What's Changed

The show dhcp-security vlans detail command now correctly displays the Interface Flag column, which shows the trust status for each interface. Flag values are hexadecimal bitmasks indicating: 0x1 (trusted), 0x2 (untrusted), 0x4 (no option82), 0x8 (no option37), 0x10 (no option18), 0x20 (no option16), 0x40 (no dhcpv6 options), and 0x80 (no option79).

[See show dhcp-security vlans.]

Standards Compliance for Data Type— To comply with the new nomenclature standards for YANG models, the sensor values with data type "Enumeration" that were previously in uppercase letters are now in lowercase letters.

[See Junos YANG Data Model Explorer.]

A new counter Sessions hit due to high rate is added to show services service-sets screen-session-limit-counters command for all subscriber traffic. This counter tracks the sessions that come up on the screen irrespective of the alarm-without-drop configuration. When "alarm-without-drop" option is disabled, all the counters display updated statistics. When alarm-without-drop is enabled, then: - The screen-drop counters on "show services service-sets statistic screen-drop" command do not increase. - The "sessions hit due to high rate" value is displayed.

[See alarm-without-drop (IDS Screen Next Gen Services), show services service-sets statistic screen-drops (Next Gen Services), and show services service-sets statistic screen-session-limit-counters (Next Gen Services).]

SFP Optics LOS alarms (MX Series)—SFP Optics don not support Tx laser disabled alarm, Tx loss of signal functionality alarm, and Rx loss of signal alarm as diagnostics output.

[See show interfaces diagnostics optics.]

When you run the request vmhost zeroize command to zeroize a single Routing Engine on a dual Routing Engine device, the CLI incorrectly displays a message indicating that it will zeroize both Routing Engines.

G.8275.1 profile configuration with PTP, SyncE, and hybrid mode (Junos)—On all Junos platforms, when configuring the G.8275.1 profile, it is mandatory to configure Precision Time Protocol (PTP), Synchronous Ethernet (SyncE), and hybrid mode. Earlier, the system would not raise a commit error even if the required hybrid and SyncE configurations were missing while configuring G.8275.1 profile. However, going forward you will not be able to configure the G.8275.1 profile without configuring PTP, SyncE and hybrid mode to be compliant with the ITU-T standards.

[See G.8275.1 Telecom Profile.]

Validation of /vm-primary mount during JDM installation or upgrade (Junos Node Slicing External Server Deployment)—During installation or upgrade of the Juniper Device Manager (JDM) on external servers running Junos Node Slicing Release 25.2 or later, an issue occurred with the validation of the /vm-primary mount that stores the GNF images. When /vm-primary was mounted using logical volumes (LVM), JDM would fail to detect that the underlying storage was an SSD. This issue is now fixed. However, the fix introduces a new dependency on the LVM2 package in the host OS. This package is included by default in standard installations of both RHEL and Ubuntu external servers. However, it is advised that you check if the LVM2 package is already installed on the host before installing or upgrading JDM.

On the MPC7E-10G line card, when you configure the 10-Gigabit Ethernet ports to operate as 1-Gigabit Ethernet ports, use the speed statement at both the edit interfaces interface name gigether-options and edit interfaces interface name hierarchy levels.

Control Maximum 802.1X Client Connections per Interface—By default, dot1x interfaces configured in multiple supplicant mode have a client limit of 100 authenticated connections per interface. Any additional connection attempts beyond this limit will be automatically blocked.

log-tag functionality: The log-tag functionality is introduced in [set services service-set]

Default route installation for non-default routing instances with iked process (MX480 and MX960)—You can install default route when the st0 interface is in a non-default routing instance. This enhancement supports migration from MS-MPC to SPC3 as MX-SPC3 injects these routes through auto route insertion (ARI) for traffic selector routes. The configuration facilitates route installation in specified routing instances.

[See Traffic Selectors in Route-Based VPNs.]

In on-device packet capture, the self-mirror-start value range now begins at 45 seconds (MX304, MX480, MX960, MX2010, MX2020, MX10003, MX10004)—For on-device packet capture, you set a self-mirror-start value that determines the duration of the packet capture. The value range now starts at 45 seconds; it previously started at 1 second.

[See request forwarding-options port-mirroring instance family self-mirror-start.]

