System Monitoring

EEDB Resource Segregation for Encapsulation Types

We have now segregated the Egress Encapsulation Database (EEDB) resources based on different egress encapsulation types, such as attachment circuits (AC), pseudowires, tunnels, and Address Resolution Protocol (ARP). This allows you to examine encapsulation-specific resource details using show commands. When resource usage exceeds the Out of Resource (OOR) threshold levels, the router also alerts you with system log messages.

When resource usage exceeds the OOR thresholds, you can avoid traffic loss by taking corrective action to free up resources, such as reducing the scale of interfaces with the related encapsulation.

The show controllers npu resources command is now modified to include the following optional keywords:

• encapAC

• encapPWE

• encaptunnels

• encapARP

This feature is supported on Cisco 5700 Series Routers and on routers that have the NC57 line cards installed and operating in either native or compatiblity mode

BGP

BGP Advertisement without Additional Paths

The route reflector client can now advertise both the best path and the best external path when the locally received route and the route that it received from VRF have different route distinguishers (RDs) without additional paths.

Earlier, the router reflector client advertised both the best path and the best external path in the route reflector only when you had configured additional path.

This feature is enabled by default and supports both IPv4 and IPv6 prefixes. You cannot disable it.

Programmability

gNMI Bundling Size Enhancement

With gRPC Network Management Interface (gNMI) bundling, the router internally bundles multiple gNMI Update messages meant for the same client into a single gNMI Notification message and sends it to the client over the interface.

You can now optimize the interface bandwidth utilization by accommodating more gNMI updates in a single notification message to the client. We have now increased the gNMI bundling size from 32768 to 65536 bytes, and enabled gNMI bundling size configuration through Cisco native data model.

Prior releases allowed only a maximum bundling size of 32768 bytes, and you could configure only through CLI.

The feature introduces new XPaths to the Cisco-IOS-XR-telemetry-model-driven-cfg.yang Cisco native data model to configure gNMI bundling size.

To view the specification of gNMI bundling, see Github repository.

gNOI System Service Revision 1.0.0

With the gRPC Network Operations Interface (gNOI) Revision 1.0.0, you can:

• Cancel a pending reboot request using the CancelReboot RPC

• Terminate a process using the KillProcess RPC

You can access the gNOI system RPC messages from the Github repository.

Routing

Configure flex-algo IS-IS maximum-path

This feature introduces the new algorithm 0 command and provides information on the updated flex-algo command.

These updates enable individual granularity for flex-algo and regular SPF algorithms.

Segment Routing

Circuit-Style SR-TE Policies

This solution allows Segment Routing to meet the requirements of a connection-oriented transport network, which was historically delivered over circuit-switched SONET/SDH networks.

Circuit-style SR-TE policies allow a common network infrastructure to be used for both connection-oriented services and classic IP-based transport. This eliminates the need for multiple parallel networks, which greatly reduces both capital expenditures (CapEx) and operating expenditures (OpEx).

High Availability Support for Dynamic Tree-SID (Multicast VPN)

We have introduced more resilience for building multicast VPN (mVPN) dynamic tree-SIDs by providing High Availability (HA) for the Segment Routing Path Computation Element (SR-PCE). This HA is made possible by adding another SR-PCE to the network.

As a result, there’s a noncompute or standby PCE for the mVPN dynamic policies. The root Path Computation Element Client (PCC) elects the active SR-PCE. If an active PCE failure occurs, the root PCC delegates the compute role for the mVPN dynamic Tree-SID to the standby SR-PCE.

Path Tracing Midpoint Node

Path Tracing (PT) provides a log or record of the packet path as a sequence of interface IDs along with its time stamp. In Path Tracing, a node can behave as a source, midpoint, or sink node.

The Path Tracing Midpoint feature is implemented in this release which measures the hop-by-hop delay, traces the path in the network and collects egress interface load information and interface Id, and stores them in the Midpoint Compressed Data (MCD) section of Hop-by-Hop Path Tracing (HbH-PT) header.

This feature provides visibility to the Path Tracing Midpoint node that handles IPv6 transit in Path Tracing and full characterization of the packet delivery path. It provides real time information and the current status of the network.

This feature is supported on Cisco 5700 Series Routers and on routers that have the NC57 line cards installed and operating in native mode.

