Cisco IOS XR Setup and Upgrade

Immutable bootstrap configurations

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

This feature ensures that the boot configuration of the router remains static and tamper-proof. Immutable bootstrap maintains the integrity and security of the router from the initial boot stage and throughout its entire operation, preventing unauthorized misconfigurations that could disrupt the router's functionality. As a result, it enhances the overall security and reliability of network devices, ensuring they always boot into a known good state.

In earlier releases, the boot configuration of the router was not immutable

Programmability

Data logging with gNSI AcctzStream service

Introduced in this release on: Fixed Systems(8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100]).

This feature replaces the existing bi-directional data streaming service, Acctz, with the new server-streaming service, AcctzStream and ensures effective network optimization and resource utilization.

With this feature, you can configure the maximum memory allocated for cached accounting history records using the grpc aaa accounting history-memomy command.

The feature introduces these changes:

CLI:

• grpc aaa accounting history-memory

For the specification on the gNSI Accounting (AcctzStream) RPCs and messages, see the Github repository.

gNOI Healthz

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

With gNOI Healthz, you can monitor and troubleshoot device health by collecting logs and conducting root-cause analysis (RCA) on detected issues. This proactive approach allows for the early identification and resolution of system health problems, thereby reducing downtime and enhancing reliability.

For the specification on gNOI.healthz, see the GitHub repository.

gRPC server TLS version 1.3 support

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now enhance your network security by enabling TLS 1.3 support for gRPC services. This update provides stronger protection against vulnerabilities, improves performance with faster connection times and reduced latency, and removes outdated ciphers. Additionally, it complies with internal security mandates, offering a more robust and future-proof solution for your network management needs.

Previously, gRPC server supported TLS version 1.2.

The feature introduces these changes:

CLI:

• tls-min-version

• tls-max-version

Tracking and Synchronization of PBR PolicyMap Statistics Using Unique IDs and InsightDB

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now accurately track, store, and synchronize per-rule statistics for PBR policy maps using unique IDs. These unique IDs are registered with InsightDB through a mapping mechanism, which includes a global key (a combination of policy map and Rule in string format) and a local key (an allocated unique number of uint64 type).

To know more about creating a Service Layer API for Interfaces, see Cisco IOS-XR Service Layer Interfaces.

This feature modifies Cisco-IOS-XR-pbr-fwd-stats-oper (see GitHub, YANG Data Models Navigator) data model.

Validation of Route Installation Using Service Layer API

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now validate route installation through hardware acknowledgements.

This feature supports Label Switched Path (LSP) selection based on IP Class-Based Forwarding (CBF) for optimized traffic engineering. It also dynamically updates routing information using next-hop and Next Hop Group (NHG) tracking based on network events and supports forward references between objects for flexible programming.

Previously, route installation confirmation, traffic engineering optimization, dynamic routing updates, and flexible programming required more manual configuration and monitoring.

To know more about creating a Service Layer API for Interfaces, see Cisco IOS-XR Service Layer Interfaces.

This feature introduces these changes:

CLI:

• show service-layer path-groups

• show service-layer policy

• show service-layer mpls label

Nexthop Resolution

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

Nexthop resolution minimizes traffic loss and improves network performance by ensuring BGP paths are valid and optimal.

Support Active IP Route Callback and Safe to Receive IP/MPLS Traffic Callback

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

This feature aims to enhance network reliability and traffic integrity by ensuring that routes and MPLS tunnels are ready to receive traffic before they are advertised or used. It consists of two components:

1. Safe to Receive IP Traffic Callback: This component utilizes a gRPC callback API to confirm that routes installed by the BGP implementation (bgp++) are ready to receive traffic before being advertised to neighbors.

2. Safe to Receive MPLS Traffic Callback: This component utilizes a callback to ensure that MPLS tunnels are ready to accept traffic, thereby confirming that intermediate routers can safely forward traffic.

To know more about creating a Service Layer API for Interfaces, see Cisco IOS-XR Service Layer Interfaces.

Interface Status of Service Layer API

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now receive low latency notifications for interface state and bandwidth changes via SL- API within 100ms. This feature ensures that when a physical or bundle interface changes its state or bandwidth, notifications are delivered promptly to the customer’s SDN agent. The system uses gRPC-based streaming APIs, allowing clients to subscribe to all or specific interfaces. This ensures timely and reliable delivery of interface events to the customer's SDN agent. To know more about creating a Service Layer API for Interfaces, see Cisco IOS-XR Service Layer Interfaces.

