What's Changed

OISM SBD bit in EVPN Type 3 route multicast flags extended community—In EVPN Type 3 Inclusive Multicast Ethernet Tag (IMET) route advertisements for interfaces associated with the supplemental bridge domain (SBD) in an EVPN optimized intersubnet multicast (OISM) network, we now set the SBD bit in the multicast flags extended community. We set this bit for interoperability with other vendors, and to comply with the IETF draft standard for OISM, draft-ietf-bess-evpn-irb-mcast.You can see this setting in the output from the show route table bgp.evpn.0 ? extensive command.

[See CLI Commands to Verify the OISM Configuration.]

Group-based Policy (GBP) tag displayed with show bridge mac-table command—On platforms that support VXLAN-GBP, the show bridge mac-table command now displays a GBP TAG output column that lists the GBP tag associated with the MAC address for a bridge domain or VLAN in a routing instance. Even if the device doesn?t support or isn?t using GBP itself, the output includes this information for GBP tags in packets received from remote EVPN-VXLAN peers.

[See Example: Micro and Macro Segmentation using Group Based Policy in a VXLAN.]

Default behavior changes and new options for the easy EVPN LAG configuration (EZ-LAG) feature—The easy EVPN LAG configuration feature now uses some new default or derived values, as follows:

• Peer PE device peer-id value can only be 1 or 2.

• You are required to configure the loopback subnet addresses for each peer PE device using the new loopback peer1-subnet and loopback peer2-subnet options at the [edit services evpn device-attribute] hierarchy level. The commit script uses these values for each peer PE device's loopback subnet instead of deriving those values on each PE device. These replace the loopback-subnet option at the [edit services evpn device-attribute] hierarchy level, which has been deprecated.

• If you configure the no-policy-and-routing-options-config option, you must configure a policy statement called EXPORT-LO0 that the default underlay configuration requires, or configure the new no-underlay-config option and include your own underlay configuration.

• The commit script generates "notice" messages instead of "error" messages for configuration errors so you can better handle [edit services evpn] configuration issues.

• The commit script includes the element names you configure (such as IRB instance names and server names) in description statements in the generated configuration.

This feature now includes a few new options so you have more flexibility to customize the generated configuration:

• no-underlay-config at the [edit services evpn] hierarchy level—To provide your own underlay peering configuration.

• mtu overlay-mtu and mtu underlay-mtu options at the [edit services evpn global-parameters] hierarchy level—To change the default assigned MTU size for underlay or overlay packets.

[See Easy EVPN LAG Configuration.]

Limit on number of IP address associations per MAC address per bridge domain in EVPN MAC-IP database—By default, devices can associate a maximum of 200 IP addresses with a single MAC address per bridge domain. We provide a new CLI statement to customize this limit, mac-ip-limit statement at the [edit protocols evpn] hierarchy level. In most use cases, you don?t need to change the default limit. If you want to change the default limit, we recommend that you don?t set this limit to more than 300 IP addresses per MAC address per bridge domain. Otherwise, you might see very high CPU usage on the device, which can degrade system performance.

[See mac-ip-limit.]

The subscription path for the flow sensor is changed from /junos/security/spu/flow/usage to /junos/security/spu/flow/statistics. This change maintains a uniform path in request and response data.

Disable the integrity check value (ICV) indicator type, length, and value (TLV) on the MKA protocol to enable MACsec sessions—By default, the ICV indicator is enabled. In most networks, when MACsec is configured, devices ignore the ICV TLV and establish a MACsec session instead. In networks that do not establish a MACsec session when the ICV TLV is enabled, use the disable-icv-indicator option at the [edit security macsec connectivity-association ca-name mka] hierarchy level to disable the ICV TLV and allow the network to establish the MACsec session. To confirm the ICV TLV is disabled, use the show security mka sessions detail command. [See mka {https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/mka-edit-security-macsec.html} and show security mka sessions {https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/show-security-mka-sessions.html}.]PR1743300

Change in the XML tags displayed for the show virtual-network-functions command in JDM (Junos node slicing) — To align the XML tags displayed for the show virtual-network-functions gnf-name | display xml with the new XML validation logic, we have replaced the underscores (_) in the output with hyphens (-) as shown below:

