What's Changed

The show dhcp-security vlans detail command now correctly displays the Interface Flag column, which shows the trust status for each interface. Flag values are hexadecimal bitmasks indicating: 0x1 (trusted), 0x2 (untrusted), 0x4 (no option82), 0x8 (no option37), 0x10 (no option18), 0x20 (no option16), 0x40 (no dhcpv6 options), and 0x80 (no option79).

[See show dhcp-security vlans.]

EVPN-VXLAN T5 host-route auto-generated community (EX4100-24T, EX4300-MP, EX4400-24MP, EX4400-24P, EX4400-48F, EX4400-48MP, EX4650, MX960, QFX5120-32C, QFX5120-48T, QFX5120-48Y, and QFX5120-48YM)—We added from interface as an optional qualifier for a policy adding a Type 5 host-route auto-generated community to locally learned host routes.

[See EVPN-VXLAN Pure Type 5 Host-Route Auto-Generated Community.]PR1889160

Changes to show system alarms command output (QFX5130 and QFX5220)—When the current version of the firmware is less than the minimum supported version, you can now see alarms for this mismatch in the output of the command. These alarms were not shown previously. For example, when you have a firmware version mismatch, you should now see output similar to the following:

PR1836811

A new counter "Sessions hit due to high rate" is added to show services service-sets screen-session-limit-counters command for all subscriber traffic. This counter tracks the sessions that come up on the screen irrespective of the alarm-without-drop configuration. When alarm-without-drop option is disabled, all the counters display updated statistics. When alarm-without-drop is enabled, then, the screen-drop counters on show services service-sets statistic screen-drop command do not increase. The sessions hit due to high rate value is displayed.

[See alarm-without-drop (IDS Screen Next Gen Services), show services service-sets statistic screen-drops (Next Gen Services), and show services service-sets statistic screen-session-limit-counters (Next Gen Services).]PR1849594

When you run the request vmhost zeroize command to zeroize a single Routing Engine on a dual Routing Engine device, the CLI incorrectly displays a message indicating that it will zeroize both Routing Engines.PR1869854

Validation of /vm-primary mount during JDM installation or upgrade (Junos Node Slicing External Server Deployment)—During installation or upgrade of the Juniper Device Manager (JDM) on external servers running Junos Node Slicing Release 25.2 or later, an issue occurred with the validation of the /vm-primary mount that stores the GNF images. When /vm-primary was mounted using logical volumes (LVM), JDM would fail to detect that the underlying storage was an SSD. This issue is now fixed. However, the fix introduces a new dependency on the LVM2 package in the host OS. This package is included by default in standard installations of both RHEL and Ubuntu external servers. However, it is advised that you check if the LVM2 package is already installed on the host before installing or upgrading JDM.PR1877593

On the MPC7E-10G line card, when you configure the 10-Gigabit Ethernet ports to operate as 1-Gigabit Ethernet ports, use the speed statement at both the edit interfaces interface name gigether-options and edit interfaces interface name hierarchy levels.PR1879198

Control Maximum 802.1X Client Connections per Interface—By default, dot1x interfaces configured in multiple supplicant mode have a client limit of 100 authenticated connections per interface. Any additional connection attempts beyond this limit will be automatically blocked.PR1882148

New option for debug collector data storage path --We've included the option outdir to specify an output directory for storing debug collector data in a customised path. This allows you to organise and access diagnostic information more efficiently, adapting storage to your specific requirements.

[See request system debug-info.] PR1889710

High-power optics support with CLI configuration option (QFX5240 and QFX5241) —You can enable high-power optics across all ports by configuring the high-power-mode option for each port. This feature supports up to 32 high-power modules, allowing you to benefit from enhanced connection capabilities. Ensure you configure the necessary settings to initialize and utilize high-power optics effectively, optimizing your network's performance. PR1891150

Static flowspec prefix validation—Commit validation now rejects static flowspec destination and source prefixes that use a shorter mask than the configured address family permits. The configuration must use a valid prefix length before the commit can succeed. This alignment with static route validation prevents invalid flowspec entries from being installed and ensures consistent routing policy enforcement across IPv4 and IPv6 configurations.PR1903233

Enhanced telemetry aggregation logic alignment with SNMP counter calculations (QFX Series)—The Junos OS telemetry is updated to include missing internal counters used in SNMP (e.g., bucket drop, idiscards, il3_incomplete, etc.). The change to the OpenConfig sensors ensures parity across both monitoring mechanisms.

[See YANG Data Model Explorer.]PR1903308

The run test chassis fru command now displays data for only the FRU (field replaceable units) that are supported on the QFX series and EX series devices and platforms.PR1905481

Enhanced ping command XML output (Junos OS and Junos OS Evolved )—The XML output for the CE-IP ping has enhanced details to differentiate between successful and failed ping attempts. The update introduces new tags that track the total number of packets sent and received, while also highlighting host unreachable replies and the overall packet loss percentage.

[See Supported and Unsupported Features for CE-IP Ping.] PR1906967

Sflow sampling with firewall filters (QFX5120, QFX5200, and QFX5210)—This feature enables sFlow sampling through firewall filter actions. You can selectively sample traffic matching specific filter terms using the then sampling action, providing granular visibility while reducing sampling overhead. You can configure sampling as set firewall family inet filter filer-nameterm term-namethen sampling and combine with standard sFlow configuration under set protocols sflow hierarchy, such as (sample-rate, collectors, interfaces) for configuring sFlow.