This feature introduces the following command:

• performance-measurement interface

SR IS-IS Enhancements: max-metric and data plane updates

The new anomaly optional keyword is introduced to affinity flex-algo command. This keyword helps to advertise the flex-algo affinity when the performance measurement signals a link anomaly, such as an excessive delay on a link. You could use the anomaly option to exclude the link from flex-algo path computations.

affinity flex-algo

Interface and Hardware Component

Improved ACL-based Traffic Mirroring with Capture Option Support on Cisco NC57 Line Cards

When you enable capture option on a source interface that has an ACL configured, the traffic matching the rules defined in an ACL gets captured. If the ACL configuration uses the capture keyword, but the ACL command is not configured on the source interface, then the whole interface traffic is mirrored and the capture action does not have any affect.

This option not only allows you to narrow down the traffic that you want to mirror but also enables you to troubleshooting the captured traffic for issues, such as packet drops, packet fields getting modified, virus attacks, or any other network threat.

This option is introduced in the following commands:

• permit (IPv4)

• permit (IPv6)

This feature is supported on routers that have the Cisco NC57 line cards installed that operate in the native mode.

SPAN Filtering of Outgoing Traffic on Layer 2 Interfaces for Cisco NC57 Line Cards

This release introduces SPAN filtering on the outgoing (Tx) DNS, HTTP, HTTPS, and TLS Layer 2 interface traffic. Enabling SPAN filtering on outgoing (Tx) traffic provides you more flexibility to monitor and troubleshoot the DNS, HTTP, HTTPS, and TLS traffic.

This feature introduces the following command:

• hw-module profile span-filter l2-l3-tx-enable

This feature is supported on routers that have the Cisco NC57 line cards installed that operate in the native mode.

Support for DP04CFP2-D15 Bidirectional CFP2-DCO Optical Module

In this release, support for DP04CFP2-D15 bidirectional CFP2-DCO optical module is added for NC55-MOD-A-S and NCS-55A2-MOD-S routers with the following MPAs:

• NC55-MPA-2TH-S

• NC55-MPA-1TH2H-S

The bidirectional CFP2-DCO optical module allows for data transmission and reception in both directions over a single fiber of a network, offering a cost and operationally effective method for expanding the network capacity in fiber-restricted networks.

Cisco NC57 Compatibility Mode: Y.1731

This feature is supported on routers that have the Cisco NC57 line cards installed and operate in the compatibility mode.

For more information on Y.1731, see Configuring Ethernet OAM.

IP Addresses and Services

Support for HSRP version 2 Extended Group Range

You can now use HSRP version 2, which has an expanded group IDs up to 4095 with 255 number of (IPv4 and IPv6 combined) HSRP sessions

Now, the interoperation with the other routers is supported.

Earlier, you could configure only up to 255 group IDs with 255 number of (IPv4 and IPv6 combined) HSRP sessions.

L2VPN and Ethernet Services

MAC Address Limit Configuration for Static Addresses

You can now configure the MAC address limit for bridge domains to learn only static MAC addresses and to drop traffic from unknown sources.

Malicious attackers can spoof a Layer 2 MAC address to change dynamic entries in the MAC table. However, with this functionality enabling you to configure the MAC address limit for bridge domains to learn only static MAC addresses, the dynamic MAC addresses are blocked. In addition, a static entry always overrules dynamic entries. This functionality thus prevents the interception of your data by unauthorized users and improves your network security.

Single Tagged VLAN Range Support for Double Tagged Frames

From this release, L2 subinterface configuration with single tagged VLAN range can be matched with the double tagged frames. Previously, the packet matching was done only with single VLAN ID and the double tagged packets were dropped.

With single tagged VLAN range support for double tagged frames, the traffic can reach the VLAN destination safely.

Storm Control Configuration for Subinterfaces

Storm control helps prevent LAN ports from being disrupted by a broadcast, multicast, or unicast traffic storm.

You can now configure different storm control rates for each subinterface on a physical port. This will give you control at a granular level and prevent flooding of excess traffic at the subinterface level.

In earlier releases, storm control could be configured only at the physical port level or only on one subinterface under a main interface.

This feature modifies the hw-module storm-control-combine-policer-bw enable command to enable per subinterface configuration support for storm control.

Netflow

IPFIX Enablement for SRv6 and Services over SRv6 Core

This feature provides improved information about IP traffic flows, through the introduction of sub-menus to two commands.

The record ipv6 command is modified to support a new optional keyword, srv6 .

A new subtype for ipv4 record and ipv6 record is introduced for l2-l3 records.

For more information, see:

• record ipv6

• show flow monitor-map

Modular QoS

Configure WRED Counters by Class on Cisco NCS 5700 Series Base (Non-SE) Version Line Cards

You can now view WRED statistics per class on Cisco NCS 5700 Series base (non-SE) version line cards operating in native mode. This functionality provides a more accurate and granular statistics profile for packet drops.