Old output:

user@host> show virtual-network-functions mgb-gnf-d | display xml (vnf-instance) 1mgb-gnf-dRunningdown <ip_addr>192.168.2.1</ip_addr> <<< The tag includes _. 2 <max_mem>16GiB</max_mem> <<< The tag includes _. <resource_template>2core-16g</resource_template> <<< The tag includes _. <qemu_process_id>614702</qemu_process_id> <<< The tag includes _. <smbios_version>v2</smbios_version> <<< The tag includes _. New output: user@jdm> show virtual-network-functions mgb-gnf-d | display xml 1mgb-gnf-dRunningdown192.168.2.1 <<< The tag changes to ip-addr. 216GiB <<< The tag changes to max-mem. 2core-16g <<< The tag changes to resource-template. 614702 <<< The tag changes to qemu-process-id. v2 <<< The tag changes to smbios-version. This change is applicable to any RPC that previously had underscores in the XML tag name.

Changes to default behavior under forwarding-table (MX Series)— ecmp-fast-reroute and indirect-next-hop-change-acknowledgements are enabled by default under the edit routing-options forwarding-table hierarchy. You can verify these defaults by running the show configuration routing-options forwarding-table in operational mode.

[See ecmp-fast-reroute and indirect-next-hop-change-acknowledgements .]PR1757413

New LSP state for show spring-traffic-engineering—We have introduced a new state Initializing in the output of show spring-traffic-engineering, which indicates that the tunnel configuration has been queued up and is awaiting processing. The LSP is in this state only during initial application of the tunnel configuration. Any subsequent changes or updates to the tunnel configuration do not trigger this state again.

[See show spring-traffic-engineering.]PR1762424

New commit check for MAC-VRF routing instances with the encapsulate-inner-vlan statement configured—We introduced a new commit check that prevents you from configuring an IRB interface and the encapsulate-inner-vlan statement together in a MAC-VRF routing instance. Please correct or remove these configurations prior to upgrading to 23.2R2 or newer to avoid a configuration validation failure during the upgrade.

[See encapsulate-inner-vlan.]PR1768407

MTU and TCP MSS not available on service interfaces (MX Series routers)—You cannot configure the media MTU or TCP MSS on service interfaces (ms, vms, or ams).

[See mtu (interfaces) and {https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/tcp-mss-edit-interfaces-unit-family.html}tcp-mss (Interfaces).]PR1772715

Change in options and generated configuration for the EZ-LAG configuration IRB subnet-address statement—With the EZ-LAG subnet-address inet or subnet-address inet6 options at the [edit services evpn evpn-vxlan irb irb-instance] hierarchy, you can now specify multiple IRB subnet addresses in a single statement using the list syntax [ addr1 addr2 ... ]. Also, in the generated configuration for IRB interfaces, the commit script now includes default router-advertisement statements at the [edit protocols] hierarchy level for that IRB interface.

[See subnet-address (Easy EVPN LAG Configuration).]PR1773375

Media Access Control Security (MACsec) session remains stable when changing exclude-protocol configuration—When you change the protocols excluded from MACsec using the exclude-protocol protocol-name option at the [edit security macsec connectivity-association connectivity-association-name], the MACsec session remains stable. [See exclude-protocol{https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/exclude-protocol-edit-security-macsec.html}.]PR1779286

When you run the run show lldp local-information interface interface-name | display xml command, the output is displayed under the lldp-local-info root tag and in the lldp-local-interface-info container tag. When you run the run show lldp local-information interface | display xml command, the lldp-tlv-filter and lldp-tlv-select information are displayed under the lldp-local-interface-info container tag in the output.

Validation of SRv6 unique SIDs based on function code (MX240, MX480, and MX960:)—Validation for SRv6 SID configuration with IS-IS has been enhanced so that SIDs defined under the same locator are considered duplicates when they share the same function code, even if only their argument code differs. When you configure multiple SRv6 SIDs with identical function codes, the configuration commit fails and the system reports that the function code cannot be the same for more than one SID. This behavior ensures consistent SRv6 SID allocation and prevents conflicting SID definitions under a single locator. When planning SRv6 deployments, you must allocate unique function codes for each SID associated with a given locator and adjust any existing configurations or examples that reuse the same function code across different SIDs. You must ensure that all SRv6 SIDs defined under a locator have unique function codes. Reusing the same function code (with only argument differences) for multiple SIDs now causes commit failure.PR1781445

Change in use of RSA signatures with SHA-1 hash algorithm?Starting in Junos OS Release 24.2R1, there is a behavioural change by OpenSSH 8.8/8.8p1. OpenSSH 8.8/8.8p1 disables the use of RSA signatures with SHA-1 hash algorithm by default. You can use RSA signatures with SHA-256 or SHA-512 hash algorithm.

