What's Changed

Limit on number of IP address associations per MAC address per bridge domain in EVPN MAC-IP database—By default, devices can associate a maximum of 200 IP addresses with a single MAC address per bridge domain. We provide a new CLI statement to customize this limit, mac-ip-limit statement at the [edit protocols evpn] hierarchy level. In most use cases, you don?t need to change the default limit. If you want to change the default limit, we recommend that you don?t set this limit to more than 300 IP addresses per MAC address per bridge domain. Otherwise, you might see very high CPU usage on the device, which can degrade system performance.

[See mac-ip-limit.]PR1848779

MTU and TCP MSS not available on service interfaces (MX Series routers)—You cannot configure the media MTU or TCP MSS on service interfaces (ms, vms, or ams).

[See mtu (interfaces) and tcp-mss (Interfaces).]

Change in options and generated configuration for the EZ-LAG configuration IRB subnet-address statement—With the EZ-LAG subnet-address inet or subnet-address inet6 options at the [edit services evpn evpn-vxlan irb irb-instance] hierarchy, you can now specify multiple IRB subnet addresses in a single statement using the list syntax [ addr1 addr2 ... ]. Also, in the generated configuration for IRB interfaces, the commit script now includes default router-advertisement statements at the [edit protocols] hierarchy level for that IRB interface.

[See subnet-address (Easy EVPN LAG Configuration).]PR1773375

Media Access Control Security (MACsec) session remains stable when changing exclude-protocol configuration—When you change the protocols excluded from MACsec using the exclude-protocol protocol-name option at the [edit security macsec connectivity-association connectivity-association-name], the MACsec session remains stable. PR1779286

[See exclude-protocol.]

Validation of SRv6 unique SIDs based on function code (MX240, MX480, and MX960:)—Validation for SRv6 SID configuration with IS-IS has been enhanced so that SIDs defined under the same locator are considered duplicates when they share the same function code, even if only their argument code differs. When you configure multiple SRv6 SIDs with identical function codes, the configuration commit fails and the system reports that the function code cannot be the same for more than one SID. This behavior ensures consistent SRv6 SID allocation and prevents conflicting SID definitions under a single locator. When planning SRv6 deployments, you must allocate unique function codes for each SID associated with a given locator and adjust any existing configurations or examples that reuse the same function code across different SIDs. You must ensure that all SRv6 SIDs defined under a locator have unique function codes. Reusing the same function code (with only argument differences) for multiple SIDs now causes commit failure.PR1781445

Starting from Junos 21.4R1 platforms with the following Routing Engines which have Intel CPUs with microcode version 0x35 observe the error warning, "000: [Firmware Bug]: TSC_DEADLINE disabled due to Errata; please update microcode to version: 0x3a (or later)" on the console. RE-S-X6-64G RE-S-X6-128G REMX2K-X8-64G RE-PTX-X8-64G RE-MX2008-X8-64G RE-MX2008-X8-128G. PR1783225

ChaCha20-Poly1305 algorithm deprecation for SSH cipher option—The ChaCha20-Poly1305 authenticated encryption algorithm is deprecated for SSH cipher option. Configure aes-128-gcm and aes-256-gcm as the encryption algorithm for SSH Cipher option. PR1783811

[See ssh (System Services).]

For MPC5E line card with flexible-queuing-mode enabled, queue resources are shared between scheduler block 0 and 1. Resource monitor CLI output displays an equal distribution of the total available and used queues between scheduler blocks. This correctly represents the queue availability to the routing engine.PR1801694

[See show-system-resource-monitor and show-system-resource-monitor-ifd-cos-queue-mapping-fpc.]

By default, host-generated outbound PTP traffic is assigned to the default network control (NC) forwarding class, which is assigned to queue 3 by default. You can change both the forwarding class and queue assignment for host outbound traffic. PR1805271

[See hw-cos-default-re-traffic-overview-cos-config-guide.]

Option to disable path MTU discovery—Path MTU discovery is enabled by default. To disable it for IPv4 traffic, you can configure the no-path-mtu-discovery statement at the [edit system internet-options] hierarchy level. To reenable it, use the path-mtu-discovery statement.

[See Path MTU Discovery.]

Default Option is Deprecated (MX Series)—The default option is deprecated for the request security pki ca-certificate ca-profile-group load ca-group-name group-name filename command and is not listed as a valid completion option in the CLI: request security pki ca-certificate ca-profile-group load ca-group-name <group_name> filename. Possible completions: File path.

If you try entering the default option manually by typing rrequest security pki ca-certificate ca-profile-group load ca-group-name group-name filename default, you will see a CLI error message that the command is not supported.

[See request security pki ca-certificate ca-profile-group load.]

BGP Neighbor Telemetry Statistics (Junos OS and Junos OS Evolved)—BGP neighbor statistics reported through telemetry are now always aggregated, regardless of whether rib-sharding is enabled. Previously, when sharding was active, statistics were streamed per shard. With the current behavior, sensors are installed appropriately, and statistics are aggregated in the main thread before being streamed. The controllers and collectors now receive a single, unified view of BGP neighbor statistics.PR1765189

Micro-SID Locator Configuration Validation—We have introduced a validation rule to prevent the configuration of micro-SID locators where the Node Code is 0x00. You might encounter a commit error if you attempt to configure a micro-SID locator that results in a Node Code of 0x00. This change ensures that the SID 0x0000, reserved for End of Container (EOC), is not utilized in configurations, preventing potential routing issues.PR1782293

Configuration History Persistence—This update ensures that the configuration history, including commits and rollback data, is preserved when restarting Docker with a new container ID. By persisting the /config directory in a Docker/Podman volume, the show system commits data is now retained. This enhancement ensures full traceability of configuration changes and assists users in debugging and monitoring their configurations more efficiently.PR1787729

Increase in revert-delay timer range— The revert-delay timer range is increased to 600 seconds from 20 seconds.

[See min-rate.]

Configure min-rate for IPMSI traffic explicitly— In a source-based MoFRR scenario, you can set a min-rate threshold for IPMSI traffic explicitly by configuring ipmsi-min-rate under set routing-instances protocols mvpn hot-root-standby min-rate. If not configured, the existing min-rate will be applicable to both IPMSI and SPMSI traffic.

[See min-rate.]