What's Changed

EVPN-VXLAN tracing configuration—The set services trace evpn-vxlan configuration invokes a built-in commit script to generate tracing configurations for troubleshooting EVPN-VXLAN in multiple modules and hierarchies.

[See trace (EVPN-VXLAN).]

• Peer PE device peer-id value can only be 1 or 2.

• You are required to configure the loopback subnet addresses for each peer PE device using the new loopback-subnet peer1-subnet and loopback peer2-subnet options at the edit services evpn device-attribute hierarchy level. The commit script uses these values for each peer PE device's loopback subnet instead of deriving those values on each PE device. The loopback-subnet option at the edit services evpn device-attribute hierarchy level has been deprecated.

• If you configure the no-policy-and-routing-options-config option, you must configure a policy statement called EXPORT-LO0 that the default underlay configuration requires, or configure the new no-underlay-config option and include your own underlay configuration.

• The commit script generates "notice" messages instead of "error" messages for configuration errors so you can better handle [edit services evpn] configuration issues.

• The commit script includes the element names you configure (such as IRB instance names and server names) in description statements in the generated configuration.

This feature also now includes a few new options so you have more flexibility to customize the generated configuration:

• no-underlay-config at the [edit services evpn] hierarchy level—To provide your own underlay peering configuration.

• mtu overlay-mtu and mtu underlay-mtu options at the [edit services evpn global-parameters] hierarchy level—To change the default assigned MTU size for underlay or overlay packets.

[See Easy EVPN LAG Configuration.]

Change in options and generated configuration for the EZ-LAG configuration IRB subnet-address statement—With the EZ-LAG subnet-address inet or subnet-address inet6 options at the [edit services evpn evpn-vxlan irb irb-instance] hierarchy, you can now specify multiple IRB subnet addresses in a single statement using the list syntax addr1 addr2 ?. Also, in the generated configuration for IRB interfaces, the commit script now includes default router-advertisement statements at the edit protocols hierarchy level for that IRB interface.

[See subnet-address (Easy EVPN LAG Configuration).]

For firewall filter action and match on slice ID, family-name can be inet, inet6, mpls, or any.PR1742998

Changes to Aggregate Level Policer at FPC (EX9208)—The summation of newly added sub-policers HELLO and UNCLS for DDOS protocols OSPF, OSPFv3, and RSVP result in the correct reporting of counters at the FPC level, for e.g. packet drops. Earlier, you could configure the OSPF, OSPFv3, and RSVP aggregate policer at the FPC level directly.

You can use the following CLI statements to configure the burst and bandwidth values for OSPF, OSPFv3, and RSVP.

• set system ddos-protection protocols ospf ospf-hello burst size bandwidth packets-per-second
• set system ddos-protection protocols ospf ospf-uncls burst 10000 bandwidth 10000
• set system ddos-protection protocols ospfv3v6 ospfv3v6-hello burst 10000 bandwidth 10000
• set system ddos-protection protocols ospfv3v6 ospfv3v6-uncls burst 10000 bandwidth 10000
• set system ddos-protection protocols rsvp rsvp-hello burst 10000 bandwidth 10000
• set system ddos-protection protocols rsvp rsvp-uncls burst 10000 bandwidth 10000

[See Protocols (DDOS).]

The active-user-count is defined as a numeric integer value in ODL request output—The output for the get-system-uptime-information ODL request contains information for the active-user-count. The active-user-count is now defined as a numeric integer value and avoids an invalid value type error.

[See show system uptime.]PR1718991

Two new alarms are added and can be seen with MPC11E when 400G-ZR optics are used. High Power Optics Too Warm: warning of the increase in chassis ambient temperature with no functional action taken on the optics Temperature too high for optics power on: New inserted optics when the chassis ambient temperature is elevated beyond the threshold will not be powered on and would need to be reinserted when the ambient temperature is within the acceptable range.PR1719569

The packet rate and byte rate fields for LSP sensors on AFT (with the legacy path) have been renamed as jnx-packet-rate and jnx-byte-rate and is in parity with the UKERN behavior. Previously, these rate fields were named as packetRate and byteRate.PR1725641

