Cisco IOS XR to SONiC OS Migration

Securely migrate from Cisco IOS XR to SONiC

As part of Cisco's commitment to disaggregate hardware and software components and provide an open-source network, we have now enabled the infrastructure to securely migrate the network operating system from Cisco IOS XR to SONiC. This migration will ensure secure access to devices and integrity of software images to prevent software modification using unauthorized third-party images. While only the infrastructure is enabled in this release, the SONiC migration image will be available in the upcoming release.

Setup and Upgrade

Improved Traceability for Firmware Upgrade with User Name Display

We have made it easier for you to trace any firmware upgrade activity by enabling traceability of the user who performed the upgrade.

This feature is enabled by default.

Firmware Upgrade without restarting the device

With this release, you may now perform a firmware upgrade on QDD-400G-ZRP-S and 400G QSFP-DD ZR without having to restart the device.

This feature is enabled by default.

9600 Baud Rate on Cisco 8100 Series Routers Consoles

With this release, select variants of Cisco 8100 Series Routers support a 9600 baud rate on the console. You can deploy devices with this baud rate in networks where the async terminal baud rate is 9600. Previously, the supported baud rate was 115200. 

This rate is configured by default and supported on:

• 8101-32H

• 8102-64H

• 8101-32FH

Display SSHD process information in the bootup logs

We have updated the bootup logs on the router to display the information of SSHD process. The SSHD process is a part of the Cisco IOS XR ISO installation service.

The updated bootup log message is:

Starting IOS-XR ISO Installation including sshd...

[ OK ] IOS-XR ISO Installation including sshd.

Telemetry

FQDN as the gRPC Tunnel Destination

You can now specify a fully qualified domain name (FQDN) as gRPC tunnel destination. FQDNs are easy to remember compared to numeric IP addresses and helps to resolve the domain names to IPv4 or IPv6 address and establish tunnel towards the destination.

Model-driven telemetry and Event-driven telemetry are supported.

The feature introduces these changes:

CLI:

• The keywords address-family ipv4 and address-family ipv6 are introduced in the gRPC tunnel command.

Virtual Address as the Source IP Address of gRPC Tunnel

You can now configure a virtual address as the source IP address of gRPC tunnel. Since the virtual address refers to whichever management interface is currently active, a route processor (RP) card fail-over is managed with ease and disruptions are minimized.

Model-driven telemetry and Event-driven telemetry are supported.

The feature introduces these changes:

CLI:

• The keywords source ipv4 virtual address and source ipv6 virtual address are introduced in the gRPC tunnel command.

Programmability

Improved YANG Input Validator and Get Requests

The OpenConfig data models provide a structure for managing networks via YANG protocols. With this release, enhancements to the configuration architecture improve input validations and ensure that the Get requests made through gNMI or NETCONF protocols return only explicitly configured OpenConfig leaves.

P4Runtime to Manage Traffic Operations

With this release, the router supports Programming Protocol-Independent Packet Processors Runtime (P4), a gRPC-based service, to program the data plane elements for network operations such as sending and receiving packets between the router and the P4Runtime controller using packet I/O messages.

This feature introduces the following commands:

CLI:

• grpc p4rt

• grpc p4rt interface

• grpc p4rt location

• show p4rt devices

• show p4rt interfaces

• show p4rt state

• show p4rt stats

• show p4rt trace

YANG Data Model:

Prevent Partial Pseudo-Atomic Committed Configurations

You can now prevent the partially-committed configurations on the router and thus ensure the system database and OpenConfig datastore stay in sync.

This feature changes how the internal rollback error is handled when a pseudo-atomic commit fails. In such cases, the system database always rolls back the configuration in its datastore thereby ensuring that there is no partially-committed configuration. If there is still inconsistency, the system displays error messages to notify you of various internal rollback failure scenarios based on which you must take rectification action to re-synchronize the data.

Routing

Autonomous System Boundary Router Isolation and Adjacency Control for LSA Overflows

In a network employing an Autonomous System Boundary Router (ASBR) and other routers, you are now assured of uninterrupted traffic flow even if the ASBR generates LSAs that exceed the limit you configured. This is made possible as you can now isolate ASBRs and also control the duration of adjacency in the EXCHANGE or LOADING phase. By isolating the ASBR from its immediate neighbors, the remaining network topology can continue to function without disruption, effectively preventing any adverse impact on traffic flow. This approach also simplifies the recovery process, as manual intervention is only necessary for the immediate neighbors of the ASBR routers.