Static flowspec prefix validation—Commit validation now rejects static flowspec destination and source prefixes that use a shorter mask than the configured address family permits. The configuration must use a valid prefix length before the commit can succeed. This alignment with static route validation prevents invalid flowspec entries from being installed and ensures consistent routing policy enforcement across IPv4 and IPv6 configurations.PR1903233

Enhanced ping command XML output (Junos OS and Junos OS Evolved )—The XML output for the CE-IP ping has enhanced details to differentiate between successful and failed ping attempts. The update introduces new tags that track the total number of packets sent and received, while also highlighting host unreachable replies and the overall packet loss percentage.

[See Supported and Unsupported Features for CE-IP Ping.] PR1906967

Pixel-Tracing Command Updates—The pixel-tracing command suite has been updated to include the following options: flush, disable, and enable. These options allow you to control and manage pixel-tracing processes for routing tasks. Note that the rib-sharding option is removed from the CLI commands to prevent system crashes when sharding configuration is present in the system. Ensure that your configurations do not rely on unmentioned options to avoid potential disruptions in your workflow.PR1909594

request jnu role delete Command Unhidden (Junos OS and Junos OS Evolved)—The request jnu role delete command, which was previously hidden, is now available for use. This command allows users to delete the role of controllers or satellites directly through the CLI. This enhancement improves administrative control and flexibility in role management within the network infrastructure.

[See request jnu role.]PR1930291

Run CSDS CLI commands as root user (MX240, MX304, MX480, MX960, MX10004, and MX10008)—Run CSDS CLI operations as the root user to ensure successful execution of maintenance commands for key exchange, authentication, and JDM interactions. Run the following commands as root user: request csds jdm add csds-instance-id csds-instance-id image vsrx-image-with-path request csds authenticate-host csds-instance-id csds-instance-id request csds delete-vsrx csds-instance-id csds-instance-id request csds extract-vsrx-keys csds-instance-id csds-instance-id request csds jdm add csds-instance-id csds-instance-id image vsrx-image-with-path request csds sync-controller other-controller-ip other-controller-ip If a non-root user runs these commands, you'll see the following warning message - warning: Must be logged in as root to execute command. See [request csds add-vsrx, request csds authenticate-host, request csds delete-vsrx, request csds extract-vsrx-keys, request csds jdm, request csds sync-controller]. PR1918503

Label field naming update in show route forwarding-table extensive output (Junos OS and Junos OS Evolved)—The CLI output for MPLS forwarding entries now uses Label instead of Load balance label. This name change standardizes the field name and improves overall clarity when reviewing MPLS forwarding information. The change affects only the output text and does not modify label allocation, forwarding behavior, or traffic handling. No configuration changes are required.PR1899543

Ephemeral database default commit synchronize model changed to synchronous (EX2300, EX2300-MP, EX2300-C, EX2300-VC, EX3400, EX3400-VC, EX4000-8P, EX4000-12MP, EX4000-12P, EX4000-12T, EX4000-24MP, EX4000-48MP, EX4000-24P, EX4000-24T, EX4000-48P, EX4000-48T, EX4100-24MP, EX4100-24P, EX4100-24T, EX4100-48MP, EX4100-48P, EX4100-48T, EX4100-F-12P, EX4100-F-12T, EX4100-F-24P, EX4100-F-24T, EX4100-F-48P, EX4100-F-48T, EX4100-H-12MP, EX4100-H-12MP-DC, EX4100-H-24F, EX4100-H-24F-DC, EX4100-H-24MP, EX4100-H-24MP-DC, EX4300-MP, EX4300VC, EX4400-24MP, EX4400-24P, EX4400-24T, EX4400-24X, EX4400-48F, EX4400-48MP, EX4400-48MXP, EX4400-48P, EX4400-48T, EX4400-48XP, EX4600-VC, EX4650, EX4650-48Y-VC, EX9204, EX9208, EX9214, MX204, MX240, MX304, MX480, MX960, MX2008, MX2010, MX2020, MX10003, MX10004, and MX10008, MX10016)—We've changed the default commit synchronize model for the ephemeral database from the asynchronous model to the synchronous model. With this change, we've deprecated the allow-commit-synchronize-with-gres statement and only the synchronous model supports synchronizing ephemeral data on devices that have graceful Routing Engine switchover (GRES) or nonstop active routing (NSR) enabled.

[See Understanding Ephemeral Database Commit Synchronize Models.]

Deprecation of shell option—The shell option no longer requires a separate configuration and is now the default behavior. Deprecating the shell option enhances efficiency and simplifies management tasks.

