Changes in Default Behavior and Syntax

Hardware

• Combinations of PICs—On Juniper Networks routing platforms, you can typically install any combination of Physical Interface Cards (PICs) in a single Enhanced Flexible PIC Concentrator (FPC). Newer JUNOS services for some PICs can require significant Internet Processor ASIC memory, and some configuration rules might limit certain combinations of PICs on some platforms. To conserve memory, group PICs in the same family together on the same FPC. Ethernet and SONET/SDH PICs typically do not use large amounts of memory. Adaptive Services, Asynchronous Transfer Mode (ATM) 2, Gigabit Ethernet, and IQ serial PICs use more.

  Configuration rules might apply to PICs installed on standard Enhanced FPCs on the following routing platforms: M5, M10, M20, M40, M40e, M160, M320, J20, T320, and T640.

  Configuration rules do not apply to PICs installed in the following routers or FPCs:

  • J-series, M7i, M10i, or M120 routers
  • Enhanced Plus FPCs on M-series and J20 routers
  • Enhanced Scaling FPCs

  When you upgrade the JUNOS software, a warning appears if any configuration rules affect your PIC combinations. If you continue the installation, the PICs appear to be online (the LEDs are on), but the JUNOS software cannot enable them and they cannot pass traffic. As a workaround, you need to plan which PICs to install on the Enhanced FPCs or PIC slots on your routing platform. For specific information about PIC combination rules, consult Technical Bulletin PSN-2007-01-023. Go to http://www.juniper.net/customers/support and click Technical Bulletins. On the JTAC Technical Bulletins Web page, enter PSN-2007-01-023 in the Search field, select the CS Technical Bulletin ID radio button, and click Search.

Software Installation and Upgrade

• New features for Ethernet IQ2 PICs and ISSU incompatibility—With JUNOS Release 9.2, the following two new features for Ethernet IQ2 PICs cause the software to reboot the PIC when an in-service software upgrade (ISSU) is performed:
  • The organization of counter memory on Ethernet IQ2 PICs is now dynamic so that counters can be allocated to different applications. In previous software releases, the organization of counter memory was static for a particular application and unused memory could not be allocated to other applications.
  • On routers with Ethernet IQ2 PICs using IEEE 802.1ad frame formats, you can now configure packet classification based on the IEEE 802.1p bits and the drop eligible indicator (DEI) bit. You can also configure rewrite rules on egress for the IEEE 802.1p bits and the DEI bit based on forwarding class or the packet loss priority bits.
• ISSU processing enhancement—When a unified in-service software upgrade (ISSU) stops progressing, issue the request system software abort in-service-upgrade command to stop the upgrade. You must issue this command in a new session on the router (separate from the existing session used to start the unified ISSU). Then, check the existing router session to verify that the upgrade has been aborted. An “ISSU: aborted!” message is provided. Additional system messages provide you with information about where the upgrade stopped and recommendations for the next step to take. [High Availability]
• Configurations can include both licensed and non-licensed features. In these situations, the license is enforced up to the point where it can be clearly distinguished. For example, an authentication-order configuration is shared by both AAA, which is licensed, and by L2TP, which is not licensed. At commit time, the router does not issue any license warnings, because it is not yet known whether AAA or L2TP is using the configuration. However, at runtime, the router checks for a license when AAA authenticates clients, but does not check when L2TP authenticates clients. [Software Installation]

Platform and Infrastructure

• On T640 routing platforms, the show pfe statistics traffic protocol bfd command output includes two new fields: “Packets with no logical interface” and “Packets with prefix length mismatch.” [System Basics and Services Command Reference]
• Previously, when a VPN routing and forwarding (VRF) interface was moved from an FPC that was not an M320 Enhanced III FPC to an M320 Enhanced III FPC, the interface state on the original FPC was blocked.
• On M-series routing platforms, the show pfe statistics ip options command output includes two new fields under IP Option Errors, as follows:
  • frames queued—Indicates the number of frames queued errors logged.
  • frames dropped—Indicates the number of frames dropped errors logged.
• Reduction in the minimum interval required between successive Routing Engine switchover events—With JUNOS software Release 9.1R2 and later, the minimum interval required between successive Routing Engine switchover events is 4 minutes (240 seconds). In previous releases, the minimum interval required was 5 minutes (300 seconds).
• Configuring IPv6 path MTU discovery—Two new statements have been added at the [edit system internet-options] hierarchy level for configuring IPv6 path MTU discovery: ipv6-path-mtu-discovery and ipv6-path-mtu-discovery-timeout. [System Basics]
• Configuring tracing operations explicitly for dynamic flow capture events—The traceoptions statement has been introduced at the [edit system services dynamic-flow-capture] hierarchy level. Tracing operations for dynamic flow capture events must be explicitly configured by including the traceoptions statement. Previously, trace operations for dynamic flow capture events were enabled by default and logged in the /var/log/dfcd directory. [System Basics]

