Hardware

Class of Service

• Support for Class of Service (CoS) features including:

  • Behaviour Aggregate classifiers and rewrites

  • Hierarchical Class of Service (HCoS)/Per VLAN with a queuing delay bandwidth buffer of 100ms for interfaces with 1G or higher speeds, and a buffer of 500ms for interfaces with less than 1G speeds.

  • Trio QoS model with five guaranteed regions and four excess regions for the scheduler (in both normal and enhanced priority modes)

  • Eight queues with strict prioritization

  [See Behavior Aggregate Classifiers, Hierarchical Class of Service Overview, and Class of Service for Routers.]

Dynamic Host Configuration Protocol

• Support for Dynamic Host Configuration Protocol (DHCP) v4/v6 in non-broadband Edge solutions, including:

  • Local server
  • Dynamic reconfiguration of clients from a DHCP local server
  • Smart, stateful, and forward-only (stateless) relay
  • Snooping
  • Integrated routing and bridging (IRB)
  • EVPN-VXLAN support for centrally routed bridging (CRB) access models only. We don't support EVPN-VXLAN on edge-routed bridging (ERB) access models.

  [See DHCP Relay Agent, DHCP Subscriber Access Networks Overview, DHCP Snooping for Network Security, DHCP Smart Relay in EVPN-VXLAN, and Dynamic Client/Server Interaction for DHCPv6.]

High availability and resiliency

• Support for platform resiliency, line card, and chassis resiliency. Routing Engine resiliency runs on Junos OS software and covers the basic chassis management including Routing Engine, fans, and power supply modules (PSMs). ULC resiliency runs on the Junos OS Evolved software including the YT ASIC, Packet Forwarding Engine, PFE FPGA, and the Ethernet switch.

  [See Platform Resiliency.]

• Support for Routing and Control Board (RCB) and Packet Forwarding Engine resiliency.

  [See show chassis errors active.]

Interfaces

• Support for optics temperature sensors in the Junos Environment Monitoring (EM) policy, including:

  • Polling temperature readings of optical modules in the system periodically to automatically manage the fan speed

  • Triggering optics shutdown for 50GbE, 100GbE, and 400GbE optics firmware when the high-temperature threshold is breached

  The EM policy is enabled by default on all 50GbE, 100GbE, and 400GbE optics interfaces, except for loopback optics and direct attach copper (DAC) cables. You can use the set chassis fpc fpc_slot pic pic_slot port port_no no-temperature-monitoring command to explicitly disable the EM policy on specific WAN ports. Use the show chassis environment command to view the optics temperature.

  [See temperature-sensor.]

• Select your product in the https://apps.juniper.net/hct/product (HCT) to view supported transceivers, optical interfaces, and direct attach copper (DAC) cables for your platform or interface module. We update the HCT and provide the first supported release information when the optic becomes available.

Junos telemetry interface (JTI)

• Support for JTI platform sensors. A basic configuration is sufficient to enable a gRPC/gNMI subscription.

  [See gRPC Services for Junos Telemetry Interface and Guidelines for Telemetry Data Subscriptions over gNMI.]

Layer 2 features

• Support for Layer 2 (L2) features, including:

  • Layer 2 protocol tunneling (L2PT)

  • Virtual private wire service (VPWS)

  • EVPN-MPLS and EVPN-VXLAN overlay networks

  • EVPN routing policies

  • Multiple VLAN Registration Protocol (MVRP) and Ethernet ring protection switching (ERPS)

  • VPLS over transport class tunnels

  • Headend termination of pseudowire services in a VPLS-enabled virtual switch

  • Q-in-Q tunneling

  • Basic DHCP snooping

  [See Layer 2 Protocol Tunneling, Overview of Headend Termination for EVPN VPWS, Multicast Support in EVPN-VXLAN Overlay Networks, Routing policies for EVPN, Understanding Multiple VLAN registration protocol (MVRP) for Dynamic VLAN Registration, Ethernet Ring Protection Switching Overview, Introduction to VPLS, Layer 2 Services on Pseudowire Service Interface Overview, Configuring Q-in-Q Tunneling, and DHCP Snooping.]

Layer 3 features

• Support for Layer 3 (L3) features, including:

  • Network slicing with routing-based and firewall-based slice steering

  • Symmetric consistent hashing for symmetric load-balancing with correlated source IP and destination IP load-balancing hash-key (both forward and reverse direction)

  • OpenConfig-compliant Segment Routing-Traffic Engineering (SR-TE) sensor compliance

  • Adaptive load balancing (ALB) on aggregate Ethernet (AE) interfaces

  • Consistent hashing on flex-algo routes in a BGP network

  • Transit statistics for pseudowire and PWHT interfaces

  • GRE tunnels over PWHT interfaces

  • Seamless MPLS L3 support with pseudowire subscriber over redundant logical tunnel and pseudowire subscriber over logical tunnel.

