Application Hosting

Cisco Secure DDoS Edge Protection

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

We have now moved DDoS protection to the network edge, ensuring you can mitigate any DDoS attacks at the ingress points and minimize the impact of such attacks on your network and applications running on it. This solution deploys a centralized controller that manages a distributed network of edge detectors that analyze and mitigate threats across networks.

Docker Application Management using IPv6 Address

In this release, you gain the ability to manage Docker applications within containers using IPv6 addresses via the router's management interface. Leveraging IPv6 addresses provides expanded addressing options, enhances network scalability, and enables better segmentation and isolation of applications within the network.

Prior to this update, only IPv4 addresses could be used to manage docker applications.

Programmability

Automatic Resynchronization of OpenConfig Configuration

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

OpenConfig infrastructure can now reapply all the OpenConfig configurations automatically if there are any discrepancies in the running configuration.

With this feature, there is no need for manual replacement of the OpenConfig configuration using Netconf or gNMI.

The re-sync operation is triggered if the running configurations and the OpenConfig configuration go out of sync after any system event that removes some running configurations from the system. A corresponding system log gets generated to indicate the re-sync status.

gRPC Network Security Interface

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

This release implements authorization mechanisms to restrict access to gRPC applications and services based on client permissions. This is made possible by introducing an authorization protocol buffer service for gRPC Network Security Interface (gNSI).

This feature introduces the following change:

CLI:

• gnsi load service authorization policy

• show gnsi service authorization policy

BGP

Peering Between BGP Routers Within the Same Confederation

Introduced in this release on: NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Native])

You can now enable BGP peering between routers in the sub-autonomous system (AS) within a confederation to advertise specific router updates using iBGP. This capability ensures that the mesh of routers between sub-ASes in a confederation maintains consistent routing tables, ensuring proper network reachability. Enabling this feature helps improve preventing performance reduction and traffic management challenges.

The feature introduces these changes:

CLI:

New Command:

• allowconfedas-in

YANG Data Models

• New XPaths for

  • Cisco-IOS-XR-ipv4-bgp-cfg.yang

  • Cisco-IOS-XR-um-router-bgp-cfg

(see GitHub, YANG Data Models Navigator)

Preventing Label Churn Using Secondary Label Allocation

Introduced in this release on: NCS 5700 line cards [Mode: Compatibility; Native]

You can now prevent label churn and ensure that traffic forwarding continues without interruption.

In certain scenarios, route reflectors (RRs) are configured as backup routers to each other through Prefix Independent Convergence (PIC) configuration, and the same VPN prefix is learnt from other routers. In such cases, if the label allocation mode used in RRs is per-next-hop-received-label, then label churn happens, and labels are exhausted quickly. This feature uses the secondary label allocation method to prevent the label churn issue.

The feature introduces these changes:

CLI:

• The allocate-secondary-label keyword is introduced in the label mode command.

YANG Data Model:

• Cisco-IOS-XR-um-router-bgp-cfg.yang (see GitHub, YANG Data Models Navigator)

Ternary Content-Addressable Memory Enhancement to Improve L3VPN Routing Capability

Introduced in this release on: NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5700 line cards [Mode: Native])

You can improve your router's performance by introducing two additional Ternary Content-Addressable Memory (TCAM) labels. This enhancement removes the dependence on the Forwarding Equivalence Class (FEC) scale for handling more routes, which means that the router's capacity is no longer limited by FEC capacity. As a result, we have significantly increased the number of routes for L3VPN.

The feature introduces these changes:

CLI:

• remote-bgp-label-mode-per-prefix

• hw-module fib mpls two-label-tcam-optimized

Virtual Routing Forwarding Next Hop Routing Policy

Introduced in this release on: NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Native])

You can now enable a route policy at the BGP next-hop attach point to limit notifications delivered to BGP for specific prefixes, which equips you with better control over routing decisions, and allows for precise traffic engineering and security compliance for each VRF instance, and helps establish redundant paths specific to each VRF.

The feature introduces these changes:

CLI:

Modified Command:

• The nexthop route-policy command is extended to VRF address-family configuration mode.