In TVP Platforms, When the FPC is configured to bring offline due to major errors, the alarm string "FPC x Offlined due to Major Errors" will be shown in the show chassis alarm and show system alarm output instead of "FPC x Major Errors" alarm.PR1734370

Support for podman-based JDM deployment—Starting in Junos OS Release 23.2R1, the external server-based Junos node slicing supports deployment of Juniper Device Manager (JDM) using the Pod Manager tool (podman). This change is applicable to servers running Red Hat Enterprise Linux (RHEL) 9. In Junos releases prior to 23.2R1, Junos node slicing supported RHEL 7.3 that provided libvirt?s lxc driver (libvirt-lxc) to deploy JDMs.PR1737550

In older Junos OS Releases, Data Definition Language (DDL) lists were ordered by the sequence in which the user configured the list items, for example a series of static routes. With this change, the list order is determined by the system with items displayed in numerical sequence rather than by the order in which the items were configured. There is no functional impact to this change.PR1738014

While running request system snapshot recovery command on all VMHost based Routing Engines, disable or stop reporting any warning message.PR1738131

Deprecated license revoke information—Starting in Junos OS Release 23.4R1, we've deprecated the show system license revoked-info command. You can use the show system license and show system license usage commands to know the license information.PR1738378

Disable the integrity check value (ICV) indicator type, length, and value (TLV) on the MKA protocol to enable MACsec sessions—By default, the ICV indicator is enabled. In most networks, when MACsec is configured, devices ignore the ICV TLV and establish a MACsec session instead. In networks that do not establish a MACsec session when the ICV TLV is enabled, use the disable-icv-indicator option at the [edit security macsec connectivity-association ca-name mka] hierarchy level to disable the ICV TLV and allow the network to establish the MACsec session. To confirm the ICV TLV is disabled, use the show security mka sessions detail command. [See mka and show security mka sessions.]PR1743300

Changes to XML output for MACsec operational commands—We have changed the XML output for the following MACsec operational commands (and the corresponding RPCs) so that they emit valid XML. show security mka sessions brief ? A new session-common element encloses each set of information for each session. show security mka sessions detail ? A new session-live element encloses the state of the interface. show security mka sessions summary ? A new mka-session-terse tag encloses the set of tags for each session. show security macsec connections ? A new macsec-interface-common-information element encloses the set of tags for each connection. show security mka statistics ? A new mka-interface-statistics element encloses each interface's protocol statistics.

[See show security mka sessions, show security macsec connections, and show security mka statistics.]PR1744564

Support extended for Default No VSTP Flooding (EX Series and QFX Series)—When a switch receives an incoming VSTP PDU, it is sent to the PFE host path where it is re-injected over the VLAN, which might cause VSTP flooding. No VSTP (VLAN Spanning Tree Protocol) Flooding, allows the packets to be dropped at the PFE host path and does not allow flooding or re-injection to the VLAN. "No VSTP Flooding" is implemented by default. VSTP flooding can be enabled using set switch-options vstp-flooding command. [See https://www.juniper.net/documentation/us/en/software/junos/stp-l2/topics/topic-map/spanning-tree-configuring-vstp.html]. PR1745592

Activation of SFP-10GBASE-T for 1G speed simultaneously with other 1G SFPs—If you want to use SFP-10GBASE-T at 1G speed, use a separate quad of ports. Do not mix with other 1G SFPs because SFP-10GBASE-T deactivates other ports with a different 1G SFP module.

Community Display Enhancement—The show route receive-protocol and show route extensive commands now accurately display community values. The community values are accurately displayed, improving the reliability of network diagnostics and policy implementations based on community information.PR1752441

Change in the XML tags displayed for the show virtual-network-functions command in JDM (Junos node slicing)]-To align the XML tags displayed for the show virtual-network-functions gnf-name | display xml with the new XML validation logic, we have replaced the underscores (_) in the output with hyphens (-). This change is applicable to any RPC that previously had underscores in the XML tag name.

