identify the domain as either abc.com@xyz.com or xyz.com, depending on the parse direction you specify.
Use the aaa parse-direction command to specify the parse direction for either the realm or the domain. Use the show aaa delimiters command to display information about the router's parse direction.
The AAA local authentication server enables the E-series router to provide local PAP and CHAP user authentication for PPP subscribers. When a subscriber logs on to the E-series router that is using local authentication, the subscriber is authenticated against user entries in the local user database, rather than an external RADIUS server.
To create your local authentication environment, you create and populate local user databases, assign the appropriate database to a virtual router, and enable local authentication on the virtual router. The database entries provide authentication-related parameters that the local authentication server uses to authenticate subscribers.
The following commands have been added or modified to support the local authentication server:
The following system log event categories have been added to support the local authentication server:
Bulk Statistics
Counter discontinuity occurs when you reload or reset a line module. To indicate reloading or resetting, bulk statistics files contain a record similar to the following:
{Controller down slot 3, TUE OCT 29 2004 14:25:10.370 UTC}
To take advantage of this detection capability, the bulk statistics parsing entity must use the record to terminate expression or formula calculations for the indicated slot and to establish a new baseline.
CLI
The new do command enables you to execute an Exec mode command from any configuration command mode. The do command functions the same as the run command.
DHCP
This feature has now been fully qualified for the JUNOSe 5.3.3, 6.0.1, and 6.1.0 releases.
Linking DHCP local pools is supported in both DHCP equal-access mode and DHCP standalone mode. The linked pool serves as a backup pool. If no addresses are available in a pool, the DHCP local server attempts to allocate an address from the linked pool. Use the link command to link one DHCP local pool to another local pool.
Dynamic Interfaces
When you issue the atm pvc command from Profile Configuration mode to apply encapsulation and traffic-shaping parameters to a bulk-configured VC range, you can now include the optional oam keyword. Specifying the oam keyword and a time interval in the range 0-600 seconds enables the generation of OAM F5 loopback cells for the entire range of PVCs configured for use by a dynamic ATM 1483 interface. This option enables VC integrity features that affect the operational state of the ATM PVC.
You can use the oam keyword in the atm pvc command only if you specify the aal5snap, aal5autoconfig, or aal5mux ip encapsulation type.
As part of this feature, the show profile command has been updated to display the current F5 OAM settings for the bulk-configured VC range. In addition, the following new MIB objects have been added to JUNOSe to support the feature:
You can use the new profile atm1483 bulk-config-name pvc command to assign an overriding profile to a single ATM PVC that exists within a virtual circuit (VC) subrange. The VC subrange that encompasses the PVC must have been previously configured with the atm bulk-config command for use by a dynamic ATM 1483 subinterface.
After you assign the overriding profile, the router uses the information in this profile instead of the information in the previously assigned base profile to create any subsequent ATM 1483 dynamic subinterface columns on the specified PVC. The overriding profile typically includes debugging attributes to help you troubleshoot problems with the ATM 1483 dynamic subinterface column created on the specified PVC.
As part of this feature, the show atm bulk-config command has been enhanced to display information about overriding profile assignments configured on the router.
Bulk configuration of VC subranges has been enhanced in this release. You can now add, remove, modify, merge, and shut down subranges within a given bulk-configured VC subrange by using the following new commands:
- Use the atm bulk-config command to add or remove subranges.
- Use the atm bulk-config modify command to modify and merge subranges.
- Use the atm bulk-config shutdown command to administratively shut down or bring up subranges. When you change the administrative state to down by using the atm bulk-config shutdown command, the router deletes all dynamic ATM 1483 subinterfaces on the affected subranges. You can use the show atm subinterface command or the show atm vc command to monitor the progress of the removal of all dynamic ATM 1483 subinterfaces for the specified subrange.
Previously, changes to VC subranges were possible only if you removed the VC range and then configured it again with different subrange values. The ability to make changes to VC subranges without first having to remove the entire VC range avoids potentially disrupting all subscribers on existing dynamic ATM 1483 subinterfaces associated with the deleted VC range.
As part of this feature, the show atm bulk-config command has been enhanced to display the current administrative state (up or down) of VC subranges configured on the router.