YANG Data Models

• New XPaths for

  • Cisco-IOS-XR-ipv4-bgp-cfg.yang

  • Cisco-IOS-XR-um-router-bgp-cfg

(see GitHub, YANG Data Models Navigator)

Interface and Hardware Component

Disable Auto-Squelch on Coherent Optics

Introduced in this release on: NCS 5500 modular routers; NCS 5700 fixed port routers

This release introduces the support to disable auto-squelch on coherent optics. By disabling auto-squelch, you can detect weak signals embedded within the laser source noise and simultaneously reduce processing overhead in systems with stable laser sources and minimal noise. When laser squelch is enabled, the system shuts down the laser in case of an Optical Transport Network (OTN) failure.

The feature introduces these changes:

CLI:

• host auto-squelch disable

YANG DATA models:

• New XPaths for Cisco-IOS-XR-controller-optics-cfg (see Github, YANG Data Models Navigator)

Independent MTUs for IPv4 and IPv6

Introduced in this release on: NCS 5700 line cards [Mode: Native]

You can now ensure reduced fragmentation or packet drops by configuring separate IPv4 and IPv6 Maximum Transmission Units (MTUs). You can configure independent IPv4 and IPv6 MTUs on the physical interface and subinterface, bundle interface and subinterface, and Bridge-Group Virtual Interface (BVI).

This feature introduces these changes:

CLI: The following commands are extended to subinterface configuration mode:

• ipv4 mtu

• ipv6 mtu

• mtu

Traffic Mirroring of Incoming and Outgoing Traffic Separately over Pseudowire

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5700 line cards [Mode: Native]

You can now distribute the monitoring load by separating the Rx and Tx traffic mirroring over the pseudowire. Earlier, you could mirror the entire traffic without distinguishing between Rx and Tx directions.

The separation of traffic direction gives the flexibility of monitoring and analyzing the nature of data being sent and received using independent network traffic analysis tools. The separation also helps in distributing the monitoring load and eases troubleshooting.

The feature modifies the monitor-session command. The keywords destination rx and destination tx of the command are extended to monitor session configuration mode. Earlier, this configuration resulted in verification failure.

TSoP Smart SFP for SDH and SONET Encapsulation

Introduced in this release on NCS 5500 fixed port routers

This release introduces support for the Clear Channel Synchronous Transport Module Level-1 (STM1) Smart SFP (SFP-TS-OC3STM1-I) for the Transparent SONET or SDH over Packet (TSoP) protocol. This allows you to leverage your existing packet-switched network to transport traditional time-division multiplexing (TDM) traffic. TSoP Smart SFPs offer the following advantages:

• Encapsulation of SDH or SONET bit streams into packet-switched network format

• Improved suitability for pseudowire transport over an Ethernet network

L2VPN and Ethernet Services

Control Word and Flow Label Signaling Attributes in Extended Community Field

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

We have enhanced the information that the Extended Community carries for a route by including details such as frame sequencing information, type of payload, identifying encapsulated traffic, and identifying packets belonging to the same traffic flow (or sharing characteristics such as source or destination addresses). Such additional information helps in proper encapsulation, identification, and handling of traffic flows at the receiving end, and is possible because we've included the control word and flow label signaling attributes to the extended community field.

The feature introduces these changes:

CLI:

The control word and flow label signaling attributes are added to:

• show bgp l2vpn evpn

• show evpn evi

Storm Control Configuration for Subinterfaces on NCS 5700 fixed port routers (non-SE)

Introduced in this release on: NCS 5700 fixed port routers

Storm Control is now supported on the NCS 5700 fixed port routers (non-SE) variants.

VXLAN Static Routing

Introduced in this release on:NCS 5500 fixed port routers;NCS 5700 fixed port routers;NCS 5500 modular routers(NCS 5500 line cardsNCS 5700 line cards [Mode: Native])

You can now configure the source and destination virtual tunnel endpoints (VTEPs) for a particular traffic flow, which is particularly useful for scenarios where your data center is connected to an enterprise network, so multiple servers in the data center provide cloud services to your customers and the enterprise edge router. These endpoints help provide rapid convergence in case of failure. Plus, using the UDP header in the VXLAN packet, the VXLAN static routing (also called unicast VXLAN) facilitates network balancing by preventing the transmission of replicated packets.

