What's Changed

Flow-label configuration status for EVPN ELAN services —The output for the show evpn instance extensive command now displays the flow-label and flow-label-static operational status for a device and not for the routing instances. A device with flow-label enabled supports flow-aware transport (FAT) flow labels and advertises its support to its neighbors. A device with flow-label-static enabled supports FAT flow labels but does not advertise its capabilities.

Commit error if interconnect and local route distinguishers have the same value—On EVPN data center interconnect (DCI) gateway devices, if you configure an interconnect RD at the edit routing-instances name protocols evpn interconnect hierarchy, the interconnect RD must be different from the local RD in the routing instance. If you try to configure the same value for the interconnect RD and the local RD in a routing instance, the device enforces this requirement by throwing a commit error. However, with DCI seamless stitching for EVPN Type 5 routes, you don't see the commit error prior to this release. Starting in this release, the device throws the commit error to enforce this condition for DCI stitching with Type 5 routes.

See [ route-distinguisher.]

The Ethernet link fault management process (lfmd) runs only when the link-fault-management protocol is configured.

Previously, if the system failed to install an interface or hierarchical policer, the PFE crashed due to an assert. Now, the system installs a firewall discard and logs a DFW_HALP_ERR_MSG_POLICER_ADD_FAILED error message. This error message provides the name of the affected policer and the corresponding error code. Relevant policers appear under the interface > unit > family > policer input/output (or) interface > unit > family > input-hierarchical-policer stanzas.PR1701676

XML tag in the get-system-yang-packages RPC reply changed (ACX Series, PTX Series, and QFX Series)—The get-system-yang-packages RPC reply replaces the xmlproxy-yang-modules tag with the proxy-xml-yang-modules tag in the XML output.

An optics configuration mismatch alarm may be triggered when there is a discrepancy between the configured speed of an interface and the supported speed of the optic. This alarm indicates that the optic installed in the specified FPC is incompatible with the speed configured on the interface.

On PTX10008 and PTX10016 routers, the default scheduler transmission rate is set to 25 percent for strict-high queues if you do not set the transmission rate for the schedulers for strict-high queues.

Before this change the output of a show task replication logical-system all | display xml validate command reported an error. After the change the output is correctly formatted with a "logical-system" root tag and no validation error occurs.

Single source of data for operational state sensor leaves (PTX10008)— You can use the suppress-interface-leaf CLI statement to suppress telemetry streaming of the following sensors from the packet forwarding engine (PFE): /interfaces/interface/state/high-speed /interfaces/interface/state/oper-status This might be required for collectors that require a single source of data for each sensor.

See [ suppress-interface-leaf.]

Label for the hours unit of time displayed in output —When there are zero minutes in the output for the show system uptime command, the label for the hours unit of time is displayed.

[See show system uptime.]

In the past inet6flow.0 was not allowed to be a primary rib in a rib-group. Starting with Release 22.3 this is now allowed.

Global tunnel termination option disables tunnel termination for all traffic (PTX10000 Series Routers)— You can use the set interfaces logical-interface-name unit n family inet/inet6 no-tunnel-termination command to block VXLAN tunnel termination for the port. Adding the no-tunnel-termination option disables tunnel termination for all traffic which the firewall filter would have otherwise allowed you to block termination based on IP addresses.

[See VXLAN Constraints on PTX10000 Series Routers.]

The active-user-count is defined as a numeric integer value in ODL request output —The output for the get-system-uptime-information ODL request contains information for the active-user-count. The active-user-count is now defined as a numeric integer value and avoids an invalid value type error.

[See show system uptime.]

Two new alarms are added and can be seen with MPC11E when 400G-ZR optics are used. High Power Optics Too Warm: warning of the increase in chassis ambient temperature with no functional action taken on the optics Temperature too high for optics power on: New inserted optics when the chassis ambient temperature is elevated beyond the threshold will not be powered on and would need to be reinserted when the ambient temperature is within the acceptable range

The packet rate and byte rate fields for LSP sensors on AFT (with the legacy path) have been renamed as jnx-packet-rate and jnx-byte-rate and is in parity with the UKERN behavior. Previously, these rate fields were named as packetRate and byteRate.

You can specify the minimum and maximum value for the hold-time down and hold-time up interval between 0 through 3600000 milliseconds at the edit protocols network-isolation group group-name detection hierarchy level.PR1726039

Prior to this change the output of a show task replication | display xml validate returned an error of the form "ERROR: Duplicate data element <task-protocol-replication-name>. With this change the XML output is properly structured with no validation errors.

Starting in Junos OS release 23.2R1 and Junos OS Evolved release 23.2R1-EVO, the output of show chassis power command displays the state of the power supply in PTX10003 and QFX10003 platforms.

[See show chassis power.]