User Interface and Configuration

• Juniper Control System (JCS) platform PSD show version enhancement—On a Protected System Domain (PSD), you can now issue the show version command with the rsd option, which allows you to view the software version running on the Root System Domain (RSD).
• Configuring the preshared key for an IKE policy—A local certificate is an alternative to the preshared key. If you do not configure either a pre-shared-key or a local certificate, the commit will fail. [System Basics]
• When you specify a URL in a JUNOS statement using an IPv6 host address, you must enclose the entire URL in quotation marks (" ") and enclose the IPv6 host address in brackets ([ ]). An example of the syntax follows:

  "ftp://username<:password>@[host-address]<:port>/url-path"

  "scp://username<:password>@[host-address]<:port>/url-path"

  This type of URL format appears in the system archival statement syntax. Not using the quotations and brackets in conjunction with using an IPv6 host address results in a failure when the transfer on commit is executed. [System Basics]

• Commit scripts execution behavior change—Enables the use of show commands in configuration mode to view the configuration even when a commit script is running. However, set commands cannot be used to change the configuration when a commit script is running. If set commands are used, the CLI displays a message “running commit script”. Previously, both show commands and set commands could not be run in configuration mode when a commit script was running.
• Configuring TACACS+ accounting—Two new statements, no-cmd-attribute-value and exclude-cmd-attribute, have been introduced at the [edit system tacplus-options] hierarchy level. They support the logging of accounting records to the correct log file on a TACACS+ server. The no-cmd-attribute-value statement sets the cmd attribute value to an empty string in the start and stop requests for accounting of login events. The exclude-cmd-attribute statement excludes the cmd attribute from the start and stop requests for accounting of login events. [System Basics]
• DHCP relay logical system support—You can configure DHCP relay in all logical systems on the router. However, DHCP relay functions properly only when configured in the default logical system. [Subscriber Access]

Interfaces and Chassis

• You can now configure the Ethernet OAM continuity check message interval for 10 milliseconds. To configure the continuity check message interval, include the interval statement at the [edit protocols oam ethernet connectivity-fault-management maintenance-domain domain-name maintenance-association ma-name continuity-check] hierarchy level. For the continuity check message interval to be configured for 10 milliseconds, you must also include the delegate-processing statement at the [edit routing-options ppm] hierarchy level. [Network Interfaces]
• VRRP operational command changes—When the VRRP virtual interface is down, the output of the show vrrp extensive and show vrrp detail commands now show N/A for the “Master router:” field. Previously when you issued these commands, the “Master router:” field showed the IP address of the last known master router. [High Availability]

  The “Delay threshold” and “Computed-send-rate” fields currently available in the output of the show vrrp profile statistics command are now displayed in the output of the show vrrp (detail | extensive) command. [Interfaces Command Reference]

• The show interfaces diagnostics optics command for optical interfaces no longer reports the decibel (dBm) value of the received signal if the received power is zero milliwatts (0.0000 mW). [Interfaces Command Reference]
• You can optionally specify the Maintenance Association End Point (MEP) identifier in the ping ethernet and traceroute ethernet commands. [Interfaces Command Reference]
• The physical interface hold time can be configured from 0 to 4,294,967,295 milliseconds. To configure the hold time, include the hold-time statement at the [edit interfaces interface-name] hierarchy level. [Network Interfaces]
• The show interfaces terse command now accepts the routing-instance all option. The output displays interfaces for all routing instances. [Interfaces Command Reference]
• Enhanced filter output from the show interfaces command—The show interfaces filter command can now display multiple input or output filters. The show interfaces detail and show interfaces extensive commands can display multiple input or output filters, including any filters attached to the interface through dynamic service activation. [Interfaces Command Reference]
• Aggregated Ethernet interfaces on Ethernet intelligent queuing (IQ2) PICs in MX-series routing platforms now support the configuration of flexible VLAN tagging, native VLAN IDs, and rewrite operations on dual-tagged frames, which consist of the following configuration statements: inner-tag-protocol-id, inner-vlan-id, pop-pop, pop-swap, push-push, swap-push,and swap-swap. [Network Interfaces]