Starting from Junos OS 21.4R1 platforms with the following Routing Engines which have Intel CPUs with microcode version 0x35 observe the error warning, "000: Firmware Bug: TSC_DEADLINE disabled due to Errata; please update microcode to version: 0x3a (or later)" on the console. RE-S-X6-64G RE-S-X6-128G REMX2K-X8-64G RE-PTX-X8-64G RE-MX2008-X8-64G RE-MX2008-X8-128G

ChaCha20-Poly1305 algorithm deprecation for SSH cipher option {Junos} - The ChaCha20-Poly1305 authenticated encryption algorithm is deprecated for SSH cipher option. Configure aes-128-gcm and aes-256-gcm as the encryption algorithm for SSH Cipher option. [See ssh (System Services).] https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/ssh-edit-system.htmlPR1783811

New CLIs introduced to collect Layer 2 bridging and Layer 2 protocols for smart debugging.PR1791299

Default Option is Deprecated (MX Series)—The default option is deprecated for the request security pki ca-certificate ca-profile-group load ca-group-name group-name filename command and is not listed as a valid completion option in the CLI: request security pki ca-certificate ca-profile-group load ca-group-name group_name filename ? Possible completions: file-path File path. If you try entering the default option manually by typing request security pki ca-certificate ca-profile-group load ca-group-name group-name filename default, you will see a CLI error message that the command is not supported.

[See request security pki ca-certificate ca-profile-group load.]PR1791360

Non-revertive switchover for sender based MoFRR— In earlier Junos releases, source-based MoFRR ensured that the traffic reverted to the primary path from the backup path, when the primary path or session was restored. This reversion could result in traffic loss. Starting in Junos OS 22.4R3-S1, source-based MoFRR will not revert to the primary path, i.e. traffic will continue to flow through the backup path as long as the traffic flow rate on the backup path does not go below the configured threshold set under protocols mvpn hot-root-standby min-rate.

[See min-rate]

Show active forwarding session for sender based MoFRR— The show multicast route extensive command will show the active forwarding session in the case of source-based MoFRR. The field Session Status: Up and Forwarding will indicate that the particular session is currently forwarding traffic.

[See show multicast route.]

The system now checks the port number value (z) in the 'set interfaces et-x/y/z:n' configuration for a valid port range on PTX10002-36QDD. Previously, configurations with invalid port numbers were committed successfully. With this update, the system displays a UI error message and prevents committing configurations with invalid port numbers, ensuring configuration accuracy and preventing potential issues. PR1798445

Three new VSA's have been added to code repository for 802.1x authentication on RADIUS server under Vendor ID: 2636: - 53: Event-Type - 54: Sub-Event-Type - 55: Juniper-Generic-Message [ See https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/802-1x-authentication-switching-devices.html#id_c3v_wfk_vwb. ]PR1799430

For MPC5E line card with flexible-queuing-mode enabled, queue resources are shared between scheduler block 0 and 1. Resource monitor CLI output displays an equal distribution of the total available and used queues between scheduler blocks. This correctly represents the queue availability to the routing engine.

Change to the commit process—In prior Junos OS and Junos OS Evolved releases, if you use the commit prepare command and modify the configuration before activating the configuration using the commit activate command, the prepared commit cache becomes invalid due to the interim configuration change. As a result, you cannot perform a regular commit operation using the commit command. The CLI shows an error message: 'error: Commit activation is pending, either activate or clear commit prepare'. If you now try running the commit activate command, the CLI shows an error message: 'error: Prepared commit cache invalid, failed to activate'. You then must clear the prepared configuration using the clear system commit prepared command before performing a regular commit operation. From this Junos and Junos OS Evolved release, when you modify a device configuration after 'commit prepare' and then issue a 'commit', the OS detects that the prepared cache is invalid and automatically clears the prepared cache before proceeding with regular 'commit' operation.

[See Commit Preparation and Activation Overview.]