Routing

Enhanced BGP BFD Strict-Mode Capabilities for Improved Interoperability

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100]); Modular Systems (8800 [LC ASIC: P100])

You now have the capability of upgrading your network with Cisco "BGP BFD strict-mode negotiate" and "override" modes, which enhance stability and device cooperation between Cisco IOS XR and Cisco XE systems. These modes ensure BGP sessions initiate only if BFD sessions are active, with the override option enforcing this even if a peer device lacks strict-mode support. This feature resolves interoperability issues, secures route propagation, and adheres to IETF standards, leading to a more reliable network.

This feature introduces these changes:

CLI:

• The bfd-state keyword is introduced in the show bgp sessions command.

• The BFDmode and BFDState fields were added to the show bgp neighbors command output.

YANG Data Models:

• New XPaths for Cisco-IOS-XR-um-router-bgp-cfg.yang

(See GitHub, YANG Data Models Navigator)

IS-IS Protocol Shutdown Mode

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200])

You can now gracefully shut down IS-IS on an interface or router without abruptly interrupting network operations. This feature simplifies operations by consolidating multiple steps into a single command, ensuring network stability during maintenance or configuration changes.

This feature introduces these changes:

CLI:

• protocol shutdown

YANG Data Model:

• Cisco-IOS-XR-um-router-isis-cfg

  (see GitHub, YANG Data Models Navigator)

Segment Routing

Delay and synthetic loss measurement for GRE tunnel interfaces

Introduced in this release on: Fixed Systems (8200); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now measure the latency or delay experienced by data packets when they traverse a network, and also proactively monitor and address potential network issues before they impact users by measuring key parameters such as packet loss, and jitter for GRE tunnel interfaces.

This feature enables you to report synthetic Two-Way Active Measurement Protocol (TWAMP) test packets that are deployed in delay-profile or delay measurement sessions, and enables delay measurement for GRE tunnel interfaces.

The feature introduces these changes:

CLI:

The performance-measurement interface command is modified with a new tunnel-ip keyword.

Fallback delay advertisement for interfaces

Introduced in this release on: Fixed Systems (8200); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now advertise fallback delay value, retaining delay information in performance metrics even when delay metrics for interfaces are temporarily unavailable due to hardware, synchronization, or network connectivity issues. The feature ensures optimal routing decisions, by maintaining network stability and continuous performance, even when real-time metrics are temporarily inaccessible.

Previously, the performance metrics did not include delay metrics when they were temporarily inaccessible, resulting in visibility gaps in the network and less effective routing.

The feature introduces these changes:

CLI:

The performance-measurement interface command is modified with a new advertise-delay fallback keyword.

YANG Data Models:

• Cisco-IOS-XR-um-performance-measurement-cfg.yang

See (GitHub, Yang Data Models Navigator)

Far-end delay metrics in one-way measurement mode

Introduced in this release on: Fixed Systems (8200); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

SR PM now enables network operators to compute both far-end (T4 – T3) and near-end (T2 – T1) delay metrics, providing a complete view of end-to-end delay across the entire data path. Measuring the far-end delay from the responder to the querier node improves visibility, and allows operators to accurately monitor and evaluate network performance.

Previously, you could measure the near-end delay metrics for a given data path.

Flexible algorithm with bandwidth optimization

Introduced in this release on: Fixed Systems(8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

The enhanced IGP flexible algorithm path computation optimizes paths by automatically adjusting to changes in link bandwidth, which is particularly advantageous for handling parallel L3 links and dynamic changes in link bandwidth, such as in L2 link bundles. This ensures optimal capacity paths by considering cumulative bandwidth in parallel links, preferring paths with the best available bandwidth and benefiting high-bandwidth traffic flows. In addition to traditional metrics like link delay or monetary cost, the algorithm also optimizes paths based on the maximum available bandwidth of links. The bandwidth metric can be locally configured or computed from advertised link bandwidth.

The feature introduces these changes:

CLI:

• bandwidth-metric flex-algo

• metric-type bandwidth

• reference-bandwidth

• group-mode

YANG Data Models:

• New Xpaths are introduced for Cisco-IOS-XR-um-router-isis-cfg.yang

  (see GitHub, YANG Data Models Navigator)

SR Policy Liveness Monitoring - Hardware Offloading

Introduced in this release on: Fixed Systems (8700) (select variants only*); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200])

You can now hardware offload the liveness monitoring in performance measurement to the router hardware, which is the Network Processing Unit (NPU). This feature helps you optimize and scale the measurement operation, helping you meet delay-bound Service Level Agreements (SLAs). Previously, this feature was software driven.

The feature introduces a new keyword npu-offload under the performance-measurement liveness-profile name liveness profile command.