Services Applications

• The Adaptive Services and MultiServices PICs are polling-based and not interrupt-based; as a result, a high value in the show chassis pic “Interrupt load average” field might not mean that the PIC has reached its maximum limit of processing. [Services Interfaces]
• Flow collection version 9 now supports 4-byte AS numbers. [Services Interfaces]
• The output of the show services pgcp statistics gateway command has changed. The output now includes statistics for command requests and command responses broken down by message type. [System Basics and Services Command Reference]
• The packet gateway (PG) supports the inactivity timer package defined in Gateway control protocol: Inactivity timer package H.248.14, March 2002. This feature allows the PG to detect the failure of its active packet gateway controller (PGC) through message inactivity. The inactivity timer is applied to the root terminations of a virtual PG (VPG). To configure, include the statements at the [edit services pgcp gateway gateway-name h248-properties inactivity-timer inactivity-timeout] hierarchy level. [Services Interfaces]
• In JUNOS 9.2 and later, you must now include the following configuration to make the flow monitoring feature operable:

  [edit system]

  ntp {

  boot-server ntp.juniper.net;

  server 172.17.28.5;

  }

  processes {

  ntp enable;

  }

• By default, the JUNOS software allocates NAT ports sequentially. To configure random port allocation, include the random-allocation statement at the [edit services nat pool pool-name port (automatic | range)] hierarchy level. [Services Interfaces]

Routing Protocols

• Support for IS-IS traffic engineering shortcuts extended to IPv6 routes—Enables you to configure IS-IS to use IGP shortcuts for IPv6 routes. Previously, only IPv4 routes were supported. As a result, the hierarchy to configure IS-IS IGP shortcuts is changed. Include a new family statement with the following statements:

  [edit protocols isis]

  traffic-engineering {

  family inet {

  short-cuts {

  multicast-rpf-routes;

  }

  }

  family inet6 {

  shortcuts;

  }

  }

  Label-switched paths (LSPs) to be used for shortcuts continue to be signaled using IPv4. However, by default, shortcut routes calculated through IPv6 routes are added to the inet6.3 routing table. The default behavior is for BGP only to use LSPs in its calculations. If you configure MPLS so that both BGP and IGP use LSPs for forwarding traffic, shortcut routes calculated through IPv6 are added to the inet6.0 routing table.

  You can use the legacy configuration of [edit protocols isis traffic engineering shortcuts] to enable IPv4 shortcuts and automatically disable IPv6 shortcuts.

  In addition, the operational mode command show isis overview has been enhanced to display shortcuts for both IPv4 and IPv6 routes. [Routing Protocols, Routing Protocols and Policies Command Reference]

• The show route protocol ospf command has been enhanced with two new options to display only OSPFv3 routes and to display only OSPFv2 routes. Include the new ospf3 option for the show route protocol command to display only OSPFv3 routes. Use the new ospf2 option for the show route protocol command to display only OSPFv2 routes. The ospf option continues to display both OSPFv2 and OSPFv3 routes. In addition, the show route command has been enhanced to display information about OSPFv3 routes under the field name OSPF3. [Routing Protocols and Policies Command Reference]
• The output of the operational mode commands show route extensive and show route protocol bgp detail now display the “AS Path: Recorded” field. [Routing Protocols and Policies Command Reference]
• BGP traceoptions flag for 4-byte AS numbers—To trace events for 4-byte autonomous- system numbers, include the 4byte-as option at the [edit protocols bgp traceoptions flag] hierarchy level. [Routing Protocols]
• Change in global configuration for Layer 2 learning properties for MX-series routers—To configure Layer 2 learning properties systemwide for an MX-series router, include the global-mac-statistics, global-mac-table-aging-time, and global-no-mac-learning statements at the [edit protocols l2-learning] hierarchy level. The mac-statistics, mac-table-aging-time, and no-mac-learning statements have been deprecated at the global level. The global-mac-limit statement continues to be supported at the [edit protocols l2-learning] hierarchy level. The mac-statistics and no-mac-learning statements continue to be supported only at the [edit bridge-domains bridge-domain-name bridge-options] hierarchy level, and beginning with JUNOS Release 9.2, at the [edit switch-options] hierarchy level. [Routing Protocols]
• When virtual private LAN service (VPLS) is configured in the router, the indirect-next-hop statement is not supported at the [edit routing-options forwarding-table] hierarchy level. [Routing Protocols, VPNs]
• Enhancement to IS-IS adjacency hold-down behavior—The outputs for the operational mode commands show isis adjacency detail and show isis interface detail have been enhanced to display whether the router is configured to signal not to advertise an interface to its neighbors in their label-switched paths (LSPs) or whether a neighbor has signaled not to advertise an interface in the router's outbound LSPs. The commands can now display the following fields in the output: Adjacency advertisement: Advertise or Adjacency advertisement: Suppress. [Routing Protocols and Policies Command Reference]
• Change in use of special characters for routing-instance names—You can no longer use special characters within the names of routing instances. A commit check and upgrade to JUNOS Release 9.0 or later fails if you include a special character within a routing-instance name. The routing-instance name can include letters, numbers, and hyphens. In addition, a routing-instance name can now be up to 128 characters long. You configure a routing-instance name at the [edit routing-instances routing-instance-name] hierarchy level. The commit check is enforced wherever a routing-instance name is referenced in the JUNOS CLI.