The feature introduces these changes:

CLI:

• host-reachability protocol static

• overlay-encapsulation vxlan

• interface nve

• member vni

YANG Data Model:

• Cisco-IOS-XR-l2vpn-cfg (see GitHub, YANG Data Models Navigator)

MPLS

Teardown and Reestablishment of RSVP-TE Tunnels

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

You can now teardown and reestablish the existing tunnels of headend, midend, or tailend router tunnels of an MPLS network for optimized distribution of the traffic across MPLS and RSVP-TE to improve network performance and enhance resource utilization.

Previously, you could reestablish tunnels only at the headend router using the mpls traffic-eng resetup command.

The feature introduces these changes:

CLI: mpls traffic-eng teardown

YANG Data Model: Cisco-IOS-XR-mpls-te-act.yang

(see GitHub, YANG Data Models Navigator)

Multicast

EVPN All-Active Multi-homed Multicast Source Behind a BVI

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

We have enhanced multicast routing efficiency, load balancing, and latency in EVPN topology by optimizing redundancy and enabling support for All-Active (AA) multicast multi-homed sources. The multi-homed multicast data sources are located behind a Bridge-Group Virtual Interface (BVI), while multicast receivers can be in either the core or a bridge domain.

This feature introduces the following changes:

• CLI

  • The ole-collapse-disable keyword is introduced in the hw-module multicast evpn command.

• YANG Data Model

  • New leaf evpn-ole-collapse-disable added in Cisco-IOS-XR-fia-hw-profile-cfg.yang (see GitHub, YANG Data Models Navigator).

MLD Snooping Synchronization for EVPN Multi-Homing

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

The Designated Forwarder (DF) PE router in an EVPN multi-homed network can now efficiently forward multicast traffic from the source to the interested receivers, avoiding unnecessary replication and reducing network bandwidth consumption.

This is made possible by introducing support for Multicast Listener Discovery, MLDv1, and MLDv2 (IPv6) snooping state synchronization for EVPN multi-homing peers or provider edge (PE) devices, expanding the scope of the previous support for IGMP (IPv4) snooping state synchronization.

Statistics for Egress Multicast Traffic Route Rate

Introduced in this release on: NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

With the ability to now view the route rates or rate of data being forwarded or transmitted per interface, you can monitor your network performance at a granular level, effectively troubleshoot network issues, and have greater control over bandwidth management.

Previously, you could view the route rates only at the line card level.

This feature introduces the following changes:

• CLI

  • The rate keyword is introduced in the show mrib route command.

• YANG Data Model

  • New XPaths for Cisco-IOS-XR-mfwd-oper.yang (see GitHub, YANG Data Models Navigator).

IP Addresses and Services

Unicast VRRP

We have now enabled Layer 3 unicast transport mode in VRRP, allowing it to enhance its capacity to send data to other networks, including cloud networks. Pairwise router redundancy enables high availability in cloud network scenarios. However, a virtual IP (VIP) address is required by the default route of the cloud native function because there is no pre-designated active member in paired routers. HSRP can provide a VIP, but cloud networks do not support Layer 2 multicast or broadcast transports. You can configure VRRP to support Layer 3 unicast transport to overcome the limitation of Layer 2 multicast and broadcast transports.

The feature introduces these changes:

New Command:

CLI:

• unicast-peer

Modified Commands:

• show vrrp command is modified to support new fields: Mcast packet in Ucast mode , IPv4 Unicast Peer , and IPv4 Unicast Peer .