• 8712-MOD-M

• 88-LC0-34H14FH

• 88-LC0-36FH

• 88-LC0-36FH-M

• 8201-32FH

• 8202-32FH-M

• 8203-88H16FH-M

• 8608-RP

SR-TE policy with enhanced flexible algorithm metric types

Introduced in this release on: Fixed Systems(8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

We have enhanced the SR-TE policy at headend with flexible algorithm that supports additional metric types, user-defined and bandwidth, ensuring consistent path computation across flexible algorithm metric types and constraints, on both intra-IGP and inter-IGP domains. The feature also supports headend computed inter-domain SR policies with Flex Algo constraints and IGP redistribution or leaking.

The feature introduces these changes:

CLI:

• The flex-algo-metric-type keyword is introduced in the effective-metric admin-distance command.

YANG Data Models:

• New Xpaths are introduced for Cisco-IOS-XR-infra-statsd-oper.yang

  (see GitHub, YANG Data Models Navigator)

SRv6 double recursion for multilayer BGP underlay

Introduced in this release on: Fixed Systems (8200); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

The feature introduces support to SRv6 double recursion where network service such as BGP VPN (Layer 2/Layer 3) requires multiple layers of resolution, specifically where one routing layer resolves over another before reaching its final destination. You can achieve double recursion by collapsing the underlay, which typically involves protocols like IGP or BGP in the packet forwarding chain, allowing three-level load balancing and even distribution of traffic across multiple layers of the network stack.

The feature is supported on the ingress Provider Edge (PE) router.

Previously, SRv6 supported only two levels of load balancing, which works for traditional service provider setups.

The feature introduces these changes:

CLI:

• tag-map tag <value> map forwarding-hierarchy level-2-used-as-nexthop

• The show cef ipv6 ipv6-prefixes and show cef ipv4 ipv4-prefixes commands are enhanced to include the Layer 2 prefix information, which resolve as nexthop Layer 3 prefixes.

YANG Data Models:

• Cisco-IOS-XR-um-router-rib-cfg:router (see GitHub, Yang Data Models Navigator) data model.

Segment routing Tree-SID interoperability and SR-P2MP enhancements

Introduced in this release on: Fixed Systems (8200); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

The feature introduces enhancements to the SR Tree-SID functionality and SR-P2MP Policy, enabling full alignment with the Path Computation Element Protocol (PCEP) standard as per IETF specifications. These improvements enable interoperability between Path Computation Client (PCC) devices from different vendors connected to the PCE, while still supporting the previous Cisco-proprietary implementation.

The feature introduces these changes:

CLI:

• The show pce ipv4 and show segment-routing traffic-eng pcc ipv4 commands are enhanced to display the SR-P2MP capability and the number of SR-P2MP instances.

VRF-to-VRF route leaking in SRv6 core

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

VRF-to-VRF route leaking enables sharing of routes between VRFs while maintaining their isolation. This feature allows the source VRF to send leaked routes to remote PEs or Route Reflectors (RRs) across an SRv6 core network, similar to an MPLS core network, enabling communication between different service tenants or administrative domains without compromising VRF isolation.

SRv6 services: EVPN E-Line support

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200] (select variants only*); Centralized Systems (8600 [ASIC: Q200])

You can now configure Segment Routing over IPv6 (SRv6) services on an EVPN E-Line network. SRv6 services on EVPN E-Line offers a modern approach to simplify and enhance network operations.

* This feature is supported on:

• 8201-32FH

BGP

256-way ECMP

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now configure up to 256 ECMP next hops for BGP in both IPv4 and IPv6, optimizing network bandwidth by load-balancing traffic across parallel paths.

Per-VRF Label Allocation for VPN Routes

Introduced in this release on: Fixed Systems (8200 [ASIC:Q200, P100], 8700 [ASIC: P100, K100] ); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now ensure consistent per-VRF label allocation for VPN routes with the same Route Distinguisher (RD). This feature modifies the default label allocation behavior by allowing you to enforce per-VRF label allocation for VPN routes using the advertise vpn-imported label-mode per-vrf command.

This feature introduces these changes:

CLI:

• advertise vpn-imported label-mode per-vrf

YANG Data Model:

• Cisco-IOS-XR-um-router-bgp-cfg.yang

  (see GitHub, YANG Data Models Navigator)

Selective FIB Download

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200])

You can now selectively download BGP prefixes to the Routing Information Base (RIB) and Forwarding Information Base (FIB). This feature prevents traffic black holes by ensuring that traffic follows default routes when specific destination routes are unavailable.

Simultaneous Monitoring of Adj-RIB-In Pre and Post-Policy Views

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now monitor BGP events and collect BGP route information before and after applying policy filters. This feature enables you to monitor both Adj-RIB-In pre-policy and post-policy views simultaneously for all BGP peers, enhancing your ability to debug routing policies and validate RTBH routes.

