Changes in Default Behavior and Syntax in Junos OS Release 10.3 for M Series, MX Series, and T Series Routers

Interfaces and Chassis

Capability to report decibel value in case of low received power for optical interfaces—The show interfaces diagnostics optics interface-name command for optical interfaces reports the decibel value (dBm) of the received signal when the received power is zero milliwatts (0.0000 mW).
[Interfaces Command Reference]

Services Applications

Command to display AACL flows—Use the show services application-aware-access-list flows command to display application-aware-access list (AACL) flows for interfaces and subscribers. You can display the output in a brief format and the AACL actions associated with each flow.
[System Basics and Services Command Reference]
Enhancement in the show services service-sets cpu-usage command—The show services service-sets cpu-usage command now supports five CPU usage categories for service sets: idp_recommended, Idle, System, Receive, and Transmit. These categories are displayed as a percentage of the total CPU usage.
[System Basics and Services Command Reference]
IPsec policy for dynamic endpoints—With Junos OS Release 10.2, you can specify the IPsec policy for dynamic endpoints.
To specify an IPsec policy for dynamic endpoints, define the policy and its proposals under the [edit services ipsec-vpn ipsec] hierarchy level. Specify the policy name by including the ipsec-policy policy-name statement at the [edit access profile profile-name client * ike] hierarchy level. If no policy is set, any policy proposed by the dynamic peer will be accepted.
[System Basics, Services Interfaces]
Border Gateway Function (BGF) applies implicit latching on TCP gates when the gate is created—By default, latching of gates is done by explicit latch requests. You can configure implicit latching of gates by entering the set implicit-tcp-latch and set implicit-tcp-source-filter configuration statements at the [edit services pgcp gateway gateway-name h248-options] hierarchy level.
The new configuration statements result in the following actions:
- implicit-tcp-latch—If explicit latching has been applied (using using ipnapt/latch) on either gate of a gate pair, implicit latching is not applied. If explicit latching has not been applied on either gate:
  - Latching is applied to both gates of the gate pair.
  - When either of the gates latches, latching is automatically disabled on the other gate.
- implicit-tcp-source-filter—Applies source address (but not source port) filtering on incoming packets, using the current remote destination address under the following conditions:
  - Explicit source filtering has not been applied by use of gm/saf.
  - Explicit latching has not been applied by use of ipnapt/latch.
[Border Gateway Function, Services Interfaces]

Subscriber Access Management

RADIUS Acct-On and Acct-Off messages—Subscriber management supports RADIUS Acct-On and Acct-Off messages to indicate the current state of RADIUS accounting support.
The RADIUS Acct-On messages indicate that accounting is being supported, and are issued in the following situations:
- Accounting is enabled through configuration.
- A new access profile is configured and committed.
- The router performs a cold reboot.
- The router performs a warm reboot and there are no subscribers currently logged in.
- The Authd process restarts and there are no active subscribers.
The RADIUS Acct-Off messages indicate that accounting is not supported, and are issued in the following situations:
- The Authd process is terminated and there are no active subscribers.
- The router is rebooted and redundancy is disabled.
[Subscriber Management]
Activate multiple policies with JSRC—JSRC can now activate multiple policies with the same service name (dynamic profile name). Previously, only a single policy could be activated and the dynamic profile name was used as the service name. To distinguish between the multiple policies, the output of the show network-access subscribers session id command has changed to display the policy name rather than the service name for JSRC-activated services. The output for RADIUS-activated services has not changed.
In the following sample output, filter-service is a RADIUS-activated service associated with the dynamic profile of the same name. 1337994190863204450 is a JSRC-activated policy providing the same service for the filter-service dynamic profile. The policy name is set by the SAE, and sent to the router.
user@host> show network-access aaa subscribers session-id 6 brief
```
Logical system/Routing instance   Client type   Session uptime    Accounting
default:default                   dhcp          00:01:29          on/time       
Service name               Service type   Quota           Accounting
filter-serive              -na-           -na-            off           
1337994190863204450        -na-           -na-            off           
```
[Subscriber Access]