Ability to commit extension-service file configuration when application file is unavailable—When you set the optional option at the edit system extension extension-service application file file-name hierarchy level, the operating system can commit the configuration even if the file is not available at the /var/db/scripts/jet file path.

[See file (JET).]

Ability to restart restart daemonized applications—Use the request extension-service restart-daemonize-app application-name command to restart a daemonized application running on a Junos device. Restarting the application can assist you with debugging and troubleshooting.

[See request extension-service restart-daemonize-app.]

Change in display of affinity constraints to hexadecimal values (ACX7100-32C, ACX7100-48L, ACX7509, ACX7024, PTX10001-36MR, PTX10004, PTX10008, and PTX10016)-Starting in Junos Evolved Release 22.4R1, in the output of the show ted spring-te-policy extensive operational command, the affinity constraints will be displayed in hexadecimal format instead of decimal.

See [ show ted spring-te-policy extensive.]

The connectivity fault management process (cfmd) runs only when the ethernet connectivity-fault-management protocol is configured.

Changes to the show system yang package (get-system-yang-packages RPC) XML output (ACX Series, PTX Series, and QFX Series)—The show system yang package command and get-system-yang-packages RPC include the following changes to the XML output:

• The root element is yang-package-information instead of yang-pkgs-info.

• A yang-package element encloses each set of package files.

• The yang-pkg-id tag is renamed to package-id.

• If the package does not contain translation scripts, the Translation Script(s) (trans-scripts) value is none.

NETCONF server's <rpc-error> response changed when <load-configuration> uses operation="delete" to delete a nonexistent configuration object (ACX Series, PTX Series, and QFX Series)—In an earlier release, we changed the NETCONF server's <rpc-error> response for when an <edit-config> or <load-configuration> operation uses operation="delete" to delete a configuration element that is absent in the target configuration. We've reverted the changes to the <load-configuration> response.

operator login class is restricted from viewing NETCONF trace files that are no-world-readable (ACX Series, PTX Series, and QFX Series)—When you configure NETCONF tracing options at the [edit system services netconf traceoptions] hierarchy level and you restrict file access to the file owner by setting or omitting the no-world-readable statement (the default), users assigned to the operator login class do not have permissions to view the trace file.

Support for the junos:cli-feature YANG extension (ACX Series, PTX Series, and QFX Series)—The cli-feature YANG extension identifies certain CLI properties associated with some command options and configuration statements. The Junos YANG modules that define the configuration or RPCs include the cli-feature extension statement, where appropriate, in schemas emitted with extensions. This extension is beneficial when a client consumes YANG data models, but for certain workflows, the client needs to generate CLI-based tools.

[See Understanding the Junos DDL Extensions YANG Module.]

The ping host | display xml validate command validates XML without error (ACX Series, PTX Series, and QFX Series) — In Junos OS and Junos OS Evolved releases prior to 22.4R2, the ping host | display xml validate command results in CRITICAL ERROR: Root tag name mismatch. Expected 'ping-results', got 'run-command'. The command now validates the XML successfully without error.

See [ ping.]

Prior to this change the output of the show isis statistics interface <interface_name> | display xml command used the XML tag "interface-name", which generated an error. With the change the XML output uses the tag "isis-interface-name".

Prior to this change the output of the show isis spring flex-algorithm | display xml command was invalidly formatted when multiple flex algorithm instances were configured. With the change, the XML output is properly structured showing flex algorithm information for each instance. A new XML tag "isis-spring-flex-algorithm" is added to bundle information for each instance.

In Junos OS Evolved platforms, show route snooping and show route forwarding-table does not show /56 routes in the VPLS address family table.

Deprecating options related to certificate enrollment (Junos)—Starting in Junos OS Release 23.2R1, we’re deprecating earlier CLI options related to Public Key Infrastructure (PKI) to enroll and reenroll local certificate through Simple Certificate Enrolment Protocol (SCEP). The table below shows the Junos CLI commands and configuration statements with the options being deprecated. You can find the same CLI options now available under scep option in these commands and statements.

[See auto-re-enrollment (Security), request security pki local-certificate enroll scep, and request security pki node-local local-certificate enroll.]

In Junos OS Evolved releases prior to 22.4R1, the show system directory-usage command assumes the current working directory is always /usr/sbin. If you want to run the command inside another directory, you must include the full directory path in the command. Starting in Junos OS Evolved Release 22.4R1, this command references the directory you currently have open. The command output displays the absolute path of the directory so you can easily see you are in the correct directory.

See [ system directory-usage.]

The xmlns:junos attribute includes the complete software version string (ACX Series, PTX Series, and QFX Series)—The xmlns:junos namespace string in XML RPC replies includes the complete software version release number, which is identical to the version emitted by the show version command. In earlier releases, the xmlns:junos string includes only partial software version information.