This feature introduces these changes:

CLI:

This feature modifies the following commands:

• route-monitoring inbound pre-policy

• show bgp bmp

• YANG Data Model: New XPaths for

  • Cisco-IOS-XR-um-router-bgp-cfg.yang

  • Cisco-IOS-XR-ipv4-bgp-oper.yang

    (see GitHub, YANG Data Models Navigator)

Interface and Hardware Component

Always-On SPAN-to-File with periodic write

Introduced in this release on: Fixed Systems(8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100]).

The enhanced SPAN-to-File feature provides continuous packet capture and debugging capability with always-on functionality that starts automatically upon destination configuration. It prevents data loss during node reloads by periodically writing packet buffer contents to disk, without stopping the capture. A default SPAN-to-File session for forwarding and buffer drops is always active and can be disabled if not needed. The feature also supports packet truncation and sampling in software for software-mirrored packets, independent of NPU capabilities.

These enhancements ensure reliable, always-available packet capture for post-event analysis, eliminating the need for prior configuration or user interaction.

The feature introduces these changes:

CLI:

• monitor-session default-capture-disable

• monitor-session local-capture-capacity

• The always-on, periodic-write, and capacity keywords are introduced in the destination file command.

• The write keyword is introduced in the monitor-session <name> packet-collection action command.

YANG data models:

• New Xpaths for Cisco-IOS-XR-um-monitor-session-cfg.yang

• New Xpaths for Cisco-IOS-XR-Ethernet-SPAN-cfg.yang

(see GitHub, YANG Data Models Navigator)

Display of traffic rates for bundle interfaces

Introduced in this release on: Fixed Systems(8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100]).

Routers can now display a snapshot of the traffic throughput and traffic rate on all bundle interfaces over the last few seconds, facilitating easy analysis. The show interfaces counters rates bundle command provides these statistics in a tabular format for quick reference.

The feature introduces these changes:

CLI:

• show interfaces counters rates bundle

YANG Data Models:

• New Xpaths introduced for Cisco-IOS-XR-infra-statsd-oper.yang

(see GitHub, YANG Data Models Navigator)

Increase in number of CFM sessions

Introduced in this release on: Fixed Systems(8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

The number of supported CFM sessions is now increased to 500. This boost allows for improved network monitoring and troubleshooting capabilities, ensuring consistent performance and reliability.

L2 interface VLAN encapsulation using VLAN range and list

Introduced in this release on: Fixed Systems (8200, 8700)(select variants only*); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200, P100])(select variants only*)

You can now leverage the VLAN range and list to effectively separate networks operating over shared links and devices. VLAN encapsulation is typically determined by the access network and customer edge (CE) device, limiting the network provider's control over the VLAN tag or Ethernet type of customer traffic.

The VLAN range and list support various customer traffic types, enhancing network flexibility and management.

*This feature is supported on:

• 8201-32FH

• 8201-24H8FH

• 8202-32FH-M

• 8212-48FH-M

• 8608

• 8711-32FH-M

• 8712-MOD-M

• 88-LC0-34H14FH

• 88-LC0-36FH

• 88-LC0-36FH-M

• 88-LC1-36EH

• 88-LC1-52Y8H-EM

• 88-LC1-12TH24FH-E

This feature modifies these changes:

CLI:

• encapsulation dot1ad

• encapsulation dot1ad dot1q

• encapsulation dot1q

• encapsulation dot1q second-dot1q

Multiple SPAN ACL sessions for MPLS

Introduced in this release on: Fixed Systems(8200, 8700)(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*).

This feature allows to configure multiple SPAN ACL sessions for MPLS on Layer 3 interfaces configured on the Label-Switched Paths (LSPs) to monitor the MPLS traffic based on the labels and the EXP bit. This feature verifies the overall network performance simultaneously from various network locations and ensures a better network visibility, network resource efficiency, and flexibility.

This MPLS SPAN ACL configuration is supported only in the ingress direction.

*This feature is now supported on:

• 8212-48FH-M

• 8711-32FH-M

• 8712-MOD-M

• 88-LC1-12TH24FH-E

• 88-LC1-52Y8H-EM

• 88-LC1-36EH

This feature introduces these changes:

CLI:

• acl mpls

• mpls access-list

YANG Data Model: Cisco-IOS-XR-um-mpls-acl-cfg.yang (see Github, YANG Data Models Navigator).

Unidirectional Link Detection Protocol support on physical Ethernet interfaces

Introduced in this release on: Fixed Systems(8200, 8700)(select variants only*); Modular Systems (8800 [LC ASIC: P100]).

The Unidirectional Link Detection Protocol (UDLD) is now supported on the Physical Ethernet interfaces on the Cisco Silicon One P100 ASIC-based Systems. This feature helps detect faults and miswiring conditions with unbundled fiber links and helps each device understand its own and neighbor connections.