YANG Data Model:

• Cisco-IOS-XR-ipv4-vrrp-cfg.yang

• Cisco-IOS-XR-ipv4-vrrp-oper.yang

  (see GitHub, YANG Data Models Navigator)

Modular QoS

Burst Size for Port-Level Shaper

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

You can now achieve a predictable and accurate burst size at the link level by configuring port-level shaper burst size, thus ensuring better adherence to traffic SLAs. Also, with the port-level shaper burst size configured in the egress policy maps, the predictability in peak burst ensures that you can configure any next-hop low-capacity device to handle these bursts.

Previously, you could configure burst sizes, which impacted traffic flow only at the Virtual Output Queue (VOQ) level but didn’t control packet transmission at the link level.

View Packet Processing and Traffic Management Resources

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

You can now view the utilization of some packet processing and traffic management resources, such as policer banks and connectors. Insights into their consumption and availability help you prevent or mitigate an Out of Resource (OOR) situation, thus ensuring optimal QoS operations with minimal impact on network performance.

The feature introduces the following changes:

CLI:

show controllers npu resources qos

YANG:

• Cisco-IOS-XR-fretta-bcm-dpa-qos-resources-oper

• Cisco-IOS-XR-5500-qos-oper

• Cisco-IOS-XR-fretta-bcm-dpa-qos-rate-profile-resources-oper

• Cisco-IOS-XR-fretta-bcm-dpa-qos-egq-resources-oper

(see GitHub, YANG Data Models Navigator)

Routing

Maximum Paths Per Flexible Algorithm Per Prefix

Previously, you could configure a maximum number of Equal-Cost Multi-path (ECMP) to be set for SPF algo 0.

This feature provides additional granularity to the IS-IS Maximum Paths Per-Algorithm feature by allowing you to specify a set of prefixes for SPF algo 0.

Now you can achieve a balance between path diversity and computational and memory requirements by controlling the number of paths for each specific algorithm and destination prefix combination.

This feature introduces these changes:

CLI

• maximum-paths route-policy name

YANG Data Models:

• This feature extends the native Cisco-IOS-XR-clns-isis-cfg.yang model

  See GitHub, Yang Data Models Navigator

Increased ECMP Maximum Paths for BGP within VRF

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

We have increased the maximum ECMP paths available for BGP within a VRF to 128. This increases the number of next hops that are added for ECMP in the Forwarding Information Base (FIB) table, which in turn ensures that the network is geared up to deal with sudden increase in bandwidth, without compromising on the load balancing and performance aspects.

Previously, the maximum number of ECMP paths supported for IGP, BGP, and labeled paths was 64. With this release, the support is enhanced to 128 ECMP paths for IPv4 and IPv6 prefixes over iBGP and eBGP within a VRF.

This feature modifies the maximum-paths command.

Segment Routing

Configure Flow Labels in SRv6 Header for PM Liveness

Introduced in this release on: NCS 5500 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards).

You can now monitor the activeness of multiple paths for a given segment list using flow labels in the SRv6 header.

In earlier releases, the SRv6 header didn't include flow labels.

The feature introduces these changes:

CLI:

• The flow-label keyword is introduced in the performance-measurement liveness-profile command.

YANG Data Models:

• Cisco-IOS-XR-um-performance-measurement-cfg.yang

• Cisco-IOS-XR-perf-meas-oper.yang

See (GitHub, Yang Data Models Navigator)

Configure Segment Lists to Activate Candidate Paths in SRv6 for PM Liveness

Introduced in this release on: NCS 5500 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards).

You can now enable a candidate path to be up by configuring the minimum number of active segment lists associated with the candidate path. The head-end router determines that a candidate path is up based on the minimum number of active segment lists configured.

In earlier releases, the head-end router identified a candidate path as up only when all the segment lists associated with the path were active.

The feature introduces these changes:

CLI:

• The validation-cp minimum-active segment-lists option is introduced in the performance-measurement liveness-detection command.

YANG Data Models:

• Cisco-IOS-XR-infra-xtc-agent-cfg.yang

See (GitHub, Yang Data Models Navigator)

Flexible Algorithm Constraint for Tree-SID Path Computation

This feature introduces support for Static and mVPN/Dynamic TreeSID with Flexible Algorithm constraint.