New commit check for MAC-VRF routing instances with the encapsulate-inner-vlan statement configured—We introduced a new commit check that prevents you from configuring an IRB interface and the encapsulate-inner-vlan statement together in a MAC-VRF routing instance. Please correct or remove these configurations prior to upgrading to Junos OS 23.2R2 or newer to avoid a configuration validation failure during the upgrade.

[See encapsulate-inner-vlan.]PR1768407

ephemeral-db-support statement required to configure MSTP, RSTP, and VSTP in the ephemeral configuration database (ACX Series, EX Series, and QFX Series)—To configure Multiple Spanning Tree Protocol (MSTP), Rapid Spanning Tree Protocol (RSTP), or VLAN Spanning Tree Protocol (VSTP) in the ephemeral configuration database, you must first configure the ephemeral-db-support statement at the [edit protocols layer2-control] hierarchy level in the static configuration database.

[See Enable and Configure Instances of the Ephemeral Configuration Database.]PR1769383

Change in options and generated configuration for the EZ-LAG configuration IRB subnet-address statement—With the EZ-LAG subnet-address inet or subnet-address inet6 options at the [edit services evpn evpn-vxlan irb irb-instance] hierarchy, you can now specify multiple IRB subnet addresses in a single statement using the list syntax [ addr1 addr2 ... ]. Also, in the generated configuration for IRB interfaces, the commit script now includes default router-advertisement statements at the [edit protocols] hierarchy level for that IRB interface.

[See subnet-address (Easy EVPN LAG Configuration).]PR1773375

LSPs scale license-Starting in Junos OS 22.4R3 and 23.4R1 Junos OS Evolved releases, the license counts only the Resource Reservation Protocol-Traffic Engineering (RSVP-TE) and Segment Routing Traffic Engineering (SR-TE) LSPs. Prior to the 22.4R3 and 23.4R1 Junos OS Evolved releases, license counts all Traffic Engineering (TE) such as RSVP-TE and SR-TE and non-TE such as LDP, BGP-LU, L-ISIS, L-OSPF LSPs.PR1792696

When all the members of the AE have the same speed (x) and no mixed speed configured. If you change the speed value of any member of the AE to a value other than x, the commit succeeded in earlier releases. From this release, the commit fails. When there are et interfaces with different speeds and you want them to be part of an AE interface. If you change the speed of all the members of the interfaces to be the same speed (x), configure the AE interface, and commit, the commit failed in earlier releases. From this release, such commits succeed.PR1745893

Ability to commit extension-service file configuration when application file is unavailable—When you set the optional option at the edit system extension extension-service application file file-name hierarchy level, the operating system can commit the configuration even if the file is not available at the /var/db/scripts/jet file path.

See file (JET).

XML output tags changed for request-commit-server-pause and request-commit-server-start (ACX Series, EX Series, MX Series, QFX Series, SRX Series, and vSRX)—We've changed the XML output for the request system commit server pause command (request-commit-server-pause RPC) and the request system commit server start command (request-commit-server-start RPC). The root element is <commit-server-operation> instead of <commit-server-information>, and the <output> tag is renamed to <message>.

Ability to restart restart daemonized applications—Use the request extension-service restart-daemonize-app application-name command to restart a daemonized application running on a Junos device. Restarting the application can assist you with debugging and troubleshooting.

[See request extension-service restart-daemonize-app.]PR1725063

NETCONF copy-config operations support a file:// URI for copy to file operations (ACX Series, EX Series, MX Series, QFX Series, SRX Series, and vSRX)—The NETCONF copy-config operation supports using a file:// URI when url is the target and specifies the absolute path of a local file.

[See copy-config.]

ephemeral-db-support statement required to configure MSTP, RSTP, and VSTP in the ephemeral configuration database (ACX Series, EX Series, and QFX Series)—To configure Multiple Spanning Tree Protocol (MSTP), Rapid Spanning Tree Protocol (RSTP), or VLAN Spanning Tree Protocol (VSTP) in the ephemeral configuration database, you must first configure the ephemeral-db-support statement at the [edit protocols layer2-control] hierarchy level in the static configuration database.

[See Enable and Configure Instances of the Ephemeral Configuration Database.]