*This feature is supported on:

• 8212-48FH-M

• 8711-32FH-M

• 8712-MOD-M

This feature introduces these changes:

CLI:

• clear ethernet udld statistics

• ethernet udld reset interface

• show ethernet udld interfaces

• show ethernet udld statistics

Double-Tagged 802.1ad Encapsulation Options for Layer 3 Physical and Bundle Subinterfaces

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

This feature enables you to increase the number of VLAN tags in an interface and an subinterface. You can enable this feature either on a physical interface or a bundle interface. When you configure this feature with the dual tag, interfaces check for IP addresses along with MAC addresses.

Verified Scalability Limits:

• Total number of VLAN tags in an interface and a subinterface with single tag: 4094

• Total number of VLAN tags in an interface and a subinterface with double tag: 4094 * 4094

Extended Support for DP04QSDD-ER1 Optical Module

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200](select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

This release introduces support for the Cisco 400G Quad Small Form-Factor Pluggable Double Density (QSFP-DD) optical module DP04QSDD-ER1 on the following routers and line cards.

*Routers:

• Cisco 8201-32FH

• Cisco 8201-24H8FH

• Cisco 8608

*Line cards:

• 88-LC1-36EH

Extended Support for DP04QSDD-HE0 Optical Module

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100])(select variants only*)

This release introduces support for the Cisco 400G QSFP-DD High-Power (Bright) Optical Module DP04QSDD-HE0, Ethernet Variant on the following line card

• *88-LC1-36EH

L2VPN

Enhance network efficiency and scalability with GIL pruning for PWHE interfaces

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100])(select variants only*)

You can now manage hardware resources for a Pseudowire Headend (PWHE) interface more efficiently by limiting PWHE replication to the line card locations where the interfaces listed in the Generic Interface List (GIL) are physically present. This optimization ensures that resource usage is confined to only the necessary line cards.

The router internally synchronizes the PWHE underlay with the GIL using a mechanism known as GIL pruning. The GIL consists of a subset of core-facing IGP/LDP-enabled interfaces expected to transmit pseudowire traffic for the PWHE interface.

This feature is enabled by default and does not require any user configuration.

*This feature is supported on:

• 88-LC1-52Y8H-EM

• 88-LC1-12TH24FH-E

Increase in pseudowire scale on Cisco 8000 Series Routers

Introduced in this release on: Fixed Systems (8200, 8700)(select variants only*); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: P100])

You can now improve traffic segmentation with a higher Ethernet Flow Point (EFP) that allows you to configure multiple VLANs with an increased scale limit of Layer 2 pseudowire per system for various services.

VPWS PWs

• *8212-48FH-M supports 12288 sessions

• 8711-32FH-M, 8608, 88-LC1-36FH, 88-LC1-12TH24FH-E, 88-LC1-52Y8H-EM, 8712-MOD-M supports 28672 sessions

VPLS PWs

• *8212-48FH-M 12288 sessions

• 8711-32FH-M, 8608, 88-LC1-36FH, 88-LC1-12TH24FH-E, 88-LC1-52Y8H-EM supports 20480 sessions

• 8712-MOD-M supports 32768 sessions

Multi-Dest (internal label ECD)

• *8212-48FH-M supports 12288 sessions

• 8711-32FH-M, 8608, 88-LC1-36FH, 88-LC1-12TH24FH-E, 88-LC1-52Y8H-EM, 8712-MOD-M supports 16384 sessions

L2 VLAN Subinterface Encapsulation and Rewrite

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now use the VLAN Subinterface Encapsulation and Rewrite operations to:

• Configure exact matching for all single-tagged encapsulations.

• Support legacy QinQ encapsulation 0x9100/0x8100.

• Enable priority tagged traffic to map to the specified interface.

The feature introduces these changes:

CLI:

New Commands

• dot1q tunneling ethertype 0x9100

• hw-module profile encap-exact

• encapsulation dot1ad priority-tagged

• encapsulation dot1q priority-tagged

Modified Command

rewrite ingress tag

YANG Data Model:

• Cisco-IOS-XR-um-8000-hw-module-profile-cfg (see GitHub, YANG Data Models Navigator)

EVPN

EVPN E-LAN Port-Active Multi-Homing

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200])(select variants only*)

The port-active multi-homing mode enables single-active redundancy load balancing at the port-level or the interface-level. In this mode, one of the PEs remains active at the port-level.