Unlike SR-TE point-to-point (P2P) policies, where the primary objective for Flexible Algorithm is to reduce or compress the number of segments on the packet, the objective for Flexible Algorithm-based point-to-multipoint (P2MP) policies:

• Another method of traffic engineering

• LFA FRR – Without Flex-Algo, the primary and backup paths chosen by the local node might not follow the traffic engineering constraints specified in the policy.

This feature introduces these changes:

CLI

• The sid-algorithm algo keyword is introduced in the command.

• The output of the show pce lsp p2mp command is modified to display Flex-Algo associated with a Tree, the Metric Type from Flex-Algo definition at Root, and the hop node-SIDs.

• The output of the show segment-routing traffic-eng p2mp policy command is modified to display Flex-Algo associated with Tree SID state, and the hop node-SIDs.

IS-IS Flexible Algorithm with Exclude Maximum Delay Constraint

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

This feature enables you to configure topologies that exclude links that have delays over a specific threshold. This is especially critical for high-frequency trading applications, in satellite networks, or wherever there are fluctuations in link delays.

This feature introduces these changes:

CLI:

• The router isis instance flex-algo algo command is modified with the new maximum-delay value option.

YANG Data Model:

• This feature extends the native Cisco-IOS-XR-clns-isis-cfg.yang model (see GitHub, YANG Data Models Navigator)

IS-IS Flexible Algorithm with Exclude Minimum Bandwidth Constraint

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

Traffic engineering in networks can be optimized by avoiding low-bandwidth links that may not be capable of handling high volumes of traffic.

This feature allows you to use Flexible Algorithm to create topologies in your network that explicitly exclude high bandwidth traffic from utilizing links below a specified capacity. This constraint is achieved by introducing a new bandwidth-based metric type within the Flexible Algorithm framework. Links that do not satisfy the constraint are ignored when computing the associated Flexible Algorithm topology.

This feature introduces these changes:

CLI:

• The router isis instance flex-algo algo command is modified with the new minimum-bandwidth value option.

YANG Data Model:

• This feature extends the native Cisco-IOS-XR-clns-isis-cfg.yang model (see GitHub, YANG Data Models Navigator)

Maximum Paths Per IS-IS Flexible Algorithm Per Prefix

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

Previously, you could configure a maximum number of Equal-Cost Multi-path (ECMP) to be set for individual Flex Algorithms.

This feature provides additional granularity to the IS-IS Maximum Paths Per-Algorithm feature by allowing you to specify a set of prefixes for Flexible Algorithm.

Now you can achieve a balance between path diversity and computational and memory requirements by controlling the number of paths for each specific algorithm and destination prefix combination.

This feature introduces these changes:

CLI:

• maximum-paths route-policy name

YANG Data Models:

• This feature extends the native Cisco-IOS-XR-clns-isis-cfg.yang model

  See GitHub, Yang Data Models Navigator

Microloop Avoidance for IS-IS with Per-Prefix Filtering

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

Currently, when SR Microloop Avoidance for IS-IS is enabled, it applies to all prefixes.

This feature allows you to selectively allow or deny specific IPv4 or IPv6 prefixes or routes that may cause microloops, which allows for efficient use of hardware resources and ensures overall network stability.

This feature introduces these changes:

CLI:

• The microloop avoidance segment-routing command is modified with the new route-policy name option for IS-IS.

YANG Data Model:

• This feature extends the native Cisco-IOS-XR-um-router-isis-cfg.yang model (see GitHub, YANG Data Models Navigator)

Microloop Avoidance for OSPFv2 Single-Node Cost-in and Single-Node Cost-out Events

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

Microloops disrupt network connectivity and cause suboptimal routing decisions. This feature avoids microloops by implementing the Greedy walk algorithm, which is similar to TI-LFA computation.

This feature extends the microloop avoidance support for additional scenarios in OSPFv2, such as cost-in and cost-out events.

This feature introduces these changes:

YANG Data Model:

• Cisco-IOS-XR-ipv4-ospf-oper.yang

  (see GitHub, YANG Data Models Navigator)

Path MTU discovery for SRv6 Packets on Ingress PE

Introduced in this release on: NCS 5500 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards).