Note that when you configure the samplingaction in a term, you cannot configure the discardand rejectaction in the same term.

[See sFlow Support on Switches.]PR1910068

[See disable-fpc (DDoS).]PR1910643

Support added for new payload match conditions (EX4100 , EX4400 , EX5200, and QFX5120)-Support added for payload-source-ipv4-address, payload-destination-ipv4-address, payload-source-ipv6-address, payload-destination-ipv6-address, payload-source-mac-address, and payload-destination-mac-address match conditions for IPv4 and IPv6 traffic which can be applied on the ingress port only.

[See Firewall Filter Match Conditions for IPv4 Traffic.]PR1914083

request jnu role delete Command Unhidden (Junos OS and Junos OS Evolved)—The request jnu role delete command, which was previously hidden, is now available for use. This command allows users to delete the role of controllers or satellites directly through the CLI. This enhancement improves administrative control and flexibility in role management within the network infrastructure.

[See request jnu role.]PR1930291

Improve heap memory utilization in link aggregation group (LAG) interfaces in large-scale configurations—If you T5 host-route auto-generated communityhave a configuration with many interfaces in a large number of VLANs, and you've configured those interfaces as part of a logical aggregated Ethernet interface bundle, the device can approach 100% of its heap memory utilization. To avoid this problem in such large-scale environments, you can set the lag-heap-optimization option to reduce heap memory utilization on the device. When you configure this statement, the Packet Forward Engine on the device restarts.

[See lag-heap-optimization.]

Label field naming update in show route forwarding-table extensive output (Junos OS and Junos OS Evolved)—The CLI output for MPLS forwarding entries now uses "Label" instead of "Load balance label." This name change standardizes the field name and improves overall clarity when reviewing MPLS forwarding information. The change affects only the output text and does not modify label allocation, forwarding behavior, or traffic handling. No configuration changes are required.PR1899543

Shell Command Logging Enhancement—All shell commands executed on the device and root sessions are now logged by default. This enhancement ensures enhanced security and auditability by capturing all commands entered in any shell environment, preventing bypassing audit logging.PR1867216

Deprecation of shell option—The shell option no longer requires a separate configuration and is now the default behavior. Deprecating the shell option enhances efficiency and simplifies management tasks.

SRv6 MSD advertisement compliance—MSD type 43 (SRH Max T.insert) is no longer advertised in IS-IS SRv6 node capability TLVs to match the latest standards draft. This alignment maintains interoperability with peer devices and tools that expect the reduced MSD type list and ensures SRH limits are reported consistently across the network.PR1879051

Auto BGP peer discovery for unnumbered interfaces of iBGP peers—Junos supports single-hop iBGP sessions for unnumbered peering. Previously, the iBGP implementation created an indirect next-hop for route resolution, even if the iBGP peer was directly connected.PR1884861

BGP route-refresh warning messages added—New messages have been introduced to the show bgp diagnostics warnings command output. These messages provide diagnostic information when the number of BGP route-refresh messages exceed predetermined thresholds within specific time intervals of 5 minutes, 30 minutes, and 1 hour.

[See show bgp diagnostics warnings.]PR1909467

BGP UPDATE messages must have the marker field set to all ones—The marker field in BGP header is a 16-octet field included for compatibility that must be set to all ones. All Junos OS and Junos OS Evolved devices send a notification and tear down the BGP session if the marker field in the header of the received update message is not set to all ones.PR1955678

Addition of message-authenticator and no-message-authenticator attributes under [edit access radius-server], [edit access profile radius-server], and [edit system radius-server] hierarchies—set message-authenticator if you require the RADIUS server to include the Message Authenticator attribute in replies to Access-Request messages. set no-message-authenticator to not require that attribute.PR1871147

Updated Annotate Command Behavior—The annotate command now correctly handles multi-line comments that start with `#`. This change ensures that all lines of a multi-line comment remain comments, preventing unauthorized configuration changes when the configuration is committed, reloaded, or rollbacked. These improvements enhance security by mitigating potential privilege escalation attacks from users with limited configuration editing permissions.PR1868636

Enhanced Permission Checks for Rename/Copy Operations—New permission checks have been introduced for rename and copy operations within the configuration hierarchy. These checks parse the hierarchy being modified to ensure the user has the required permissions for the hierarchy and its sub-hierarchies. If permissions are insufficient, the operation will fail and a "Permission denied" error will be displayed. This enhancement ensures that configuration modifications are performed only by authorised users, improving security and preventing unintended changes to critical system settings.PR1882303

Stale ui-state.db data in persistent NETCONF sessions post-mgd restart—Existing NETCONF sessions might fetch stale data from ui-state.db after mgd -N restart. New sessions correctly map the refreshed database. Scripts must establish new sessions post-restart to access updated values. Functional configuration remains unaffected. [Script failures monitoring "local-host" NETCONF sessions]-Scripts might fail when including "local-host" NETCONF sessions in monitoring operations. Internal sessions are now excluded from tracking. Scripts must filter out "local-host" sessions. No impact to internal application functionality.PR1888557

Generate genstate YANG modules on Junos devices—You can use the show system schema operational command or equivalent RPC to generate the genstate YANG modules in the specified output directory on a device.

[See show system schema.]PR1910388