*The EVPN E-LAN port-active multi-homing mode is now extended to:

• 8712-MOD-M

• 8201-32FH

• 8201-24H8FH

• 8202-32FH-M

• 8608

• 88-LC0-34H14FH

• 88-LC0-36FH

• 88-LC0-36FH-M

EVPN E-Line All-Active Multi-Homing

Introduced in this release on: Fixed Systems (8200, 8700) ; Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200])(select variants only*)

In all-active multihoming mode, multiple PE devices connected to the same CE are simultaneously active. Traffic is distributed across all active links, optimizing bandwidth usage and ensuring high availability.

*The EVPN E-line all-active multi-homing mode is now extended to:

• 8712-MOD-M

• 8201-32FH

• 8201-24H8FH

• 8202-32FH-M

• 8608

• 88-LC0-34H14FH

• 88-LC0-36FH

• 88-LC0-36FH-M

EVPN E-Line Port-Active Multi-Homing

Introduced in this release on: Fixed Systems (8200, 8700) ; Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200]) (select variants only*)

The port-active multi-homing mode enables single-active redundancy load balancing at the port-level or the interface-level. In this mode, one of the PEs remains active at the port-level. This feature enables protocol simplification as only one of the physical ports is active at a given time.

*The EVPN E-Line port-active multi-homing mode is now extended to:

• 8712-MOD-M

• 8201-32FH

• 8201-24H8FH

• 8202-32FH-M

• 8608

• 88-LC0-34H14FH

• 88-LC0-36FH

• 88-LC0-36FH-M

EVPN E-Line Single-Active Multi-Homing

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200]) (select variants only*)

The single-active multi-homing mode offers redundant connectivity on a single link at a time with failover to the second link in case the active link fails. In this mode, only a single PE among a group of PEs attached to an Ethernet segment forwards traffic to and from that Ethernet Segment.

* The EVPN E-Line single-active multi-homing mode is now extended to:

• 8712-MOD-M

• 8201-32FH

• 8201-24H8FH

• 8202-32FH-M

• 8608

• 88-LC0-34H14FH

• 88-LC0-36FH

• 88-LC0-36FH-M

MPLS

Improved scale for MPLS over UDP tunnels

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200, P100])

To handle high traffic volume, you can enhance the MPLS over UDP tunnel scale up to 15284 tunnels using the hw-module profile cef mplsoudp scale command.

The feature introduces these changes:

CLI:

• hw-module profile cef mplsoudp scale

Prevention of IP traffic steering over MPLS-TE tunnel

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200, P100]).

This feature allows to prevent the MPLS labelled traffic or IP traffic to destinations associated with a segment routing prefix SID from resolving over the MPLS-TE tunnel using the autoroute announce exclude-traffic segment-routing all command. This feature ensures optimal hardware resource utilization.

This feature enhances the existing autoroute announce exclude-traffic segment-routing configuration which prevents only the MPLS labelled segment routing traffic from steering into the MPLS-TE tunnel.

The feature introduces these changes:

CLI:

RSVP-TE Transport Solution with Flex LSP Headend

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can enable the router to compute

• a primary LSP path,

• a secondary LSP path,

• a dynamic restore path serves as a backup to the primary LSP path, and

• another dynamic restore path acts as a backup to the secondary LSP path.

During the primary LSP path failure, the headend router computes a new dynamic restore primary path by reusing the links from the failed primary LSP path, and during the secondary LSP path or backup path or protecting path failure, the headend router computes a new dynamic restore path by reusing the links from the failed secondary LSP path.

CLI:

The protected-by keyword is enhanced to include two backup paths in the path-option command.

Multicast

LSM mLDP based MVPN bud/tail node enhancements on edge routers

Introduced in this release on: Fixed Systems(8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200, P100]).

This feature extends the support for the rendezvous point (RP) placement on the LSM mLDP based mVPN BUD/TAIL node on edge routers.

With this feature, the BUD node is now supported on these profiles: 0, 1, 2, 3, 4, 5, 6, 7, 9, 11, 12, 13, 14, 15, 17, 19, 23, 25, 27, 28, and 29.

Previously, the BUD node was supported only on Profiles 21 and 22 which were introduced in Cisco IOS XR Release 24.1.1.

Multicast Route Statistics

Introduced in this release on: Fixed Systems(8200 , 8700);Modular Systems (8800 [LC ASIC: P100, K100])

With this release, the route stats counters are programmed on the ingress line card, making traffic measurement more efficient.

Previously, the stats-ole implementation was used on P100 and K100 ASIC based systems, but it is no longer utilized. With this change, the stats-ole will show as invalid in the command output. As traffic enters the ingress Line card, the packets and bytes for the counter will increment. The same command can be used to clear the counters by specifying the ingress Line card location.

NetFlow and sFlow

sFlow Export with ECMP Load Balancing

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100])

You can now achieve sFlow packet load balancing across all ECMP paths to the collector. This feature uses pre-routing to gather nexthop interface and IP details for each packet, ensuring uniform distribution. It overcomes the limitations of the previous method, which lacked path visibility, by actively utilizing all paths. This results in more effective load balancing and improved network performance without compromising path tracking.

