What's Changed

Limit on number of IP address associations per MAC address per bridge domain in EVPN MAC-IP database—By default, devices can associate a maximum of 200 IP addresses with a single MAC address per bridge domain. We provide a new CLI statement to customize this limit, mac-ip-limit statement at the [edit protocols evpn] hierarchy level. In most use cases, you don?t need to change the default limit. If you want to change the default limit, we recommend that you don?t set this limit to more than 300 IP addresses per MAC address per bridge domain. Otherwise, you might see very high CPU usage on the device, which can degrade system performance.

[See mac-ip-limit.]PR1848779

Change in options and generated configuration for the EZ-LAG configuration IRB subnet-address statement—With the EZ-LAG subnet-address inet or subnet-address inet6 options at the edit services evpn evpn-vxlan irb irb-instance hierarchy, you can now specify multiple IRB subnet addresses in a single statement using the list syntax addr1 addr2 ... . Also, in the generated configuration for IRB interfaces, the commit script now includes default router-advertisement statements at the edit protocols hierarchy level for that IRB interface.

[See subnet-address (Easy EVPN LAG Configuration).]

ChaCha20-Poly1305 algorithm deprecation for SSH cipher option (Junos)-The ChaCha20-Poly1305 authenticated encryption algorithm is deprecated for SSH cipher option. Configure aes-128-gcm and aes-256-gcm as the encryption algorithm for SSH Cipher option. [See ssh (System Services).] https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/ssh-edit-system.htmlPR1783811

Media Access Control Security (MACsec) session remains stable when changing exclude-protocol configuration—When you change the protocols excluded from MACsec using the exclude-protocol protocol-name option at the [edit security macsec connectivity-association connectivity-association-name], the MACsec session remains stable. [See exclude-protocol{https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/exclude-protocol-edit-security-macsec.html}.]PR1779286

Starting from Junos 21.4R1 platforms with the following Routing Engines which have Intel CPUs with microcode version 0x35 observe the error warning, "000: [Firmware Bug]: TSC_DEADLINE disabled due to Errata; please update microcode to version: 0x3a (or later)" on the console. RE-S-X6-64G RE-S-X6-128G REMX2K-X8-64G RE-PTX-X8-64G RE-MX2008-X8-64G RE-MX2008-X8-128GPR1783225

For MPC5E line card with flexible-queuing-mode enabled, queue resources are shared between scheduler block 0 and 1. Resource monitor CLI output displays an equal distribution of the total available and used queues between scheduler blocks. This correctly represents the queue availability to the routing engine. See https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/show-system-resource-monitor.html and https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/show-system-resource-monitor-ifd-cos-queue-mapping-fpc.html.PR1801694

The topics in CVBC-Documented-In field have been updated to mention rangePR1810284

BGP Neighbor Telemetry Statistics (Junos OS and Junos OS Evolved)—BGP neighbor statistics reported through telemetry are now always aggregated, regardless of whether rib-sharding is enabled. Previously, when sharding was active, statistics were streamed per shard. With the current behavior, sensors are installed appropriately, and statistics are aggregated in the main thread before being streamed. The controllers and collectors now receive a single, unified view of BGP neighbor statistics.PR1765189

Micro-SID Locator Configuration Validation—We have introduced a validation rule to prevent the configuration of micro-SID locators where the Node Code is 0x00. You might encounter a commit error if you attempt to configure a micro-SID locator that results in a Node Code of 0x00. This change ensures that the SID 0x0000, reserved for End of Container (EOC), is not utilized in configurations, preventing potential routing issues.PR1782293

Detection of legacy PD (PoE)—The detection of legacy PD (powered device) is disabled by default in EX4400-24MP, EX4400-48MP, EX4400-48MXP, EX4400-48XP, EX4400-24P, and EX4400-48P models. To enable a legacy PD in a port for these models, see Enabling Legacy Powered Device

Configuration History Persistence—This update ensures that the configuration history, including commits and rollback data, is preserved when restarting Docker with a new container ID. By persisting the /config directory in a Docker/Podman volume, the show system commits data is now retained. This enhancement ensures full traceability of configuration changes and assists users in debugging and monitoring their configurations more efficiently.PR1787729

Increase in revert-delay timer range— The revert-delay timer range is increased to 600 seconds from 20 seconds.

[See min-rate.]