What's Changed

Limit on number of IP address associations per MAC address per bridge domain in EVPN MAC-IP database--By default, devices can associate a maximum of 200 IP addresses with a single MAC address per bridge domain. We provide a new CLI statement to customize this limit, mac-ip-limit statement at the [edit protocols evpn] hierarchy level. In most use cases, you don't need to change the default limit. If you want to change the default limit, we recommend that you don?t set this limit to more than 300 IP addresses per MAC address per bridge domain. Otherwise, you might see very high CPU usage on the device, which can degrade system performance.

[See mac-ip-limit.]

Starting in Junos OS release 23.2R1 and Junos OS Evolved release 23.2R1-EVO, the output of show chassis power command displays the state of the power supply in PTX10003 and QFX10003 platforms

[See show chassis power.]

When all the members of the AE have the same speed (x) and no mixed speed configured. If you change the speed value of any member of the AE to a value other than x, the commit succeeded in earlier releases. From this release, the commit fails. When there are et interfaces with different speeds and you want them to be part of an AE interface. If you change the speed of all the members of the interfaces to be the same speed (x), configure the AE interface, and commit, the commit failed in earlier releases. From this release, such commits succeed.

In older Junos Releases, Data Definition Language (DDL) lists were ordered by the sequence in which the user configured the list items, for example a series of static routes. With this change, the list order is determined by the system with items displayed in numerical sequence rather than by the order in which the items were configured. There is no functional impact to this change.PR1738014

While running request system snapshot recovery command on all VMHost based Routing Engines, disable or stop reporting any warning message.PR1738131

Changes to XML output for MACsec operational commands—We have changed the XML output for the following MACsec operational commands (and the corresponding RPCs) so that they emit valid XML. show security mka sessions brief ? A new session-common element encloses each set of information for each session. show security mka sessions detail ? A new session-live element encloses the state of the interface. show security mka sessions summary ? A new mka-session-terse tag encloses the set of tags for each session. show security macsec connections ? A new macsec-interface-common-information element encloses the set of tags for each connection. show security mka statistics ? A new mka-interface-statistics element encloses each interface?s protocol statistics.

[See show security mka sessions{https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/show-security-mka-sessions.html }, show security macsec connections{https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/show-security-macsec-connections.html }, and show security mka statistics.]PR1744564

Community Display Enhancement—The show route receive-protocol and show route extensive commands now accurately display community values. The community values are accurately displayed, improving the reliability of network diagnostics and policy implementations based on community information.PR1752441

New commit check for MAC-VRF routing instances with the encapsulate-inner-vlan statement configured—We introduced a new commit check that prevents you from configuring an IRB interface and the encapsulate-inner-vlan statement together in a MAC-VRF routing instance. Please correct or remove these configurations prior to upgrading to 23.2R2 or newer to avoid a configuration validation failure during the upgrade.

[See encapsulate-inner-vlan.]PR1768407

Before this change most list were ordered by the sequence in which the user configured the list items, for example a series of static routes. After this change the list order is determined by the system with items displayed in numerical sequence rather than by the order in which the items were configured. There is no functional impact to this change.

ACX7509. NOTE: In the CLI using the command request chassis feb slot slot-number offline if you make the primary FEB offline, a traffic loss warning message is displayed and the FEB offline request is rejected. If offline/restart is still intended for primary FEB, use force option in addition to the command. WARNING message displayed in the CLI: "warning: RCB and FEB work in the paired slot mode. FEB %s offline/restart will result in traffic loss and does not cause a switchover. Please re-try after initiating a mastership switchover using 'request chassis routing-engine master switch' CLI. If offline/restart is still intended, use 'force' option in addition to this CLI."

ephemeral-db-support statement required to configure MSTP, RSTP, and VSTP in the ephemeral configuration database (ACX Series, EX Series, and QFX Series)--To configure Multiple Spanning Tree Protocol (MSTP), Rapid Spanning Tree Protocol (RSTP), or VLAN Spanning Tree Protocol (VSTP) in the ephemeral configuration database, you must first configure the ephemeral-db-support statement at the [edit protocols layer2-control] hierarchy level in the static configuration database.

[See Enable and Configure Instances of the Ephemeral Configuration Database.]

Media Access Control Security (MACsec) session remains stable when changing exclude-protocol configuration—When you change the protocols excluded from MACsec using the exclude-protocol protocol-name option at the [edit security macsec connectivity-association connectivity-association-name], the MACsec session remains stable. [See exclude-protocol{https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/exclude-protocol-edit-security-macsec.html}.]PR1779286

Change in options and generated configuration for the EZ-LAG configuration IRB subnet-address statement—With the EZ-LAG subnet-address inet or subnet-address inet6 options at the [edit services evpn evpn-vxlan irb irb-instance] hierarchy, you can now specify multiple IRB subnet addresses in a single statement using the list syntax [ addr1 addr2 ... ]. Also, in the generated configuration for IRB interfaces, the commit script now includes default router-advertisement statements at the [edit protocols] hierarchy level for that IRB interface.