The feature introduces these changes:

CLI:

• The flow exporter-map command is modified with a new pre-route all-ecmp-paths keyword.

System Security

IPv6 support for CA enrollment URL

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

To enhance network compatibility and simplify management for modern network environments, you can now configure IPv6 addresses and CA server URLs resolving to IPv6 addresses as enrollment URLs for the CA hosted on IPv6-based servers. This enhancement allows successful CA configuration using the crypto ca trustpoint command, overcoming previous limitations where using IPv6 addresses and CA server URLs resolving to IPv6 addresses as enrollment URLs resulted in configuration failure.

MACsec Encryption on Layer 3 Subinterfaces

Introduced in this release on: Centralized Systems (8600 [ASIC:Q200])

You can now configure MACsec policy on Layer 3 subinterfaces, which gives you the flexibility to apply MACsec policies to different L3 subinterfaces that belong to the same main physical interface. This capability is possible because we've enabled the router to keep the VLAN tags unencrypted, enabling the L3 subinterfaces to be the MACsec endpoints. When you apply MACsec policies on these subinterfaces, you can enhance the overall security of your network by adding an extra layer of security to the communication between different subnets.

Multi-auth MAC Authentication Bypass

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100]) (*select variants only)

You can enhance network flexibility by enabling multiple hosts on a single port using MAC Authentication Bypass (MAB). The router now supports up to two clients per port by expanding its MAC learning capability from one to two. It authenticates each MAC address individually, allowing multi-domain authentication and enabling independent management of two endpoints. This feature simplifies network management and increases the connectivity options for devices per port.

*This feature is supported on the 8201-SYS routers.

Per-NPU hash rotation

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now configure the hash rotation value for each Network Processing Unit (NPU) to improve traffic load balancing and minimize traffic polarization. Alternatively, the value can be automatically calculated, eliminating the need for manual configuration.

MACsec Encryption on 8711-32FH-M

Introduced in this release on: Fixed Systems (8700 [ASIC: P100]) (select variants only*)

MACsec, the Layer 2 encryption protocol, secures data on physical media and provides data integrity and confidentiality.

*We now support MACsec encryption on all ports of 8711-32FH-M.

RADIUS with TLS protection

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

Remote Authentication Dial-In User Service (RADIUS) over Transport Layer Security (TLS) or RADSEC is now supported on Cisco 8000 routers. You can configure the RADIUS protocol on the Cisco router (RADIUS client) to redirect RADIUS packets to a remote RADIUS server connected over TLS for Authentication, Authorization, and Accounting (AAA) services.

Without TLS, RADIUS packets may be subject to potential security vulnerabilities, including data exposure, replay attacks, weak authentication, and encryption vulnerabilities, especially when transmitted across untrusted networks.

The feature introduces these changes:

CLI:

• The keyword radsec-server is introduced in the radius-server host command.

YANG Data Models:

• New Xpath for

  Cisco-IOS-XR-um-aaa-cfg.yang

• New Xpath for

  Cisco-IOS-XR-aaa-lib-cfg.yang

(see GitHub, YANG Data Models Navigator)

TLS version 1.3 support

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

We have enhanced the security and performance of the routers by upgrading to TLS version 1.3. This version minimizes vulnerabilities by eliminating outdated algorithms and ensuring forward secrecy. Additionally, TLS 1.3 improves router performance by providing faster connection times and reducing latency. The routers will now use TLS version 1.3 as the default for all TLS session establishment requests. If the peer device does not support TLS version 1.3, the router will automatically revert to TLS version 1.2.

System Management

Machine check error notifications

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

MCEs can cause the router to reboot. You had to manually inspect the MCE log file to determine whether the router reboot was due to a MCE.

Starting from this release, the Cisco IOS XR Software displays a syslog notification for any Machine Check Error (MCE) and simplifies the troubleshooting process.

Periodic shutdown syslog messages

Introduced in this release on: Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

By default, Cisco IOS XR software generates a shutdown syslog message immediately after the LC, FC, or RP shuts down and repeats the shutdown syslog message every 60 minutes to keep you informed about the shutdown status.

Support for Precision Time Protocol (PTP)

Introduced in this release on: Fixed Systems (8200 [ASIC: P100]) (select variants only*)

* With this release, support for PTP telecom profiles 8262, 8264, 8273.2, and 8275.1 is extended to the Cisco 8212-48FH-M router.

PTP Support on 88-LC1-12TH24FH-E and 88-LC1-52Y8H-EM

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100])(select variants only*)

Based on the IEEE 1588-2008 standard, Precision Time Protocol (PTP) is a protocol that defines a method to synchronize clocks in a network for networked measurement and control systems.