  • Multicast routing protocols

  • MPLS Segment routing

  • Layer 3 (L3) unicast forwarding and GRE tunneling

  • RFC-2544-based benchmarking tests

  [See Hierarchical Class of Service for Network Slicing, Actions in Routing Policy Terms, YANG Data Model Explorer, Understanding Aggregated Ethernet Load Balancing, show interfaces extensive, MPLS Pseudowire Subscriber Logical Interfaces, MPLS Overview, Multicast Routing Protocols, Generic Routing Encapsulation (GRE), and Understanding RFC 2544-Based Benchmarking Tests.]

MACsec

• Support for MACsec bounded delay protection. Enable Media Access Control Security (MACsec) bounded delay protection to protect your network against man-in-the-middle attacks. When enabled, the device ensures that a frame is not sent after a delay of two seconds or more. MACsec periodically compares the number of frames transmitted to the number of frames received. If a frame is sent but not received within two seconds, such as during a man-in-the-middle-attack, the packet is dropped.

  [See bounded-delay.]

Network management and monitoring

• Support for port mirroring.

  Analyzer is currently not supported.

  [See Port Mirroring and Analyzers.]

Protection against DDoS attacks

• Support for distributed denial-of-service (DDoS) protection. DDoS protection is enabled by default.

  [See Control Plane Distributed Denial-of-Service (DDoS) Protection Overview.]

Routing protocols

• Support for L3 routing protocols.

Routing policy and firewall filters

• Support for forwarding firewalls and 1GbE firewall support. Fabric loopback will be replaced by WAN stream loopback, which can impact mainline throughput.

  [See Understanding Firewall Filter Match Conditions and Service Filter Overview.]

Security services

• Junos OS supports IKE to define mechanisms for key generation and exchange, and manage security associations (SAs).

  Inline IPsec is supported in Unified Services Framework (USF) mode. The IPsec architecture provides a security suite for the IPv4 and IPv6 network layers. The suite provides functionality such as authentication of origin, data integrity, confidentiality, replay protection, and nonrepudiation of source. ESP in tunnel mode is supported.

  [See IPsec Overview and Enabling and Disabling Next Gen Services.]

Services applications

• Support for inline services, including:

  • Inline NAT—NAT44 and NPTv6

  • Inline softwires—Mapping of Address and Port with Encapsulation (MAP-E)

  • Mapping of Address and Port with Translation (MAP-T)

  • IPv6 rapid deployment (6rd)

  [See Inline NAT, Configuring Mapping of Address and Port with Encapsulation (MAP-E), and Configuring Inline 6rd.]

• FlowTapLite support.

  [See Understanding the FlowTap and FlowTapLite Services.]

• Inline video monitoring support, including:

  • Inline video monitoring using media delivery indexing (MDI)

  • Inline video monitoring of IPv4-over-MPLS flows to measure media delivery index (MDI) metrics

  • Inline video monitoring of IPv6 flows and IPv6-over-MPLS flows to measure media delivery index (MDI) metrics

  [See Understanding Inline Video Monitoring on MX Series Routers, video-monitoring, and show services video-monitoring mdi flows fpc-slot.]

• Inline monitoring services support to provide the flexibility to monitor different streams of traffic at different sampling rates on the same interface.

  [See Inline Monitoring Services Configuration.]

• Inline active flow monitoring support, including:

  • EVPN traffic

  • MPLS, MPLS-IPv4, and MPLS-IPv6 traffic

  • IPv4 or IPv6 traffic, including traffic on next-hop based GRE tunnels and ps interfaces

  Both IPFIX and V9 formats are supported.

  [See Understand Inline Active Flow Monitoring.]

Subscriber management and services

• Support for subscriber services in Broadband Edge (BBE) and Broadband Network Gateway (BNG) solutions. Inline carrier-grade NAT (CGNAT) is currently not supported.

  [See Broadband Subscriber Services.]

• Support for broadband network gateway (BNG) control and user plane separation (CUPS) architecture. Juniper BNG CUPS is a cloud application that separates the BNG control plane components from the native Junos OS.

  [See Juniper BNG CUPS Overview.]

• Support for 5G Access Gateway Function (AGF).

  [See Access Gateway Function.]

• Support for 5G Wireless CUPS user plane function (UPF). The UPF, supported on MX Series routers, handles all user data traffic according to the CUPS model. Junos Multi-Access UPF supports MX Series routers functioning as UPFs and provides high-throughput 5G fixed wireless and mobile wireless service in non-standalone (NSA) mode.

  [See MX Series Router As Junos Multi-Access User Plane.]

Software installation and upgrade

• Secure boot and common BIOS support. The Secure Boot implementation is based on the UEFI 2.4 standard. The BIOS has been hardened and serves as a core root of trust. The BIOS updates, the bootloader, and the kernel are cryptographically protected. Secure boot is enabled by default on supported platforms.

  [See Junos OS Overview.]

• Firmware upgrade support.

  [See request system firmware upgrade.]

• Support for secure zero-touch provisioning (SZTP). Use RFC 8572-based SZTP to bootstrap your remotely located network devices that are in a factory-default state. SZTP enables mutual authentication between the bootstrap server and the network device before the remote network device is accessed for initiating zero-touch provisioning.

  [See Secure Zero Touch Provisioning.]