What's Changed

The show dhcp-security vlans detail command now correctly displays the Interface Flag column, which shows the trust status for each interface. Flag values are hexadecimal bitmasks indicating: 0x1 (trusted), 0x2 (untrusted), 0x4 (no option82), 0x8 (no option37), 0x10 (no option18), 0x20 (no option16), 0x40 (no dhcpv6 options), and 0x80 (no option79).

[See show dhcp-security vlans.]

Control Maximum 802.1X Client Connections per Interface—By default, dot1x interfaces configured in multiple supplicant mode have a client limit of 100 authenticated connections per interface. Any additional connection attempts beyond this limit will be automatically blocked.

New option for debug collector data storage path—We've included the outdir option to specify an output directory for storing debug collector data in a customised path. This allows you to organise and access diagnostic information more efficiently, adapting storage[ to your specific requirements.

A new counter Sessions hit due to high rate is added to the show services service-sets screen-session-limit-counters command for all subscriber traffic. This counter tracks the sessions that come up on the screen irrespective of the alarm-without-drop configuration. When the alarm-without-drop option is disabled, all the counters display updated statistics. When alarm-without-drop is enabled, then, the screen-drop counters on the show services service-sets statistic screen-drop command do not increase. TheSessions hit due to high rate value is displayed.

When you run the request vmhost zeroize command to zeroize a single Routing Engine on a dual Routing Engine device, the CLI incorrectly displays a message indicating that it will zeroize both Routing Engines

Validation of /vm-primary mount during JDM installation or upgrade (Junos Node Slicing External Server Deployment)—During installation or upgrade of the Juniper Device Manager (JDM) on external servers running Junos Node Slicing Release 25.2 or later, an issue occurred with the validation of the /vm-primary mount that stores the GNF images. When /vm-primary was mounted using logical volumes (LVM), JDM would fail to detect that the underlying storage was an SSD. This issue is now fixed. However, the fix introduces a new dependency on the LVM2 package in the host OS. This package is included by default in standard installations of both RHEL and Ubuntu external servers. However, it is advised that you check if the LVM2 package is already installed on the host before installing or upgrading JDM.

Chassis redundancy failover options are not supported on ACX7348, ACX7332, and ACX7059 platforms—The disk-read-threshold, disk-write-threshold, not-on-disk-underperform, on-disk-failure, and on-loss-of-keepalives statements under chassis redundancy failover are not supported on ACX7348, ACX7332, and ACX7059 platforms. Configuration attempts using these statements are rejected. This change is platform-specific and does not affect other Junos platforms where these statements may continue to be supported.PR1885312

Static flowspec prefix validation—Commit validation now rejects static flowspec destination and source prefixes that use a shorter mask than the configured address family permits. The configuration must use a valid prefix length before the commit can succeed. This alignment with static route validation prevents invalid flowspec entries from being installed and ensures consistent routing policy enforcement across IPv4 and IPv6 configurations.PR1903233

Enhanced ping command XML output (Junos OS and Junos OS Evolved )—The XML output for the CE-IP ping has enhanced details to differentiate between successful and failed ping attempts. The update introduces new tags that track the total number of packets sent and received, while also highlighting host unreachable replies and the overall packet loss percentage.

[See Supported and Unsupported Features for CE-IP Ping.]PR1906967

request jnu role delete Command Unhidden (Junos OS and Junos OS Evolved)—The request jnu role delete command, which was previously hidden, is now available for use. This command allows users to delete the role of controllers or satellites directly through the CLI. This enhancement improves administrative control and flexibility in role management within the network infrastructure.

[See request jnu role.]PR1930291

Label field naming update in show route forwarding-table extensive output (Junos OS and Junos OS Evolved)—The CLI output for MPLS forwarding entries now uses "Label" instead of "Load balance label." This name change standardizes the field name and improves overall clarity when reviewing MPLS forwarding information. The change affects only the output text and does not modify label allocation, forwarding behavior, or traffic handling. No configuration changes are required.

Deprecation of shell option—The shell option no longer requires a separate configuration and is now the default behavior. Deprecating the shell option enhances efficiency and simplifies management tasks.

Shell Command Logging Enhancement—All shell commands executed on the device and root sessions are now logged by default. This enhancement ensures enhanced security and auditability by capturing all commands entered in any shell environment, preventing bypassing audit logging. PR1867216

Commit validation for unique user IDs—We have added support to validate the user configuration to ensure that each user is assigned a unique UID. A commit fails if duplicate UIDs are detected, ensuring stronger validation and preventing identity conflicts. Previously, a commit was successful even when multiple users shared the same UID, triggering only a warning and logging a syslog message.PR1890656

SRv6 MSD advertisement compliance—MSD type 43 (SRH Max T.insert) is no longer advertised in IS-IS SRv6 node capability TLVs to match the latest standards draft. This alignment maintains interoperability with peer devices and tools that expect the reduced MSD type list and ensures SRH limits are reported consistently across the network.PR1879051

Auto BGP peer discovery for unnumbered interfaces of iBGP peers—Junos supports single-hop iBGP sessions for unnumbered peering. Previously, the iBGP implementation created an indirect next-hop for route resolution, even if the iBGP peer was directly connected.PR1884861

BGP route-refresh warning messages added—New messages have been introduced to the show bgp diagnostics warnings command output. These messages provide diagnostic information when the number of BGP route-refresh messages exceed predetermined thresholds within specific time intervals of 5 minutes, 30 minutes, and 1 hour.

[See show bgp diagnostics warnings.]PR1909467

BGP UPDATE messages must have the marker field set to all ones—The marker field in BGP header is a 16-octet field included for compatibility that must be set to all ones. All Junos OS and Junos OS Evolved devices send a notification and tear down the BGP session if the marker field in the header of the received update message is not set to all ones.PR1955678

Addition of message-authenticator and no-message-authenticator attributes under access radius-server, access profile radius-server, and system radius-server hierarchies—Set message-authenticator if you require the RADIUS server to include the Message Authenticator attribute in replies to Access-Request messages. Set no-message-authenticator to not require that attribute.PR1871147

Stale ui-state.db data in persistent NETCONF sessions post-mgd restart-Existing NETCONF sessions might fetch stale data from ui-state.db after mgd -N restart. New sessions correctly map the refreshed database. Scripts must establish new sessions post-restart to access updated values. Functional configuration remains unaffected. Script failures monitoring "local-host" NETCONF sessions-Scripts might fail when including "local-host" NETCONF sessions in monitoring operations. Internal sessions are now excluded from tracking. Scripts must filter out "local-host" sessions. No impact to internal application functionality.

Generate genstate YANG modules on Junos devices—You can use show system schema operational command or equivalent RPC to generate the genstate YANG modules in the specified output directory on a device.

[See show system schema.]

Updated Annotate Command Behavior—The annotate command now correctly handles multi-line comments that start with `#`. This change ensures that all lines of a multi-line comment remain comments, preventing unauthorized configuration changes when the configuration is committed, reloaded, or rollbacked. These improvements enhance security by mitigating potential privilege escalation attacks from users with limited configuration editing permissions.PR1868636

Enhanced Permission Checks for Rename/Copy Operations—New permission checks have been introduced for rename and copy operations within the configuration hierarchy. These checks parse the hierarchy being modified to ensure the user has the required permissions for the hierarchy and its sub-hierarchies. If permissions are insufficient, the operation will fail and a "Permission denied" error will be displayed. This enhancement ensures that configuration modifications are performed only by authorised users, improving security and preventing unintended changes to critical system settings.PR1882303