What's Changed

The show dhcp-security vlans detail command now correctly displays the Interface Flag column, which shows the trust status for each interface. Flag values are hexadecimal bitmasks indicating: 0x1 (trusted), 0x2 (untrusted), 0x4 (no option82), 0x8 (no option37), 0x10 (no option18), 0x20 (no option16), 0x40 (no dhcpv6 options), and 0x80 (no option79).

[See show dhcp-security vlans.]

A new counter "Sessions hit due to high rate" is added to show services service-sets screen-session-limit-counters command for all subscriber traffic. This counter tracks the sessions that come up on the screen irrespective of the alarm-without-drop configuration. When alarm-without-drop option is disabled, all the counters display updated statistics. When alarm-without-drop is enabled, then, the screen-drop counters on show services service-sets statistic screen-drop command do not increase. The "sessions hit due to high rate" value is displayed.

[See alarm-without-drop (IDS Screen Next Gen Services), show services service-sets statistic screen-drops (Next Gen Services), and show services service-sets statistic screen-session-limit-counters (Next Gen Services).]PR1849594

When you run the request vmhost zeroize command to zeroize a single Routing Engine on a dual Routing Engine device, the CLI incorrectly displays a message indicating that it will zeroize both Routing Engines.PR1869854

Validation of filepath/vm-primary(filepath) mount during JDM installation or upgrade (Junos Node Slicing External Server Deployment)—During installation or upgrade of the Juniper Device Manager (JDM) on external servers running Junos Node Slicing Release 25.2 or later, an issue occurred with the validation of the filepath/vm-primaryfilepath mount that stores the GNF images. When filepath/vm-primaryfilepath was mounted using logical volumes (LVM), JDM would fail to detect that the underlying storage was an SSD. This issue is now fixed. However, the fix introduces a new dependency on the LVM2 package in the host OS. This package is included by default in standard installations of both RHEL and Ubuntu external servers. However, it is advised that you check if the LVM2 package is already installed on the host before installing or upgrading JDM.PR1877593

On the MPC7E-10G line card, when you configure the 10-Gigabit Ethernet ports to operate as 1-Gigabit Ethernet ports, use the speed statement at both the [edit interfaces interface name gigether-options] and edit interfaces interface name hierarchy levels. PR1879198

Control Maximum 802.1X Client Connections per Interface—By default, dot1x interfaces configured in multiple supplicant mode have a client limit of 100 authenticated connections per interface. Any additional connection attempts beyond this limit will be automatically blocked.

New option for debug collector data storage path We've included the option outdir to specify an output directory for storing debug collector data in a customised path. This allows you to organise and access diagnostic information more efficiently, adapting storage to your specific requirements.

PR1889710

Correct auto-negotiation status display for 1G full-duplex links (EX2300-48MP, EX3400-48T, EX4100-48MP, EX4100-48P, and EX4400-48P)—You should be aware that when operating at a speed of 1G with full-duplex mode and no auto-negotiation, the system internally advertises auto-negotiation capabilities despite displaying incorrect status as "disabled" and "No-auto-negotiation" in interface commands. You need to remove the 1G option for copper ports while configuring speed to avoid this discrepancy.

Topic updated with limitations on hop-limit match condition for EX4100 and EX4400. PR1890156

Static flowspec prefix validation—Commit validation now rejects static flowspec destination and source prefixes that use a shorter mask than the configured address family permits. The configuration must use a valid prefix length before the commit can succeed. This alignment with static route validation prevents invalid flowspec entries from being installed and ensures consistent routing policy enforcement across IPv4 and IPv6 configurations.PR1903233

Enhanced ping command XML output (Junos OS and Junos OS Evolved )—The XML output for the CE-IP ping has enhanced details to differentiate between successful and failed ping attempts. The update introduces new tags that track the total number of packets sent and received, while also highlighting host unreachable replies and the overall packet loss percentage [See Supported and Unsupported Features for CE-IP Ping.]PR1906967

Support added for new payload match conditions (EX4100 , EX4400 , EX5200, and QFX5120)-Support added for payload-source-ipv4-address, payload-destination-ipv4-address, payload-source-ipv6-address, payload-destination-ipv6-address, payload-source-mac-address, and payload-destination-mac-address match conditions for IPv4 and IPv6 traffic which can be applied on the ingress port only.