This feature prevents packet losses when one SRv6-enabled router sends an oversized packet to another. The functionality enables a router to send an ICMP error message to the source in such cases, prompting the sender to resend a packet whose size is within the MTU value, thus ensuring the packet moves ahead. The feature is critical for SRv6-enabled routers as these routers don't support packet fragmentation.

Previously, a router dropped oversized packets without notifying the source, resulting in packet loss.

The feature introduces these changes:

CLI:

• The path-mtu keyword is introduced in the hw-module profile segment-routing srv6 mode command.

SR Policy Liveness Monitoring on Segment Routing over IPv6 (SRv6)

Introduced in this release on: NCS 5500 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards).

In segment routing over IPv6 (SRv6), you can now verify end-to-end traffic forwarding over an SR policy candidate path by periodically sending probe messages. Performance monitoring on an SRv6 network enables you to track and monitor traffic flows at a granular level.

Earlier releases supported SR policy liveness monitoring over an SR policy candidate path on MPLS.

SR-TE Application Programming Interface (API)

Introduced in this release on: NCS 5500 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards)

This feature introduces an API solution that simplifies the task of building SR-TE controllers and managing SRTE policies. It does so by defining gRPC API services that allow applications to request SR policy operations.

The solution leverages the gRPC Service API and GPB Data models, providing a unified, scalable, and secure method for network programming.

This feature introduces these changes:

New CLI

• grpc segment-routing traffic-eng policy-service

YANG Data Models:

EMSD Yang model is updated to have this config under "segment-routing" container.

• Native model: Cisco-IOS-XR-man-ems-cfg.yang

• UM model: Cisco-IOS-XR-um-grpc-cfg.yang

(see GitHub, YANG Data Models Navigator)

SR-TE Explicit Path with a BGP Prefix SID as First Segment

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

This feature allows you to configure an SR-TE policy with an explicit path that uses a remote BGP prefix SID as its first segment. This path is achieved by leveraging the recursive resolution of the first SID, which is a BGP-Label Unicast (BGP-LU) SID. BGP-LU labels are used as the first SID in the SR policy to determine the egress paths for the traffic and program the SR-TE forwarding chain accordingly.

This allows users to enable Segment Routing to leverage their existing BGP infrastructure and integrate it with the required Segment Routing functionalities.

SRv6 ESI Filtering

Introduced in this release on: NCS 5500 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards)

Split Horizon Group (SHG) labels and Ethernet Segment Identifier (ESI) filtering functionalities exist on MPLS underlay networks.

This feature introduces ESI filtering functionality to SRv6 underlay networks, using the End.DT2M SRv6 endpoint behavior. This behavior uses the "Arg.FE2" argument for SRv6, which is similar to the SHG label for MPLS.

This feature allows nodes to identify BUM traffic based on the advertised ESI and prevent a loop by avoiding re-broadcasting the same traffic back towards the access node.

This functionality is enabled by default.

SRv6 Traffic Accounting

Introduced in this release on: NCS 5500 fixed port routers, NCS 5500 modular routers (NCS 5500 line cards).

You can now enable the router to record the number of packets and bytes transmitted on a specific egress interface for IPv6 traffic using the SRv6 locator counter.

You can use this data to create deterministic data tools to anticipate and plan for future capacity planning solutions.

This feature introduces or modifies the following changes:

CLI:

• accounting prefixes ipv6 mode per-prefix per-nexthop srv6-locators

YANG Data Models:

• Cisco-IOS-XR-accounting-cfg

• Cisco-IOS-XR-fib-common-oper.yang

(see GitHub, YANG Data Models Navigator)

SRv6-Services: L3 Services with Local SIDs from W-LIB

Introduced in this release on: NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5700 line cards [Mode: Native])

This feature enables an SRv6 headend node to allocate and advertise local SIDs with Wide (32-bit) functions (Local W-LIB).