You can now configure a static ATM interface with an ATM PVC whose VPI and VCI addresses fall within an existing bulk-configured VC subrange. Conversely, you can also create a bulk-configured VC subrange that includes the VPI and VCI addresses belonging to an existing ATM PVC on a static ATM interface. Previously, configurations that caused VPI/VCI address conflicts between a static ATM interface and a bulk-configured VC subrange were prohibited on the router.
This feature uses the existing commands for configuring a static ATM interface (interface atm, atm pvc) and for creating a bulk-configured VC subrange (atm bulk-config). In addition, the show atm bulk-config command has been enhanced to display the current operational status (Active or Inactive) of overriding profile assignments configured on the router,
Firewall
The ip inspect name command now enables you to configure RTSP (Real-Time Streaming Protocol) in an inspection list. This enhancement provides RTSP and realAudio support for RealNetworks RealPlayer applications in a JUNOSe NAT and stateful firewall network configuration.
IP
You can now configure the forwarding table route hold-down timer. The timer value is the number of seconds available after an initial routing table change for the accumulation and distribution of routing table updates to the line modules.
The new forwarding-table route-holddown command sets the timer value in the range of 0-30 seconds (default value is 3 seconds). A setting of zero (0) distributes an update after each change to the routing table. The no version sets the hold-down timer to the default value (3 seconds).
Setting the timer higher than the default value can enhance SRP performance, but it can also delay the implementation of routing table changes on the line modules. Be aware of the possible effect on network performance before you configure the forwarding table hold-down timer.
You can use the show forwarding-table route-holddown command to display the configured hold-down timer setting.
Path MTU discovery is the process of discovering the PMTU value (the largest MTU value that the path can support without requiring fragmentation) and using that value when transmitting IP datagrams.
IS-IS
In earlier releases, if you did not specify a link level with the isis metric command, the command applied the metric value to only level 1 links by default. The new behavior is to apply the metric value to both level 1 and level 2 links by default.
E-series routers support IS-IS graceful restart as defined in RFC 3847—Restart Signaling for Intermediate System to Intermediate System (IS-IS) (July 2004). When graceful restart, which is also known as nonstop forwarding (NSF), is enabled on an IS-IS router, the router can restart with minimal routing disruption to the network. Graceful restart is disabled on the router by default.
The following commands have been added or modified to support IS-IS graceful restart:
L2TP
The following commands are now supported in the CLI:
Full documentation for these commands is provided in this release. For more information, see the JUNOSe Broadband Access Configuration Guide and the JUNOSe Command Reference Guide, A to M.
MLPPP
- You can now install multiple tunnel-service modules in an E-series router deployed as an LNS where the tunnel sessions carry MLPPP. Previously, having more than one tunnel-service module installed in this configuration led to incorrect operation of the E-series router.
MPLS
An LSR can discover potential LDP peers through link hello and targeted hello messages. Link hellos come from directly connected peers, and targeted hellos come from nondirectly connected peers. For this reason, link hellos and targeted hellos were treated differently; an LSR that received both types of hellos from the same peer established two separate LDP sessions to that peer. Now, only a single session is established.
You can use the mpls ldp link-hello disable command to suppress the transmission of link hello messages on an interface, so that only targeted hello messages can be sent to selected LSRs on the subnet.
Previously, LDP did not advertise labels for interface addresses if they were not in the routing table. For example, if an interface address had a prefix length less than 32, the address itself was not put into the routing table and LDP did not advertise a label for it.
You can now specify an interface with the mpls ldp advertise-labels command to enable the advertisement of label mappings for that interface address itself, in addition to the subnet that the interface is on.
You can use the mpls ldp session holdtime command to specify the period for which for an LSR maintains the session with its LDP peer without receipt of any LDP message from that peer. The LDP session is terminated when the timer expires.
Each LSR peer sends the session hold time in its initialization message; peers negotiate to use the minimum of the session hold times proposed by the pair of LSRs. This negotiated session hold time is used by the keepalive timer to maintain the session. The keepalive timer is reset with the receipt of any session message from the peer. In the absence of other LDP protocol messages being sent, peers periodically send a keepalive message to maintain the LDP session.