[See Firewall Filter Match Conditions for IPv4 Traffic.]PR1914083

Topic updated with Platform Specific Behavior section - Firewall Filter Flexible Match Conditions. PR1917415

request jnu role delete Command Unhidden (Junos OS and Junos OS Evolved)—The request jnu role delete command, which was previously hidden, is now available for use. This command allows users to delete the role of controllers or satellites directly through the CLI. This enhancement improves administrative control and flexibility in role management within the network infrastructure.

PR1930291

Mixed 1G and 10G speed support on 4x25G ULM module (EX4400)—Support has been added for operating 1G and 10G interface speeds concurrently on the 4x25G ULM module when it is configured in 1G/10G mode. When you configure the quad using set chassis fpc 0 pic 2 port 0 speed 10g or set chassis fpc 0 pic 2 port 0 speed 1g, the system detects and brings up both 1G and 10G transceivers in that quad, creates interfaces for 1G and 10G transceivers, and skips creating interfaces for any 25G transceivers present in the quad. This enhancement simplifies interface management and increases flexibility by allowing you to mix 1G and 10G optics within the same 4x25G ULM quad under a single speed configuration.

[See Port Speed on EX4400 Switches.]PR1969800

Label field naming update in show route forwarding-table extensive output (Junos OS and Junos OS Evolved)—The CLI output for MPLS forwarding entries now uses "Label" instead of "Load balance label." This name change standardizes the field name and improves overall clarity when reviewing MPLS forwarding information. The change affects only the output text and does not modify label allocation, forwarding behavior, or traffic handling. No configuration changes are required. PR1899543

Ephemeral database default commit synchronize model changed to synchronous (EX2300, EX2300-MP, EX2300-C, EX2300-VC, EX3400, EX3400-VC, EX4000-8P, EX4000-12MP, EX4000-12P, EX4000-12T, EX4000-24MP, EX4000-48MP, EX4000-24P, EX4000-24T, EX4000-48P, EX4000-48T, EX4100-24MP, EX4100-24P, EX4100-24T, EX4100-48MP, EX4100-48P, EX4100-48T, EX4100-F-12P, EX4100-F-12T, EX4100-F-24P, EX4100-F-24T, EX4100-F-48P, EX4100-F-48T, EX4100-H-12MP, EX4100-H-12MP-DC, EX4100-H-24F, EX4100-H-24F-DC, EX4100-H-24MP, EX4100-H-24MP-DC, EX4300-MP, EX4300VC, EX4400-24MP, EX4400-24P, EX4400-24T, EX4400-24X, EX4400-48F, EX4400-48MP, EX4400-48MXP, EX4400-48P, EX4400-48T, EX4400-48XP, EX4600-VC, EX4650, EX4650-48Y-VC, EX9204, EX9208, EX9214, MX204, MX240, MX304, MX480, MX960, MX2008, MX2010, MX2020, MX10003, MX10004, and MX10008, MX10016)—We've changed the default commit synchronize model for the ephemeral database from the asynchronous model to the synchronous model. With this change, we've deprecated the allow-commit-synchronize-with-gres statement and only the synchronous model supports synchronizing ephemeral data on devices that have graceful Routing Engine switchover (GRES) or nonstop active routing (NSR) enabled.

[See Understanding Ephemeral Database Commit Synchronize Models.]