By default, host-generated outbound PTP traffic is assigned to the default network control (NC) forwarding class, which is assigned to queue 3 by default. You can change both the forwarding class and queue assignment for host outbound traffic. See https://www.juniper.net/documentation/us/en/software/junos/cos/topics/concept/hw-cos-default-re-traffic-overview-cos-config-guide.html.PR1805271

In a firewall filter configured with a port-mirror-instance or port-mirror action, if l2-mirror action is also configured, then port-mirroring instance family should be any. In the absence of the l2-mirror action, port-mirroring instance family should be the firewall filter family.

G.8275.1 profile configuration with PTP, SyncE, and hybrid mode (Junos)— On all Junos platforms, when configuring the G.8275.1 profile, it is mandatory to configure Precision Time Protocol (PTP), Synchronous Ethernet (SyncE), and hybrid mode. Earlier, the system would not raise a commit error even if the required hybrid and SyncE configurations were missing while configuring G.8275.1 profile. However, going forward you will not be able to configure the G.8275.1 profile without configuring PTP, SyncE and hybrid mode to be compliant with the ITU-T standards.

[See G.8275.1 Telecom Profile.]

Zeroize a specific disk—The Routing Engine of your device has multiple disks for redundancy. Use the command request system zeroize (disk1|disk2) to zeroize only one of the disks. Use disk1 to zeroize the primary disk (/dev/sda) and disk2 to zeroize the backup disk (/dev/sdb).

[See request system zeroize (Junos OS Evolved).]PR1770301

MTU Configuration Check for Demux Interfaces—A new commit-check has been introduced to validate the MTU configurations on the demux interfaces. This commit-check ensures that the underlying physical interface device (IFD) has an MTU large enough to support the configured MTU on the demux interface. If the underlying IFD's MTU is too small, a commit error gets generated prompting to increase the underlying interface's MTU before applying the configuration. Proper MTU alignment prevents configuration errors and ensures reliable network performance.PR1797797

Changes to the XML output for ping RPCs (MX480)—We've updated the junos-rpc-ping YANG module and the corresponding Junos XML RPCs to ensure that the RPC XML output conforms to the YANG schema. As a result, we changed the XML output for the following ping RPCs:

• <ping>—The XML output emits <ping-error-message> and <ping-warning-message> tags instead of <xnm:error> and <xnm:warning> tags.

• <request-ping-ce-ip>—The XML output is enclosed in an <lsping-results> root element.

• <request-ping-ethernet>—

  • The <ethping-results> root tag includes a <cfm-loopback-reply-entry> or <cfm-loopback-reply-entry-rapid> tag for each received response. In earlier releases, a single tag enclosed all responses.

  • The XML output includes only application specific error tags and omits <xnm:error> tags.

  • The <cfm-loopback-reply-entry-rapid> tag is now reflected in the YANG schema.

• <request-ping-overlay>—The <ping-overlay-results> element includes a new child tag <hash-udp-src-port>.

With this release, the CLI does not allow you to delete the ?management-instance? configuration from the [edit system] hierarchy level if you have configured syslog messages for remote hosts with the ?mgmt_junos? instance as routing instance at the [edit system syslog] hierarchy level and at the [edit system] hierarchy level. If you try to delete the management-instance configuration at the [edit system] hierarchy level without deleting it from the [edit system syslog] hierarchy level, the CLI shows a commit error.PR1785475

Enhanced burst value for DDoS protocol TTL parameters (MX10004)—We've enhanced the burst value for DDoS protocol TTL to 100%. Earlier to this release the burst value for DDoS protocol TTL was 20%.

[See show ddos-protection protocols.]PR1780241

Commands for Viewing Transport-Class and Resolution Scheme Information--We've introduced the show route transport-class command to view transport-class information and show route resolution scheme command to view custom resolution schemes for route next-hop resolution.