Shell Command Logging Enhancement—All shell commands executed on the device and root sessions are now logged by default. This enhancement ensures enhanced security and auditability by capturing all commands entered in any shell environment, preventing bypassing audit logging.PR1867216

Commit validation for unique user IDs—We have added support to validate the user configuration to ensure that each user is assigned a unique UID. A commit fails if duplicate UIDs are detected, ensuring stronger validation and preventing identity conflicts. Previously, a commit was successful even when multiple users shared the same UID, triggering only a warning and logging a syslog message.PR1890656

Behavior change for multihop eBGP sessions (MX960)—When a multihop eBGP session with a directly connected peer goes into IDLE state due to no local interface being present, the system now does a hard reset instead of handling it as a configuration change. This change ensures that the session and associated routes are reset promptly, improving the timeliness and accuracy of routing updates. This adjustment is important for maintaining the stability and efficiency of your network routing, especially in scenarios involving interface deactivation or removal.PR1869927

SRv6 MSD advertisement compliance—MSD type 43 (SRH Max T.insert) is no longer advertised in IS-IS SRv6 node capability TLVs to match the latest standards draft. This alignment maintains interoperability with peer devices and tools that expect the reduced MSD type list and ensures SRH limits are reported consistently across the network.PR1879051

Auto BGP peer discovery for unnumbered interfaces of iBGP peers—Junos supports single-hop iBGP sessions for unnumbered peering. Previously, the iBGP implementation created an indirect next-hop for route resolution, even if the iBGP peer was directly connected.PR1884861

BGP route-refresh warning messages added—New messages have been introduced to the show bgp diagnostics warnings command output. These messages provide diagnostic information when the number of BGP route-refresh messages exceed predetermined thresholds within specific time intervals of 5 minutes, 30 minutes, and 1 hour.

[See show bgp diagnostics warnings.]PR1909467

BGP UPDATE messages must have the marker field set to all ones—The marker field in BGP header is a 16-octet field included for compatibility that must be set to all ones. All Junos OS and Junos OS Evolved devices send a notification and tear down the BGP session if the marker field in the header of the received update message is not set to all ones.PR1955678

Addition of message-authenticator and no-message-authenticator attributes under access radius-server, access profile radius-server, and system radius-server hierarchies—Set message-authenticator if you require the RADIUS server to include the Message Authenticator attribute in replies to Access-Request messages. Set no-message-authenticator to not require that attribute.PR1871147

Updated Annotate Command Behavior—The annotate command now correctly handles multi-line comments that start with `#`. This change ensures that all lines of a multi-line comment remain comments, preventing unauthorized configuration changes when the configuration is committed, reloaded, or rollbacked. These improvements enhance security by mitigating potential privilege escalation attacks from users with limited configuration editing permissions.PR1868636

Enhanced Permission Checks for Rename/Copy Operations—New permission checks have been introduced for rename and copy operations within the configuration hierarchy. These checks parse the hierarchy being modified to ensure the user has the required permissions for the hierarchy and its sub-hierarchies. If permissions are insufficient, the operation will fail and a "Permission denied" error will be displayed. This enhancement ensures that configuration modifications are performed only by authorised users, improving security and preventing unintended changes to critical system settings.PR1882303

Enhanced file archive exclusion capability (PTX10008)—The "file archive" operational command now supports ?exclude? option where you can specify a folder or regular expression to exclude from final archive. (Example, exclude traces from /var/log). This enhancement improves the flexibility and efficiency of the archiving process, allowing you to manage log files more effectively. To exclude folders, you can use one of the below formats: user@router> file archive source /var/log destination /var/tmp/abc exclude jam* exclude wtmp* exclude ksyncd exclude aaasd user@router> file archive exclude [license* shmlog ksyncd] source /var/log/ destination /var/tmp/abcPR1884901

Stale ui-state.db data in persistent NETCONF sessions post-mgd restart—Existing NETCONF sessions might fetch stale data from ui-state.db after mgd -N restart. New sessions correctly map the refreshed database. Scripts must establish new sessions post-restart to access updated values. Functional configuration remains unaffected. [Script failures monitoring "local-host" NETCONF sessions]-Scripts might fail when including "local-host" NETCONF sessions in monitoring operations. Internal sessions are now excluded from tracking. Scripts must filter out "local-host" sessions. No impact to internal application functionality.PR1888557

Generate genstate YANG modules on Junos devices—You can use the show system schema operational command or equivalent RPC to generate the genstate YANG modules in the specified output directory on a device.

[See show system schema.]PR1910388