Shell Command Logging Enhancement--All shell commands executed on the device and root sessions are now logged by default. This enhancement ensures enhanced security and auditability by capturing all commands entered in any shell environment, preventing bypassing audit logging.PR1867216

Deprecation of shell option—The shell option no longer requires a separate configuration and is now the default behavior. Deprecating the shell option enhances efficiency and simplifies management tasks.

Commit validation for unique user IDs--We have added support to validate the user configuration to ensure that each user is assigned a unique UID. A commit fails if duplicate UIDs are detected, ensuring stronger validation and preventing identity conflicts. Previously, a commit was successful even when multiple users shared the same UID, triggering only a warning and logging a syslog message.PR1890656

SRv6 MSD advertisement compliance—MSD type 43 (SRH Max T.insert) is no longer advertised in IS-IS SRv6 node capability TLVs to match the latest standards draft. This alignment maintains interoperability with peer devices and tools that expect the reduced MSD type list and ensures SRH limits are reported consistently across the network.PR1879051

Auto BGP peer discovery for unnumbered interfaces of iBGP peers—Junos supports single-hop iBGP sessions for unnumbered peering. Previously, the iBGP implementation created an indirect next-hop for route resolution, even if the iBGP peer was directly connected.PR1884861

BGP route-refresh warning messages added—New messages have been introduced to the show bgp diagnostics warnings command output. These messages provide diagnostic information when the number of BGP route-refresh messages exceed predetermined thresholds within specific time intervals of 5 minutes, 30 minutes, and 1 hour.

[See show bgp diagnostics warnings.]PR1909467

BGP UPDATE messages must have the marker field set to all ones—The marker field in BGP header is a 16-octet field included for compatibility that must be set to all ones. All Junos OS and Junos OS Evolved devices send a notification and tear down the BGP session if the marker field in the header of the received update message is not set to all ones.PR1955678

Addition of message-authenticator and no-message-authenticator attributes under access radius-server, access profile radius-server, and system radius-server hierarchies—set message-authenticator if you require the RADIUS server to include the message authenticator attribute in replies to Access-Request messages. set no-message-authenticator to not require that attribute.PR1871147

Updated Annotate Command Behavior—The annotate command now correctly handles multi-line comments that start with `#`. This change ensures that all lines of a multi-line comment remain comments, preventing unauthorized configuration changes when the configuration is committed, reloaded, or rollbacked. These improvements enhance security by mitigating potential privilege escalation attacks from users with limited configuration editing permissions.PR1868636

Enhanced Permission Checks for Rename/Copy Operations—New permission checks have been introduced for rename and copy operations within the configuration hierarchy. These checks parse the hierarchy being modified to ensure the user has the required permissions for the hierarchy and its sub-hierarchies. If permissions are insufficient, the operation will fail and a "Permission denied" error will be displayed. This enhancement ensures that configuration modifications are performed only by authorised users, improving security and preventing unintended changes to critical system settings.PR1882303

Enhanced file archive exclusion capability (PTX10008)—The file archive operational command now supports exclude option where you can specify a folder or regular expression to exclude from final archive. (Example, exclude traces from /var/log). This enhancement improves the flexibility and efficiency of the archiving process, allowing you to manage log files more effectively. To exclude folders, you can use one of the below formats:

PR1884901

Stale ui-state.db data in persistent NETCONF sessions post-mgd restart—Existing NETCONF sessions might fetch stale data from ui-state.db after mgd -N restart. New sessions correctly map the refreshed database. Scripts must establish new sessions post-restart to access updated values. Functional configuration remains unaffected. [Script failures monitoring "local-host" NETCONF sessions]-Scripts might fail when including "local-host" NETCONF sessions in monitoring operations. Internal sessions are now excluded from tracking. Scripts must filter out "local-host" sessions. No impact to internal application functionality.PR1888557

Generate genstate YANG modules on Junos devices—You can use the show system schema operational command or equivalent RPC to generate the genstate YANG modules in the specified output directory on a device.

[See show system schema.]PR1910388