Increase in QoS Policer Allocation on Cisco NCS 5700 Series Line Cards

You can now allocate up to a maximum of 64000 policers for QoS by reallocating unused BGP Flowspec policer resources to QoS and increasing the QoS policer count.

With more QoS policers, you can apply policies on more sub-interfaces.

This feature is supported on NC57-18DD-SE and NC57-36H-SE line cards.

This feature introduces the following command:

• hw-module profile qos policer-scale

Licensing

Flexible Consumption Model on NCS-57D2-18DD-SYS

Flexible Consumption Model (FCM) is now extended to the NCS-57D2-18DD-SYS chassis.

Smart Licensing on NCS-57D2-18DD-SYS

Cisco Smart Licensing is a cloud-based, flexible and automated software licensing model that enables you to activate and manage Cisco software licenses across your organization. Smart Licensing solution allows you to easily track the status of your license and software usage trends.

Smart Licensing is now supported on the NCS-57D2-18DD-SYS chassis.

Smart Licensing Per Port for Segment Routing-Traffic Engineering

Cisco Smart Licensing is a cloud-based, flexible software licensing model that enables you to activate and manage Cisco software licenses across your organization. Under the Flexible Consumption Model, we have Advantage licenses which are required on top of Essential Licenses for ports that use advanced features like L3VPN.

This release allows you to allocate the Advantage licenses to the Segment Routing Traffic Engineering (SR-TE) based on the active ports under MPLS or SRV6. Before this release, when you configured SR-TE, all the ports used to consume Advantage licenses. This allows you to manage advantage licenses for SR-TE.

System Management

ITU-T G.8275.2 and Default PTP profiles over IPv6

For ITU-T G.8275.2 and the IEEE 1588 default PTP profiles, the encapsulation type for PTP packet transport is now extended to IPv6.

This feature modifies the transport command to include the keyword ipv6 .

RSP Slot Location in Syslog

When an RSP switchover occurs, the router logs the active RSP slot location in the syslog message. This helps you quickly identify the active RSP slot from your router's system log messages.

In earlier releases, the RSP switchover Syslog message didn't include the active RSP slot location.

Y.1564 Service Activation Test in Native Mode

Y.1564 - Ethernet Service Activation Test (or performance test methodology) is a testing procedure which tests service turn-up, installation, and troubleshooting of Ethernet-based services. This test methodology was created to have a standard way of measuring Ethernet-based services in the industry.

This testing procedure is now supported on Cisco Routers that have the Cisco NCS57 line cards installed and operate in the Native mode.

PTP on NC57-MPA-1FH1D-S and NCS-57D2-18DD-SYS

Based on the IEEE 1588-2008 standard, Precision Time Protocol (PTP) is a protocol that defines a method to synchronize clocks in a network for networked measurement and control systems.

PTP is now supported on the following hardware:

• NC57-MPA-1FH1D-S

• NCS-57D2-18DD-SYS

SyncE on NC57-MPA-1FH1D-S and NCS-57D2-18DD-SYS

SyncE provides synchronization signals transmitted over the Ethernet physical layer to downstream devices, while the Synchronization Status Message (SSM) indicates the quality level of the transmitting clock to the neighboring nodes, informing the nodes about the level of the network's reliability. Ethernet Synchronization Message Channel (ESMC) is the logical channel that uses an Ethernet PDU (protocol data unit) to exchange SSM information over the SyncE link.

SyncE is now supported on the following hardware:

• NC57-MPA-1FH1D-S

• NCS-57D2-18DD-SYS

System Monitoring

EEDB Resource Segregation for Encapsulation Types

We have now segregated the Egress Encapsulation Database (EEDB) resources based on different egress encapsulation types, such as attachment circuits (AC), pseudowires, tunnels, and Address Resolution Protocol (ARP). This allows you to examine encapsulation-specific resource details using show commands. When resource usage exceeds the Out of Resource (OOR) threshold levels, the router also alerts you with system log messages.

When resource usage exceeds the OOR thresholds, you can avoid traffic loss by taking corrective action to free up resources, such as reducing the scale of interfaces with the related encapsulation.

The show controllers npu resources command is now modified to include the following optional keywords:

• encapAC

• encapPWE

• encaptunnels

• encapARP

This feature is supported on Cisco 5700 Series Routers and on routers that have the NC57 line cards installed and operating in either native or compatiblity mode

System Security

Dynamic Retrieval of NETCONF Access Control Model Policies

Your router now retrieves the NETCONF Access Control Model (NACM) policies or rules on-demand for an authorized user from a remote Lightweight Directory Access Protocol (LDAP) server to validate each NETCONF operation. As the policies are stored in an external server and retrieved dynamically, this feature eliminates the need to manually update policies on a per-router basis.