[See show route transport-class and show route resolution scheme.]PR1757468

BGP Neighbor Telemetry Statistics (Junos OS and Junos OS Evolved)—BGP neighbor statistics reported through telemetry are now always aggregated, regardless of whether rib-sharding is enabled. Previously, when sharding was active, statistics were streamed per shard. With the current behavior, sensors are installed appropriately, and statistics are aggregated in the main thread before being streamed. The controllers and collectors now receive a single, unified view of BGP neighbor statistics.PR1765189

Micro-SID Locator Configuration Validation—We have introduced a validation rule to prevent the configuration of micro-SID locators where the Node Code is 0x00. You might encounter a commit error if you attempt to configure a micro-SID locator that results in a Node Code of 0x00. This change ensures that the SID 0x0000, reserved for End of Container (EOC), is not utilized in configurations, preventing potential routing issues.PR1782293

iBGP RR Update for Link Bandwidth Aggregation—In iBGP Route Reflector (RR) deployments, aggregation policies may advertise BGP Link Bandwidth (LBW) values that differ from the arithmetic sum of LBWs that multiple Provider Edges (PEs) provide. The update clarifies and enforces correct LBW calculation on RRs because the RRs recompute bandwidth locally instead of summing it cumulatively. Users might observe changes in the LBW values that RRs advertise, which can influence traffic-engineering behavior.PR1806864

You can configure VLAN termination cause codes to specify RADIUS attribute values for different termination scenarios on JUNOS MX Series platforms supporting the Layer-2 Bitstream Access (L2BSA) feature. You can diagnose and manage network issues effectively by understanding the specific reasons for VLAN termination. Ensure that the correct termination cause codes are sent by validating configuration and testing scenarios to correctly interpret network events. When a subscriber logs out, the system occasionally sends an incorrect termination cause value to RADIUS. The subscriber VLAN "Account-Terminate-Cause" in "Acct-Stop" message for different L2BSA subscriber logout error scenarios is modified to display correct reasons for termination.

[See "VLAN Termination Causes and Code Values" and "show network-access aaa terminate-code".]

Viewing files with the file compare files command requires users to have maintenance permission—The file compare files command in Junos OS and Junos OS Evolved requires a user to have a login class with maintenance permission.

[See Login Classes Overview.

Configuration database maximum size increased (ACX Series, EX Series, MX Series, QFX Series, SRX Series, and vSRX)—We've enhanced the extend-size statement at the [edit system configuration-database] hierarchy level to increase the maximum database size. On devices with a default configuration database size of ~400 MB, extend-size increases the maximum database size to ~2 GB. On devices with a default configuration database size of ~660 MB, extend-size increases the maximum database size to ~2.2 GB.

[See configuration-database.]

Displaying RPC Details Despite Command Invalidity—The system now allows displaying RPC details even when executing the show pfe filter hw | display xml rpc command on unsupported platforms. This change provides essential debugging information without requiring the command to pass product checks, thus improving diagnostic capabilities.PR1765385

Message Redirection for Syslog Messages--When you have configured syslog message redirection using the following CLI: [edit system syslog] user (user_name) { any info; } and need to disable the redirection of syslog messages to the interactive terminal, issue the set cli syslog-output disable command. To enable the redirection of syslog messages, issue the syslog-output enable command. We?ve introduced this command to reduce clutter in the terminal output caused by redirection messages. For more flexibility, the root user or any other user can configure allow-syslog-output or no-allow-syslog-output configuration statements at the [edit system login user(user_name) cli] hierarchy level to allow or disallow the users from getting the syslog message redirection to the interactive terminal. PR1781529

Configuration History Persistence—This update ensures that the configuration history, including commits and rollback data, is preserved when restarting Docker with a new container ID. By persisting the /config directory in a Docker/Podman volume, the show system commits data is now retained. This enhancement ensures full traceability of configuration changes and assists users in debugging and monitoring their configurations more efficiently.PR1787729

Hot Root Standby with Inactive Route Support—Hot Root Standby (HRS) now supports querying inactive routes from shards. This enables MVPN to access and utilize inactive route data for required features. MVPN processes involving inactive routes are now handled asynchronously, ensuring smoother and more efficient operations. With this change, HRS is supported with sharding enabled.

[See hot-root-standby.]PR1763724

Increase in revert-delay timer range— The revert-delay timer range is increased to 600 seconds from 20 seconds.

[See min-rate.]

Configure min-rate for IPMSI traffic explicitly— In a source-based MoFRR scenario, you can set a min-rate threshold for IPMSI traffic explicitly by configuring ipmsi-min-rate under set routing-instances protocols mvpn hot-root-standby min-rate. If not configured, the existing min-rate will be applicable to both IPMSI and SPMSI traffic.

[See min-rate.]