The clear mpls ldp command has been extended to enable the clearing of particular prefixes or particular neighbors.
JUNOSe supports virtual channel connection (VCC) cell relay encapsulation for ATM layer 2 services over MPLS. VCC cell relay encapsulation enables the router to emulate ATM switch behavior by forwarding individual ATM cells over an MPLS pseudowire (also referred to as a Martini circuit) created between two ATM VCCs, or as part of a local ATM passthrough connection between two ATM 1483 subinterfaces on the same router.
The JUNOSe implementation conforms to the required N-to-1 cell mode encapsulation method described in the Martini draft, Encapsulation Methods for Transport of ATM over MPLS Networks—draft-ietf-pwe3-atm-encap-07.txt (April 2005 expiration), with the provision that only a single ATM virtual circuit (VC) can be mapped to an MPLS pseudowire (or Martini circuit).
VCC cell relay encapsulation is useful for voice-over-ATM applications that use AAL2-encapsulated voice transmission.
The following commands have been added or modified to support VCC cell relay encapsulation:
JUNOSe supports the creation of HDLC layer 2 circuits across an MPLS network or in a local cross-connect configuration. An HDLC layer 2 circuit can carry any standard HDLC traffic (including PPP) or Cisco HDLC traffic between two CE devices across an MPLS network. In an HDLC layer 2 circuit configuration, an E-series router functions as one of the PE routers.
You can now use either the mpls-relay command or route interface command to configure an HDLC layer 2 circuit on a serial or POS interface. The interfaces at either end of the circuit can be different types and can operate at the same speed or at different speeds. For example, you can configure an HDLC layer 2 circuit between a serial interface on a T1 circuit and a POS interface on an OC3 circuit. You cannot, however, configure any additional interfaces (such as PPP) above the HDLC interface after you issue the mpls-relay comand or route interface command.
By default, the router uses VC-type HDLC signaling and HDLC encapsulation to encapsulate HDLC frames in MPLS. Optionally, you can include the new relay-format ppp keywords in either the mpls-relay command or route interface command to cause the router to use VC-type PPP signaling and PPP encapsulation instead of the default VC-type HDLC signaling and HDLC encapsulation.
HDLC layer 2 services over MPLS are supported on the following module combinations:
- cOCx/STMx F0 line module with cOC3 STM1 F0 I/O module
- cOCx/STMx F0 line module with cOC12 STM4 I/O module. (Sequencing is not supported on this line module combination.)
- CT3/T3-F0 line module with CT3/T3 12 I/O module
- COCX-F3 line module with E3-12 FRAME I/O module
- OCx/STMx POS line module with OC3-4 I/O module
- COCX-F3 line module with CT3/T3 12 I/O module
Multicast IP and IPv6
You can now configure an IGMP or MLD (IPv6) interface to use an outgoing interface (OIF) map. When you configure an OIF map on an interface, the map is applied to all IGMP or MLD membership requests that the interface receives.
OSPF
The E-series routers now support a maximum of 25,000 OSPF routes; previously, the maximum was 10,000.
E-series routers support OSPF graceful restart extensions as defined in RFC 3623 (Graceful OSPF Restart). Graceful restart enables a router to continue forwarding OSPF traffic based on routing information it receives prior to an unplanned restart, while the E-series router switches from the primary SRP to the secondary SRP module.
Packet Mirroring
Packet mirroring enables you to send a copy of a packet to an external host for analysis. Packet mirroring has many uses, including traffic debugging and troubleshooting user networking problems. In addition to the previously supported CLI-based IP interface mirroring, JUNOSe software supports RADIUS-based mirroring, which uses dynamically created secure policies.
There are two variations of RADIUS-based mirroring, depending on whether the user is currently logged on. One variation starts the mirroring session when the specified user logs on and is authenticated by RADIUS. The second variation is RADIUS initiated, and uses the RADIUS dynamic-request server and RADIUS change of authorization messages to immediately start mirroring the session of a user who is already logged on.
In the JUNOSe 6.1.0 release, several packet-mirroring commands have been renamed as listed in the following table. The original commands are no longer supported; you must upgrade your scripts accordingly if they included the original commands.
Platform Support
For detailed information about hardware features, see the E-series Hardware Guide and E-series Module Guide.