Before this release, your router supported static NACM, where the NACM policies or rules were stored locally, requiring manual policy updates on each router.

This feature introduces the nacm enable-external-policies command.

IMA Enforcement

We now use Integrity Measurement Architecture (IMA) to provide a higher level of trust and runtime security for the routers. With IMA appraisal, you can detect modifications to a file or executable within the router. These modifications could be accidental or malicious, carried out remotely or locally. In addition to logging an integrity violation, the IMA policy also enforces an appraisal by blocking any operation (open or run) for a compromised executable.

IMA Enforcement is now introduced on Cisco NCS 5700 Series Routers. It is not supported on Cisco NCS 5500 Series Routers.

Secure Boot Status

You can now verify whether the router is securely booted up with an authentic Cisco software image. We have introduced a show command to verify the secure boot status of the router. If the software image was tampered with, then the secure boot fails, and the router does not boot up. Before this release, there was no provision on the router to verify the secure boot status.

The feature introduces these:

• CLI: show platform security integrity log secure-boot status command.

• YANG Data Model: Cisco-IOS-XR-attestation-agent-oper.yang Cisco native model (see GitHub)

The feature is supported only on Cisco NCS 5700 Series Routers.

Secure Boot on NCS-57D2-18DD-SYS

You can ensure that the code that executes on Cisco routers is authentic and unmodified. Cisco hardware-anchored secure boot feature protects the microloader, the first piece of code that boots up, in a tamper-resistant hardware. This functionality thereby establishes a root of trust that helps to prevent Cisco routers from executing tainted network software.

This feature is now extended to the following variant of Cisco NCS 5700 Series Router:

• NCS-57D2-18DD-SYS

Selective Authentication Methods for SSH Server

You now have the flexibility to choose the preferred SSH server authentication methods on the router. These methods include password authentication, keyboard-interactive authentication, and public-key authentication. This feature allows you to selectively disable these authentication methods. By allowing the SSH clients to connect to the server only through these permitted authentication methods, this functionality provides additional security for router access through SSH. Before this release, by default, the SSH server allowed all these authentication methods for establishing SSH connections.

The feature introduces these changes:

• CLI: New disable auth-methods command

• YANG Data Model: New XPaths for Cisco-IOS-XR-crypto-ssh-cfg.yang Cisco native model (see GitHub)

Telemetry

Stream Telemetry Data for ACL

The Access control List (ACL) is an ordered list of rules used to filter the traffic to increase network performance, and to specify the system resource access permissions either grant or deny to users or systems for security.

We have introduced the streaming of ACL statistics to monitor the traffic flow using YANG data and telemetry. It allows you to monitor dropped, matched, and denied packets of IPv4 and IPv6. In earlier releases, you could monitor ACL statistics through CLI.

This feature introduces the Cisco-IOS-XR-ipv4-acl-oper.yang and Cisco-IOS-XR-ipv6-acl-oper.yang models to capture IPv4 and IPv6 ACL statistics on Cisco Network Convergence System 5700 Series Routers.

Stream Telemetry Data for BGP FlowSpec Statistics

Use Border Gateway Protocol (BGP) FlowSpec to mitigate the effects of distributed denial-of-service (DDoS) attack over the network.

We have introduced streaming of BGP FlowSpec statistics using YANG data and telemetry. It allows you to monitor traffic flow match, drop in the traffic, or policing at definite rate for IPv4 and IPv6 parameters such as IP address, port, DSCP, and so on. In earlier releases, you could monitor BGP FlowSpec statistics through CLI.

This feature introduces the Cisco-IOS-XR-flowspec-oper.yang data models to capture BGP FlowSpec statistics such as matched, dropped, and transmitted packet count on Cisco Network Convergence System 5700 Series Routers.

View Internal TCAM Resource Utilization for Ingress Hybrid ACL

Ternary Content-Addressable Memory(TCAM) is an important and limited resource. This feature, allows you to be mindful of the usage and availability of the resource, before configuring ingress hybrid ACL.

You can now fetch the usage data through CLI and Streaming Telemetry.

This functionality modifies the following:

• CLI:

  The option status in the show controllers npu internaltcam status location command, displays the possible free and used entries.

• YANG Data Model:

  This feature uses the Cisco-IOS-XR-fia-internal-tcam-oper.yang to fetch the internal TCAM resource.