  A commit check is also now enforced for firewall filter and policy statement names. The commit check fails if these names include special characters. You configure firewall filters at the [edit firewall filter filter-name] hierarchy level. You configure a policy statement at the [edit policy-options policy-statement policy-name] hierarchy level. [Routing Protocols, Policy Framework]

• On MX-series routers, a maximum of 4000 active logical interfaces are now supported on a bridge domain or on each mesh group in a VPLS instance configured for Layer 2 bridging. [Routing Protocols]

Multicast

• When a PIM hello multicast message is received, a neighbor should exist or will be created. If the hello message contains the holdtime option, the neighbor timeout will be set to this holdtime. If the hello does not contain the holdtime option, the neighbor timeout is set to the default hello holdtime. [Multicast]

VPNs

• You can configure the JUNOS software to allow a Layer 2 circuit to be established, even if the MTU configured on the PE router does not match the MTU configured on the remote PE router, by including the ignore-mtu-mismatch statement at the [edit protocols l2circuit neighbor address interface interface-name] hierarchy level.
• When virtual private LAN service (VPLS) is configured in the router, the indirect-next-hop statement is not supported at the [edit routing-options forwarding-table] hierarchy level. [Routing Protocols, VPNs]
• LDP VPLS MTU options—You can now set an MTU value for LDP VPLS by including the mtu statement at the [edit routing-instances routing-instance-name protocols vpls] hierarchy level. You can also configure VPLS to ignore the MTU configuration set for the associated physical interface. This enables you to bring up a circuit between two logical interfaces that are defined on physical interfaces with different MTU values. To configure VPLS to ignore MTU mismatches, include the ignore-mtu-mismatch statement at the [edit routing-instances routing-instance-name protocols vpls] hierarchy level. [VPNs]
• The JUNOS software now enforces the rule in which you must configure a unique route distinguisher for each VPLS or VPN routing instance regardless of whether or not nonstop active routing (NSR) is enabled. In previous releases, you could configure the same route distinguisher for multiple routing instances. When multiple routing instances used the same route distinguisher and nonstop active routing was not configured, the standby Routing Engine was not able to uniquely identify the routing instance based on the route distinguisher. [VPNs]
• Bridges in the default instance use VPLS and inet tables named __juniper_def_vswitch__. [Routing Protocols]

Class of Service

• When an IQ2 PIC is configured with a traffic control profile and only the guaranteed rate is specified, the shaping rate is set to the port rate by default. [Class of Service]
• The CLI value range displayed and allowed for restricted queue number configuration at the [edit class-of-service restricted-queues forwarding-class forwarding-class-name] hierarchy level has changed from a range of 0 through 65,535 to the correct range of 0 through 3. [Class of Service]
• The file statement at the [edit class-of-service traceoptions] hierarchy level includes the following new options:
  • files—Maximum number of trace files (2 through 1000).
  • match—Regular expression for lines to be logged.
  • no-world-readable—Do not allow any user to read the log file.
  • size—Maximum trace file size (10,240 through 1,073,741,824 bytes).
  • world-readable—Allow any user to read the log file.

  You can also set a new flag (dynamic) to trace dynamic CoS functions. The default log file count is now 3 (it was previously 5) and the default trace file size is 1 MB (it was 5 MB). [Class of Service]

• On MX-series routers with the EQ DPC, forwarding-class is not supported as a from match condition. [Class of Service]

Routing Policy and Firewall Filters

• Two new OSPF match conditions for routing policy—The protocol match condition for routing policy now supports two new statements: ospf2 and opsf3. Use the ospf2 statement to match OSPFv2 routes. Use the ospf3 statement to match OSPFv3 routes. The protocol ospf statement continues to match both OSPFv2 and OSPFv3 routes. Include the protocol ospf2 or protocol ospf3 statement at the [edit policy-options policy-statement policy-name term term-name from] hierarchy level. [Policy Framework]