What's Changed

Pseudowire status display update in show evpn vpws-instance output—For EVPN-VPWS pseudowire interfaces configured with protocols ccc, the Pseudowire field in the show evpn vpws-instance command output now displays the correct corresponding pseudowire status value Not Present when the local logical interface for the pseudowire connection is not present. Previously, this field still displayed the value CCC-Up even when the Status output field showed the local interface was not present.

[See show evpn vpws-instance.]

Hidden disable-fpc CLI statement (QFX5000 Series Switches)—We've hidden the disable-fpc CLI statement at the following hierarchy levels:

• edit system ddos-protection global

• set system ddos-protection protocols protocol-group aggregate

Earlier to this release, when you configure the disable-fpc CLI statement, the device generated DCPFE core when the device processes a large volume of data as it restricts the DDOS protection of the CPU.

[See disable-fpc (DDoS).]

Enhanced telemetry aggregation logic alignment with SNMP counter calculations (QFX-Series)—The Junos OS telemetry is updated to include missing internal counters used in SNMP (e.g., bucket drop, idiscards, il3_incomplete, etc.). The change to the OpenConfig sensors ensures parity across both monitoring mechanisms.

[See YANG Data Model Explorer.]

High-power optics support with CLI configuration option (QFX5240 and QFX5241)—You can enable high-power optics across all ports by configuring the high-power-mode option for each port. This feature supports up to 32 high-power modules, allowing you to benefit from enhanced connection capabilities. Ensure you configure the necessary settings to initialize and utilize high-power optics effectively, optimizing your network's performance.

When you run the request vmhost zeroize command to zeroize a single Routing Engine on a dual Routing Engine device, the CLI incorrectly displays a message indicating that it will zeroize both Routing Engines.

A new counter Sessions hit due to high rate is added to show services service-sets screen-session-limit-counters command for all subscriber traffic. This counter tracks the sessions that come up on the screen irrespective of the alarm-without-drop configuration. When alarm-without-drop option is disabled, all the counters display updated statistics. When alarm-without-drop is enabled, then:

• The screen-drop counters on show services service-sets screen-session-limit-counters command do not increase.

• The Sessions hit due to high rate value is displayed.

[See alarm-without-drop-edit-services-screen-ids-options-usf, show-services-service-sets-statistic-screen-drop, and show-services-service-sets-statistic-screen-session-limit-counters.]PR1849594

Sflow sampling with firewall filters (QFX5120, QFX5200, and QFX5210)—This feature enables sFlow sampling through firewall filter actions. You can selectively sample traffic matching specific filter terms using the sampling action, providing granular visibility while reducing sampling overhead. You can configure sampling under set firewall family inet filter filer-name term term-name then hierarchy and combine with standard sFlow configuration statements, such as set protocols sflow (sample-rate, collectors, and interfaces) to export data for matched traffic.

Note that when you configure the samplingaction in a term, you cannot configure the discard and reject action in the same term.

[See sflow-support-on-switches.] PR1910068

Support added for new payload match conditions (EX4100 , EX4400 , EX5200, and QFX5120)—Support added for payload-source-ipv4-address, payload-destination-ipv4-address, payload-source-ipv6-address, payload-destination-ipv6-address, payload-source-mac-address, and payload-destination-mac-address match conditions for IPv4 and IPv6 traffic which can be applied on the ingress port only.

[See firewall-filter-match-conditions-for-ipv4-traffic.] PR1914083

Enhanced loop detection for Layer 2 networks (EX4650, QFX5120-32C, QFX5120-48T, QFX5120-48Y, and QFX5120-48YM) —We've added support for monitoring all VLANs on a logical interface. You can set vlan-id all option under the [edit vlans vlan-name] hierarchy. With this change, the devices can detect network loops across multiple VLANs and interfaces, improving network stability and performance.

[See Enable Lightweight PE-CE Loop Detect on a Logical Interface and loop-detect.] PR1924351

New file path for customer binding information—The Dynamic Host Configuration Protocol (DHCP) local server or relay agent now stores customer binding information to a file in /var/db. Previously, the file was stored in /var/preserve, which was not secured. To restore the customer binding information after an upgrade or reboot, choose one of the following approaches: -Before upgrading, copy the file from /var/preserve to /var/db. -After upgrading, copy the file from /var/preserve to /var/db and run the request dhcp restore-persistent-clients from-file command.

[See Configuring DHCP Local Server to Preserve Subscriber Binding Information.]PR1934180

Supports static route configurations with /32 host addresses—Static Route Configuration with /32 host addresses allows configuring static routes using an interface as the next-hop, even if the interface has a /32 netmask. This change is significant for network administrators managing static routes in environments where interfaces are often assigned /32 addresses. Routes configured in this manner will now commit successfully, removing previous limitations. Example for CLI commands of static routes that uses an interface addresses as next-hop: set routing-options static route 45.63.100.176/32 next-hop et-0/0/32.0 set interfaces et-0/0/32 unit 0 family inet address 169.254.255.32/32. PR1929438