The headend router utilizes the local W-LIB functionality to define and implement SR policies using SRv6 SIDs.

The Local W-LIB is supported for Layer 3 (VPNv4/VPNv6/BGPv4/BGPv6 global) services.

Two-Way Active Measurement Protocol Light Source Address Filtering

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

You can now restrict unauthorized users from sending packets to the network and prevent compromising the network security and reliability. For a destination UDP port, you can configure the list of IP addresses that can send Two-Way Active Measurement Protocol (TWAMP)-light packets to responder or querier nodes.

In earlier releases, the responder or querier node accepted TWAMP-light packets from all IP addresses.

The feature introduces these changes:

CLI:

• The querier and responder keywords are introduced in the performance-measurement protocol twamp-light measurement delay command.

YANG Data Models:

• Cisco-IOS-XR-um-performance-measurement-cfg.yang

• Cisco-IOS-XR-perf-meas-oper.yang

See (GitHub, Yang Data Models Navigator)

System Management

PTP on NCS-57B1-6D24-SYS, NCS-57B1-5DSE-SYS and NCS-57D2-18DD-SYS

Introduced in this release on: NCS 5700 fixed port routers

Based on the IEEE 1588-2008 standard, Precision Time Protocol (PTP) is a protocol that defines a method to synchronize clocks in a network for networked measurement and control systems.

With this release, PTP Class C performance and QSFP-DD optics are now supported on 400G port speed for the following hardware:

• NCS-57B1-6D24-SYS

• NCS-57B1-5DSE-SYS

• NCS-57D2-18DD-SYS

PTP and SyncE support on breakout ports of NCS-57D2-18DD-SYS and NCS-57B1-6D24-SYS Routers

Introduced in this release on: NCS 5700 fixed port routers.

Based on the IEEE 1588-2008 standard, Precision Time Protocol (PTP) is a protocol that defines a method to synchronize clocks in a network for networked measurement and control systems. And, SyncE provides synchronization signals transmitted over the Ethernet physical layer to downstream devices, while the Synchronization Status Message (SSM) indicates the quality level of the transmitting clock to the neighboring nodes, informing the nodes about the level of the network's reliability. Ethernet Synchronization Message Channel (ESMC) is the logical channel that uses an Ethernet PDU (protocol data unit) to exchange SSM information over the SyncE link.

With this release, timing support for PTP and SyncE is extended to 4x10G and 4x25G breakout ports of NCS-57D2-18DD-SYS and NCS-57B1-6D24-SYS routers.

Class B and Class C performances are supported on 4x10G and 4x25G breakout ports of NCS-57D2-18DD-SYS and NCS-57B1-6D24-SYS routers.

System Monitoring

System Logging Message Count

Instead of calculating the bytes consumed by Syslog as you did previously, you can now easily and effectively manage the buffer size of the system log messages by specifying the number of entries the system log displays.

The feature introduces these changes:

CLI:

• The entries-count keyword is added to the logging buffered command.

YANG Data Model:

• New Xpaths for Cisco-IOS-XR-infra-syslog-cfg

• New Xpaths for Cisco-IOS-XR-um-logging-cfg

System Security

Multiple Public Keys per User for Public Key-based Authentication

Introduced in this release on: NCS 5500 fixed port routers; NCS 5700 fixed port routers; NCS 5500 modular routers (NCS 5500 line cards; NCS 5700 line cards [Mode: Compatibility; Native])

We provide greater flexibility to access secure routers by allowing four public keys to be used for authentication. With the ability to associate multiple public keys with your user account on the router, we've also simplified the authentication process by eliminating the need to create unique users for each SSH client device.

The feature introduces these changes:

CLI:

• The second , third , and fourth keywords are introduced in the crypto key import authentication rsa command.

• The second , third , and fourth keywords are introduced in the crypto key zeroize authentication rsa command.

• The second , third , and fourth keywords are introduced in the keystring command.

YANG Data Models:

• Cisco-IOS-XR-crypto-act

• Cisco-IOS-XR-um-ssh-cfg

(See GitHub, YANG Data Models Navigator)