[See subnet-address (Easy EVPN LAG Configuration).]PR1773375

ChaCha20-Poly1305 algorithm deprecation for SSH cipher option {Junos} - The ChaCha20-Poly1305 authenticated encryption algorithm is deprecated for SSH cipher option. Configure aes-128-gcm and aes-256-gcm as the encryption algorithm for SSH Cipher option. [See ssh (System Services).] https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/ssh-edit-system.htmlPR1783811

Ability to commit extension-service file configuration when application file is unavailable—When you set the optional option at the edit system extension extension-service application file file-name hierarchy level, the operating system can commit the configuration even if the file is not available at the /var/db/scripts/jet file path.

file (JET)

NETCONF <copy-config> operations support a file:// URI for copy to file operations (ACX Series, EX Series, MX Series, QFX Series, SRX Series, vMX, and vSRX)—The NETCONF <copy-config> operation supports using a file:// URI when <url> is the target and specifies the absolute path of a local file.

[See <copy-config>.]

ephemeral-db-support statement required to configure MSTP, RSTP, and VSTP in the ephemeral configuration database (ACX Series, EX Series, and QFX Series)—To configure Multiple Spanning Tree Protocol (MSTP), Rapid Spanning Tree Protocol (RSTP), or VLAN Spanning Tree Protocol (VSTP) in the ephemeral configuration database, you must first configure the ephemeral-db-support statement at the [edit protocols layer2-control] hierarchy level in the static configuration database.

[See Enable and Configure Instances of the Ephemeral Configuration Database.]

Two-Way Active Measurement Protocol (TWAMP) server/reflector test traffic classified by the ingress filter was re-classified with the values configured on the host-outbound-traffic configuration statement (All Junos OS Evolved platforms; MX Series platforms with MPC10E, MPC11E, or JNP10K-LC9600 cards)—We no longer re-classify the egress TWAMP traffic. We now maintain the same queue for the packets in the egress direction that the packets had in the ingress direction.PR1739935

Previously, shaping of Layer 2 pseudowires did not work on logical tunnel interfaces. This has been fixed for all platforms except QX chip-based MICs and MPCs.PR1751798

Optimized mesh group routes (QFX5110, QFX5120, QFX5130, QFX5700 and ACX Series)— show route snooping for inet.1/inet6.1 table and show route snooping table inet.1/inet6.1 will display only CE mesh group routes for platforms that support EVPN-MPLS or EVPN-VxLAN multicast. In earlier releases, other mesh groups like the VE mesh group were also displayed.

BGP BFD Strict Mode and Holddown Configuration Issue (Junos OS)--We've identified an issue with the BGP BFD strict mode where, if a router is configured with BFD strict mode and a holddown interval, and the peer router does not have these configurations, the BGP session remains in the idle state indefinitely. This occurs because the router with the strict configuration waits for the BFD session to establish, while the peer router waits for the BGP session to establish. To avoid this issue, ensure that both routers are consistently configured with BFD strict mode and holddown intervals.

[See BFD strict mode for BGP peer sessions.]PR1749221

Changed Advertisement of Argument-Length Values (Junos OS and Junos OS Evolved)—Argument-Length (AL) values calculation formula has been updated to 128 - (Block-Length + Node-Length + Function-Length). This change aligns the system with updated standards, promoting smoother interoperability across network devices. No configuration changes are required from the users' side.PR1750434

Commands for Viewing Transport-Class and Resolution Scheme Information (Junos OS and Junos OS Evolved)--We've introduced the show route transport-class command to view transport-class information and show route resolution scheme command to view custom resolution schemes for route next-hop resolution.

PR1757468

BGP Neighbor Telemetry Statistics (Junos OS and Junos OS Evolved)—BGP neighbor statistics reported through telemetry are now always aggregated, regardless of whether rib-sharding is enabled. Previously, when sharding was active, statistics were streamed per shard. With the current behavior, sensors are installed appropriately, and statistics are aggregated in the main thread before being streamed. The controllers and collectors now receive a single, unified view of BGP neighbor statistics.PR1765189

Optimized mesh group routes (QFX5110, QFX5120, QFX5130, QFX5700 and ACX Series)—show route snooping for inet.1/inet6.1 table and show route snooping table inet.1/inet6.1 will display only CE mesh group routes for platforms that support EVPN-MPLS or EVPN-VxLAN multicast. In earlier releases, other mesh groups like the VE mesh group were also displayed.PR1772078

Micro-SID Locator Configuration Validation—We have introduced a validation rule to prevent the configuration of micro-SID locators where the Node Code is 0x00. You might encounter a commit error if you attempt to configure a micro-SID locator that results in a Node Code of 0x00. This change ensures that the SID 0x0000, reserved for End of Container (EOC), is not utilized in configurations, preventing potential routing issues.PR1782293

Viewing files with the file compare files command requires users to have maintenance permission—The file compare files command in Junos OS and Junos OS Evolved requires a user to have a login class with maintenance permission.

[See Login Classes Overview.]PR1759073

Increase in revert-delay timer range—The revert-delay timer range is increased to 600 seconds from 20 seconds.

[See min-rate.]

Increase in revert-delay timer range—The revert-delay timer range is increased to 600 seconds from 20 seconds.

[See min-rate.]PR1780148

Configure min-rate for IPMSI traffic explicitly—In a source-based MoFRR scenario, you can set a min-rate threshold for IPMSI traffic explicitly by configuring ipmsi-min-rate under set routing-instances protocols mvpn hot-root-standby min-rate. If not configured, the existing min-rate will be applicable to both IPMSI and SPMSI traffic.

[See min-rate.]PR1794379