User Interface and Configuration

New CLI message for license add and delete operation—Adding or deleting a license key on the router with the CLI might be delayed, if a kernel re-sync operation is in progress at that time. The following message is displayed on the CLI when the license add/delete operation is about to be delayed: A kernel re-sync operation is in progress. License update may take several minutes to complete.
[Software Installation and Upgrade]
Deactivation of parts of oneliners in the configuration is not allowed—In Junos OS Release 10.3 and later, you can only deactivate complete oneliners, but not parts of them.
[CLI User Guide]
Commit-time warning messages at the [edit interfaces] hierarchy level are now system logged—CLI commit-time warnings displayed for configuration changes at the [edit interfaces] hierarchy level are removed and are logged as system log messages.
This is also applicable to VRRP configurations at the following hierarchy levels:
- [edit interfaces interface-name unit logical-unit-number family (inet | inet6) address address]
- [edit logical-systems logical-system-name interfaces interface-name unit logical-unit-number family (inet | inet6) address address]
[CLI User Guide]

show chassis fpc command CLI output message for 10x10GE(LAN/WAN) SFPP PICs—On T1600 routers, Type 4 FPCs with ASICs based on the SL2.0 chipset do not support the 10-Gigabit Ethernet LAN/WAN PIC with SFP+ (10x10GE(LAN/WAN) SFPP). If you issue the show chassis fpc command with the pic-status option, the CLI displays the string “Not Supported” for 10x10GE(LAN/WAN) SFPP PICs installed on such FPCs. The following is a sample output:

user@host> show chassis fpc pic-status

Slot 0   Online       E2-FPC Type 1
  PIC 0  Online       1x G/E SFP, 1000 BASE
  PIC 1  Online       Adaptive Services-II
  PIC 2  Online       1x G/E IQ, 1000 BASE
  PIC 3  Online       1x G/E IQ, 1000 BASE
Slot 1   Online       FPC Type 3-ES
  PIC 0  Present      UNUSED- Not Supported
Slot 2   Online       FPC Type 4-ES
  PIC 0  Offline      4x OC-192 SONET XFP
  PIC 1  Present      10x10GE(LAN/WAN) SFPP- Not Supported        <<<<<<
Slot 4   Offline      FPC Type 1-ES
Slot 5   Offline      FPC Type 2-ES
Slot 6   Online       E2-FPC Type 3
  PIC 0  Online       1x OC-192 SONET XFP
  PIC 1  Online       4x OC-48 SONET
  PIC 2  Online       4x OC-48 SONET
  PIC 3  Online       MultiServices 500
Slot 7   Online       FPC Type 4-ES
  PIC 0  Online       4x 10GE (LAN/WAN) XFP
  PIC 1  Online       4x 10GE (LAN/WAN) XFP

In addition, an entry is logged in the system log messages (/var/log/messages) that the PIC is not supported. The following is a sample message logged in the system log:

Apr  5 08:47:36  router1 chassisd[2770]: CHASSISD_UNSUPPORTED_PIC: PIC 1 in FPC 2 (type 763, version 257) is not supported

[System Basics and Services Command Reference]

Power voltage readings (MX80 router)—You can display the power voltage readings using the show chassis environment cb command on the MX80 router.
[System Basics and Services Command Reference]
Yellow alarm for excessive framing errors on M Series, MX Series, T Series, and TX Matrix routers—A new yellow alarm on the Routing Engine has been introduced for excessive framing errors on the console port. An excessive framing error alarm is triggered when the default framing error threshold of 20 errors per second on a serial port is exceeded. This might be caused by a faulty serial console port cable connected to the device.
[System Basics]

Changes in Default Behavior and Syntax in Junos OS Release 10.3 for M Series, MX Series, and T Series Routers

Interfaces and Chassis

Services Applications

Subscriber Access Management

User Interface and Configuration

Related Topics