Policy Management
IPv6 classifier lists now support the source-address, source-host, destination-address, and destination-host keywords, which enable you to classify IPv6 traffic based on source and destination addresses. You can specify a source or destination IPv6 address or use an IPv6 prefix to specify a source or destination host.
For example, the following command classifies traffic on source host 2001:db8:1::8001 and destination address 2001:db8:3::/48:
host1(config)#ipv6 classifier-list ClaclName4 source-host 2001:db8:1::8001 2001:db8:3::/48The number of available policy management statistics per ASIC line module has increased to 256,000 for each ingress and egress forwarding interface. The previous maximum was 64,000.
Enhanced policy monitoring performance does not significantly change how the policy management show commands display statistics. A minor change to color information can occur when you use, for example, the show ip interface command to monitor statistics. If you add a rate-limit rule, packets that existed before the rate-limit addition are colored green, regardless of their color before the rate-limit addition.
Enhanced policy monitoring performance can cause minor changes to color information in the MIB files. For example:
- The MIB can display packet/byte counters as green even though they are colorless.
- Adding a rate-limit rule causes the MIB to display packets as green instead of the color they were before the rate-limit addition.
- Adding filter and rate-limit rules displays statistics in a set of three identical packet/byte counters for both filter and rate-limit. Removing the rate-limit rule does not change the MIB display to the single colorless counter that existed before the addition of the rate-limit rule.
PPPoE
This feature has now been fully qualified for JUNOSe 5.3.0 and higher releases.
By default, the router sends both the AC-Name and AC-Cookie tags as part of the PPPoE Active Discovery Session (PADS) packet. If necessary for compatibility with your network equipment, you can issue the new pppoe pads disable-ac-info command to prevent the router from sending the AC-Name and AC-Cookie tags in the PADS packet on all PPPoE interfaces configured after the command is issued.
The following commands have been added or modified to support this feature:
You can enable the router to capture and process a vendor-specific tag containing a PPPoE remote circuit ID value transmitted from a DSLAM. To enable this feature for a static or dynamic PPPoE interface, you must issue the pppoe remote-circuit-id command. When capture of the PPPoE remote circuit ID is enabled, you can configure RADIUS to override the standard use of either or both of the Calling-Station-Id [31] and NAS-Port-Id [87] RADIUS attributes and instead use the remote circuit ID value.
This feature is supported on all E-series modules on which you can configure PPPoE interfaces. However, the feature is particularly useful in Ethernet-based B-RAS configurations as a means of uniquely identifying subscribers connected to the router on a single Ethernet link.
Several MIB files have been updated to support PPPoE remote circuit ID capture. See PPPoE and RADIUS MIBs Updated in SNMP for details.
The following commands have been added or modified to support PPPoE remote circuit ID capture:
QoS
JUNOSe software enables QoS profiles to be dynamically attached to L2TP session interfaces. QoS profile support is on a per-L2TP session basis, and is supported on E-series routers that are configured as an LAC or LNS.
L2TP QoS profiles are attached to a dynamic L2TP session interface when the newly created interface has the QoS-Profile-Name [26-26] RADIUS VSA associated with it.
Use the queue command with the l2tp-session keyword to specify that a queue traffic class be configured for the L2TP session interface. For example:
host1(config-qos-profile)#l2tp-session queue traffic-class strictPriorityUse the node command to configure a scheduler node for each interface of the L2TP session interface type. For example:
host1(config-qos-profile)#l2tp-session node scheduler-profile scheduler1 group strict-priorityUse the show qos-profile, show qos interface-hierarchy, and show qos-profile references commands to display information about the QoS configuration for L2TP session interfaces.
You can use the shared-shaping-rate command to shape the aggregate traffic for a logical interface when the logical interface traffic is queued through more than one scheduler hierarchy. For example, you might configure QoS for voice, video, and data traffic on a single ATM VC. The video and voice traffic are placed in separate scheduler hierarchies from the data traffic to provision the low latency that is required for voice and video traffic.
Shared shaping enables you to ensure that the data traffic is shaped dynamically so that it matches the bandwidth available after the voice and video bandwidth requirements are met.