*This feature is now supported on 88-LC1-12TH24FH-E and 88-LC1-52Y8H-EM line cards.

With this release, 88-LC1-12TH24FH-E and 88-LC1-52Y8H-EM line cards support these PTP telecom profiles:

G.8265.1

G.8275.2

PTP for 8212-48FH-M Router

Introduced in this release on: Fixed Systems (8200) (select variants only*)

Based on the IEEE 1588-2008 standard, Precision Time Protocol (PTP) is a protocol that defines a method to synchronize clocks in a network for networked measurement and control systems.

*This feature is now extended to 8212-48FH-M.

For 8212-48FH-M routers, support for PTP is extended to G8265.1, G.8263, and G8275.2 profiles.

Global Navigation Satellite System (GNSS) Support on Cisco 8712-MOD-M Router

Introduced in this release on: Fixed Systems(8700)(select variants only*).

Global Navigation Satellite System (GNSS) is a satellite system used as a timing interface. GNSS receiver receives signals from GNSS satellites and decodes the information from multiple satellites to determine its distance from each satellite. Based on this data, the GNSS receiver identifies the location of each satellite.

*This feature is supported on the Cisco 8712-MOD-M routers.

System Monitoring

Monitor interface

Introduced in this release on: Fixed Systems (8200, 8700 ); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: P100]).

The filter physical keyword was introduced, along with new columns InDrops and OutDrops in the output, to provide enhanced monitoring capabilities for physical interfaces.

CLI:

• The filter physical keyword is added to the monitor interface command.

Improved packet loss detection and monitoring

Introduced in this release on: Fixed Systems (8700 [ASIC:K100]); Modular Systems (8800 [LC ASIC: P100])

You can now see the historical trend data for the packet-drop use-case, with detailed granularity on a per node and per NPU basis.

This feature introduces these changes:

CLI:

The history keyword is introduced in the show healthcheck use-case packet-drop command.

Support for logging functionality on third-party applications

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

This feature enables third-party applications to forward syslog messages to a remote server for handling a high rate of system logging.

Licensing

Support for Smart Licensing using Policy on the 8712-MOD-M

Introduced in this release on: Fixed Systems (8700) (select variants only*)

Support for Smart Licensing using Policy is now extended to the hardware.

• 8712-MOD-M

This Cisco 8000 router variant support FCM Model 2.

Cisco 8712-MOD-M Router

The Cisco 8712-MOD-M is a K100-based, 2-RU router with the I/O diversity that provides 6.4 Tbps of network bandwidth.

The Cisco 8712-MOD-M features 4 Modular Port Adapter (MPA) slots that support 8K-MPA-4D, 8K-MPA-16H and 8K-MPA-16Z2D MPAs.

The 8K-MPA-4D is a pluggable card that provides 4 interface ports that can support QSFP-DD 400GbE, 200GbE, or 100GbE modules

The 8K-MPA-16H is a pluggable card that provides 16 interface ports that supports QSFP-28 100GbE module.

The 8K-MPA-16Z2D is a pluggable card that provides 20 interface ports that includes 4 ports of QSFP-DD and 16 ports of SFP modules.

PSU2KW-HVPI Power Supply Unit for the Cisco 8201, 8202, 8201-32FH, and 8101-32FH Routers

We are now supporting the high voltage power supply unit, PSU2KW-HVPI, which accepts AC, HVAC, or HVDC input power to operate the Cisco 8201, 8202, 8201-32FH, 8101-32FH routers in the port-side intake configuration.

The PSU2KW-HVPI power supply unit offers a maximum power output of 1000W (AC low line) or 2000W (HVAC or HVDC). The advantages of the PSU2KW-HVPI PSU include:

• Supports both HVDC and HVAC input power

• Enhances performance when transceivers are installed in the router, which requires more power to operate

• Provides improved efficiency for power distribution

Route Processor Card 8800-RP2-S

This release introduces support for a new route processor card, 8800-RP2-S, on Cisco 8800 Series routers. It provides a capacity of 8-core x86 CPU at 2.7GHz with 64GB RAM and only supports Secure Zero-Touch Provisioning (sZTP).

sZTP streamlines the network deployment process, making it faster, more reliable, and more secure.

For more information, see the Cisco 8800 section in the Datasheet here.

Optics

Note: Optics support varies across devices (routers, line cards, RPs, and so on). To know if an optics is compatible with a specific Cisco device, refer to the Transceiver Module Group (TMG) Compatibility Matrix.

This release introduces the following optics:

Cisco 1000BASE T-X Transceiver Module

• SFP-1G-SX

• SFP-1G-LH