Previously, shaping of Layer 2 pseudowires did not work on logical tunnel interfaces. This has been fixed for all platforms except QX chip-based MICs and MPCs.PR1751798

After this change IS-IS export policies support setting the down bit configuring the "set-down-bit" action in an export policy term.

TI-LFA and Legacy LFA Configuration Commit Validation Update (Junos OS and Junos OS Evolved)—You can now enable TI-LFA and legacy FRR (node-link-protection) in separate OSPF instances. The system generates a commit error only if you enable both TI-LFA and legacy FRR under the same OSPF instance. In that case, the commit fails and triggers the following message: "error: commit failed: (statements constraint check failed)".

[See Topology-Independent Loop-Free Alternate with Segment Routing for IS-IS and OSPF.]PR1718886

BGP Multipath route calculation—When configuring multipath in the routing-instance, BGP routes that are inactive due to cluster-list length are also considered as eligible for multipath calculations. This enhances route selection by including more potential paths in your multipath configuration.

[See Understanding BGP Path Selection.]PR1719797

BGP Multipath State Information in show route extensive Command (Junos OS and Junos OS Evolved)—The show route extensive command now includes per-prefix BGP multipath state information. This update provides detailed insight into BGP multipath state for the prefix and enhances network troubleshooting for more effective diagnostics and issue resolution.

[See show route extensive.]PR1729787

After this change ISIS export policies support setting the down bit configuring the "set-down-bit" action in an export policy term.PR1737106

[BGP BFD Strict Mode and Holddown Configuration Issue (Junos OS)]--We've identified an issue with the BGP BFD strict mode where, if a router is configured with BFD strict mode and a holddown interval, and the peer router does not have these configurations, the BGP session remains in the idle state indefinitely. This occurs because the router with the strict configuration waits for the BFD session to establish, while the peer router waits for the BGP session to establish. To avoid this issue, ensure that both routers are consistently configured with BFD strict mode and holddown intervals. [See {https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bfd-for-bgp-session.html#id-understanding-bfd-for-bgp__d58e80}BFD strict mode for BGP peer sessions.]PR1749221

Changed Advertisement of Argument-Length Values (Junos OS and Junos OS Evolved)—Argument-Length (AL) values calculation formula has been updated to 128 - (Block-Length + Node-Length + Function-Length). This change aligns the system with updated standards, promoting smoother interoperability across network devices. No configuration changes are required from the users' side.PR1750434

[Commands for Viewing Transport-Class and Resolution Scheme Information]--We've introduced the show route transport-class command to view transport-class information and show route resolution scheme command to view custom resolution schemes for route next-hop resolution.

[See show route transport-class and show route resolution scheme.]PR1757468

BGP Neighbor Telemetry Statistics (Junos OS and Junos OS Evolved)—BGP neighbor statistics reported through telemetry are now always aggregated, regardless of whether rib-sharding is enabled. Previously, when sharding was active, statistics were streamed per shard. With the current behavior, sensors are installed appropriately, and statistics are aggregated in the main thread before being streamed. The controllers and collectors now receive a single, unified view of BGP neighbor statistics.PR1765189

Information about users editing system configuration—The show system configuration database status command displays information from the Junos OS configuration database that describes the users currently editing the system configuration.

Port Mirroring Configuration Update—Interface ranges are no longer supported as part of configuration groups for creating analysers. If you attempt to use an interface-range in a config group, you will encounter an error indicating an invalid interface type. Additionally, interface ranges or interface lists cannot be configured under this setting. This change ensures precise and error-free configuration by requiring the specification of individual interfaces rather than ranges, thus improving the accuracy and reliability of port mirroring setups.PR1728883

Output for request system software status | display xml validate has a tag mismatch error (all platforms)—The output contains the error message CRITICAL ERROR: Root tag 'package-status' is either not defined in ODL or does not have 'flag root' set. Please check. Rendering may not work properly. We have removed the improperly defined package-status tag and replaced it with a new child tag package-status-message.

Viewing files with the file compare files command requires users to have maintenance permission—The file compare files command in Junos OS and Junos OS Evolved requires a user to have a login class with maintenance permission.

[See Login Classes Overview.]