What's Changed

Limit on number of IP address associations per MAC address per bridge domain in EVPN MAC-IP database—By default, devices can associate a maximum of 200 IP addresses with a single MAC address per bridge domain. We provide a new CLI statement to customize this limit, mac-ip-limit statement at the [edit protocols evpn] hierarchy level. In most use cases, you do not need to change the default limit. If you want to change the default limit, we recommend that you do not set this limit to more than 300 IP addresses per MAC address per bridge domain. Otherwise, you might see very high CPU usage on the device, which can degrade system performance.

[See mac-ip-limit.]

MTU and TCP MSS not available on service interfaces (MX Series routers)—You cannot configure the media MTU or TCP MSS on service interfaces (ms, vms, or ams).

[See mtu (interfaces).]

Change in options and generated configuration for the EZ-LAG configuration IRB subnet-address statement—With the EZ-LAG subnet-address inet or subnet-address inet6 options at the [edit services evpn evpn-vxlan irb irb-instance] hierarchy, you can now specify multiple IRB subnet addresses in a single statement using the list syntax addr1 addr2 ... . Also, in the generated configuration for IRB interfaces, the commit script now includes default router-advertisement statements at the [edit protocols] hierarchy level for that IRB interface.

[See subnet-address (Easy EVPN LAG Configuration).]

Media Access Control Security (MACsec) session remains stable when changing exclude-protocol configuration—When you change the protocols excluded from MACsec using the exclude-protocol protocol-name option at the [edit security macsec connectivity-association connectivity-association-name], the MACsec session remains stable. [See exclude-protocol.]PR1779286

Starting from Junos 21.4R1 platforms with the following Routing Engines which have Intel CPUs with microcode version 0x35 observe the error warning, "000: Firmware Bug: TSC_DEADLINE disabled due to Errata; please update microcode to version: 0x3a (or later)" on the console. RE-S-X6-64G RE-S-X6-128G REMX2K-X8-64G RE-PTX-X8-64G RE-MX2008-X8-64G RE-MX2008-X8-128G

ChaCha20-Poly1305 algorithm deprecation for SSH cipher option—The ChaCha20-Poly1305 authenticated encryption algorithm is deprecated for SSH cipher option. Configure aes-128-gcm and aes-256-gcm as the encryption algorithm for SSH Cipher option. [See ssh (System Services).] PR1783811

For MPC5E line card with flexible-queuing-mode enabled, queue resources are shared between scheduler block 0 and 1. Resource monitor CLI output displays an equal distribution of the total available and used queues between scheduler blocks. This correctly represents the queue availability to the routing engine.

[See show system resource-monitor andshow system resource-monitor ifd-cos-queue-mapping fpc.]

The topics in CVBC-Documented-In field have been updated to mention range.

Option to disable path MTU discovery—Path MTU discovery is enabled by default. To disable it for IPv4 traffic, you can configure the no-path-mtu-discovery statement at the [edit system internet-options] hierarchy level. To reenable it, use the path-mtu-discovery statement.

[See Path MTU Discovery.]

Optimized mesh group routes (QFX5110, QFX5120, QFX5130, QFX5700 and ACX Series)— show route snooping for inet.1/inet6.1 table and show route snooping table inet.1/inet6.1 will display only CE mesh group routes for platforms that support EVPN-MPLS or EVPN-VXLAN multicast. In earlier releases, other mesh groups like the VE mesh group were also displayed.

BGP Neighbor Telemetry Statistics (Junos OS and Junos OS Evolved)—BGP neighbor statistics reported through telemetry are now always aggregated, regardless of whether rib-sharding is enabled. Previously, when sharding was active, statistics were streamed per shard. With the current behavior, sensors are installed appropriately, and statistics are aggregated in the main thread before being streamed. The controllers and collectors now receive a single, unified view of BGP neighbor statistics.PR1765189

Micro-SID Locator Configuration Validation—We have introduced a validation rule to prevent the configuration of micro-SID locators where the Node Code is 0x00. You might encounter a commit error if you attempt to configure a micro-SID locator that results in a Node Code of 0x00. This change ensures that the SID 0x0000, reserved for End of Container (EOC), is not utilized in configurations, preventing potential routing issues.PR1782293

Configuration History Persistence—This update ensures that the configuration history, including commits and rollback data, is preserved when restarting Docker with a new container ID. By persisting the /config directory in a Docker/Podman volume, the show system commits data is now retained. This enhancement ensures full traceability of configuration changes and assists users in debugging and monitoring their configurations more efficiently.PR1787729

Increase in revert-delay timer range— The revert-delay timer range is increased to 600 seconds from 20 seconds.

[See min-rate.]

Configure min-rate for IPMSI traffic explicitly— In a source-based MoFRR scenario, you can set a min-rate threshold for IPMSI traffic explicitly by configuring ipmsi-min-rate under set routing-instances protocols mvpn hot-root-standby min-rate. If not configured, the existing min-rate will be applicable to both IPMSI and SPMSI traffic.

[See min-rate.]