Shared shaping is typically enabled on the access-facing line module, but you can enable the feature for any interface type recognized by QoS, on any line module and any JUNOSe router.
You can use the show qos shared-shaper command to display information about the shared shapers configured on your router.
RADIUS
This feature has now been fully qualified for JUNOSe 5.3.0 and higher releases.
RADIUS attribute filtering has been enhanced to support filtering of selected attributes from accounting-on and accounting-off messages. Use the radius-include command to enable or disable filtering of the attributes in the following table:
RADIUS relay server now supports address assignment using DHCP external servers. This feature enables the E-series router to forward DHCP address requests to other systems in the network.
The SDX application does not participate in address pool selection if the E-series router is using a DHCP external server.
This feature has now been fully qualified for JUNOSe 6.0.0 and higher releases.
The RADIUS dynamic-request server provides an efficient way to use RADIUS servers to centrally manage user sessions. In addition to supporting the router's RADIUS disconnect feature, the RADIUS dynamic-request server supports change of authorization (CoA) messages from RADIUS servers. CoA messages dynamically modify session authorization attributes and are used by the router's packet mirroring feature.
The following commands have been added or modified to support the RADIUS dynamic-request server:
With the addition of the RADIUS dynamic-request server feature, the configuration procedure for the router's RADIUS disconnect feature has changed:
- The Radius Disconnect Configuration mode has been removed from the CLI.
- The radius disconnect client command is no longer supported. You now use Radius Configuration mode and the new subscriber disconnect command to configure RADIUS disconnect.
- The baseline radius disconnect, show radius disconnect clients, and show radius disconnect statistics commands have been removed from the CLI.
The following MIB objects have been added to the rsradclient.mi2 MIB to provide SNMP support for the DHCP access model:
The upper limit for the max-sessions command in Radius Configuration mode has increased from 4000 to 32,000.
When PPPoE remote circuit ID capture is enabled on the router, you can use either (or both) of the radius override calling-station-id remote-circuit-id and radius override nas-port-id remote-circuit-id commands to override the standard use of the Calling-Station-Id [31] and NAS-Port-Id [87] RADIUS attributes, respectively, and instead use the remote circuit ID value.
For more information, see PPPoE Remote Circuit ID Capture in PPPoE.
SNMP
The juniIf.mi2 MIB has been modified to add the Interfaces Count Table, juniIfCountTable. This MIB allows a count of interfaces by interface type.
The following MIBs have been updated to support the PPPoE remote circuit ID capture feature:
For more information about this feature, see PPPoE Remote Circuit ID Capture in PPPoE.
The SNMP subsystem now supports only the Juniper Networks enterprise ID (4874) and the corresponding vendor ID 1 (Juniper Networks).
The rfc3813.mi2 MIB (the MPLS LSR MIB) has been added. The rfc3811.mi2 MIB describes the textual conventions of the rfc3813.mi2 MIB.
You can now specify the routeTable trap category with the snmp-server enable traps command. The routeTable trap category enables you to generate SNMP traps when a virtual router exceeds the maximum limit and warning threshold values that you specified for routes by using the maximum routes command.
Stateful SRP Switchover (High Availability)
The RADIUS relay server now supports stateful SRP switchover (high availability).
The MPLS application now supports stateful SRP switchover (high availability). Recovery from a switchover uses static configuration only (that is, dynamic configuration and state information is lost, and MPLS forwarding stops until the states are relearned).
The bridged Ethernet application now supports stateful SRP switchover (high availability).
Beginning with the JUNOSe 6.0.0 release, stateful SRP switchover is qualified for the applications listed in the following table. The JUNOSe 6.0.0 Release Notes erroneously reported these applications as unsupported.
System
The summary keyword has been added to the show virtual-router command. Using the summary keyword enables you to display only the total number of virtual routers and the total number of VRF instances. You can use the summary keyword with the detail keyword to display the number of VRF instances for each virtual router name.
TFTP
You can now use the Trivial File Transfer Protocol (TFTP) to copy files and to redirect output from the E-series router to a remote server if the remote host supports TFTP. Before transferring files by the remote TFTP server, you must use the host command to define the host and to specify TFTP as the file transport protocol. The maximum file size is 32 MB for file transfers.