This feature introduces these changes:

CLI:

• max-external-lsa

• exchange-timer

YANG Data Model:

• Cisco-IOS-XR-ipv4-ospf-cfg.yang

• Cisco-IOS-XR-ipv4-ospf-oper.yang

• Cisco-IOS-XR-um-router-ospf-cfg.yang

(see GitHub, YANG Data Models Navigator)

Bidirectional Forwarding Detection on BVI

Now you can extend the advantage of low-overhead and short-duration detection of path failures between routers to an Integrated Routing and Bridging (IRB) deployment scenario by configuring Bidirectional Forwarding Detection (BFD) on multipath single-hop sessions using Bridge-Group Virtual Interface (BVI). By configuring BFD on a multipath session, you can apply BFD over virtual interfaces or between interfaces that are multiple hops away.

Disable IID-TLV of IS-IS Protocol Instance

You can now disable Instance Identifier Type-Length-Value (IID-TLV) in the Hello and LSP packets when multiple IS-IS protocol instances are configured on the router.

Each IS-IS instance has a unique instance-ID set, the TLV of which is sent in the Hello and LSP packets. The IID-TLV attribute helps in uniquely identifying the IS-IS protocol instance as well as the topologies to which the Protocol Data Units (PDUs) apply.

The feature introduces these changes:

CLI

New Command:

• iid disable

Modified Commands:

• The hello-padding command is extended to IS-IS process configuration mode

• The disable (IS-IS) command is modified with a new level keyword, and also extended to interface configuration mode.

YANG Data Model

• New XPaths for openconfig-isis.yang (see GitHub, YANG Data Models Navigator)

Segment Routing

Configurable Filters for IS-IS Advertisements to BGP-Link State

This feature allows you to configure a route map to filter IS-IS route advertisements to BGP-Link State (LS). It also provides a per-area configuration knob to disable IS-IS advertisements for external and propagated prefixes. This configuration of filters hence reduces the amount of redundant data for external and interarea prefixes sent to the BGP - LS clients.

The feature introduces exclude-external , exclude-interarea , and route-policy name optional keywords in the distribute link-state command.

IS-IS Partition Detection and Leakage of Specific Route Advertisements

In an open ring topology, a single fiber cut may partition the area or domain into two pieces. With summarization enabled, the area (domain) partition may result in traffic drops. Depending on the configuration in the Area Border Routers (ABRs) or Autonomous System Boundary Routers (ASBRs) that is picked as an entry point to the partitioned area (domain), the traffic is delivered to its destination or dropped as unreachable at ABR or ASBR.

IS-IS partition detection and leakage of specific route advertisements features are introduced to retain connectivity for the partitioned area (domain) when summarization is used.

The ABRs or ASBRs detect a network partition within an area (domain) and upon detection, ensure that the summary route is replaced with specific route advertisements in IS-IS.

The following command and keyword are introduced:

The feature introduces these changes:

New Command:

• partition-detect

Modified Command:

• The partition-repair keyword is introduced in the summary-prefix command.

YANG Data Model:

• New XPaths for Cisco-IOS-XR-um-router-isis-cfg.yang (see GitHub, YANG Data Models Navigator)

Label Distribution Protocol over Segment Routing Policy

This feature extends the existing MPLS Label Distribution Protocol (LDP) address family neighbor configuration to specify an SR policy as the targeted end-point, thus integrating LDP over SR-TE in core networks and enabling interoperability between LDP and SR-capable devices.

The feature introduces the neighbor sr-policy command.

Local ECMP Support on SRTE

This feature supports the top security identifier (SID) resolved route interior gateway protocol (IGP) path’s weight to be used in relative weight computation of outgoing paths of the SRTE policy.

Now ECMP supports SRTE and computes per-egress-path relative weight using underlay (IGP) weight from Forwarding Information Base (FIB) / Routing Information Base (RIB) in addition to Segment List (SL) weight and number of primary egress paths for SL. Thus, IGP load balancing required at individual paths is also maintained.

This feature is enabled by default and no configuration changes are required.

Multicast VPN: Dynamic Tree-SID Multicast VPN IPv6

This feature allows Dynamic Tree Segment Identifier (Tree-SID) deployment where IPv6 Multicast payload is used for optimally transporting IP VPN multicast traffic over the provider network, using SR-PCE as a controller. This implementation supports IPv6 only for the Dynamic Tree-SID. Currently, the Static Tree-SID supports IPV4 payloads only, not the IPv6 payloads.

Multicast: Cisco Nonstop Forwarding for Tree-SID

This feature prevents hardware or software failures on the control plane from disrupting the forwarding of existing packet flows through the router for Tree-SID. Thus, ensuring improved network availability, network stability, preventing routing flaps, and no loss of user sessions while the routing protocol information is being restored.

The feature modifies the show mrib nsf private command.

SRv6 Traffic Accounting

You can now enable the router to record the number of bytes transmitted on a specific egress interface for IPv6 traffic using the SRv6 locator counter.

You can use this data to create deterministic data tools to anticipate and plan for future capacity planning solutions.

This feature introduces or modifies the following changes:

CLI:

• CLI:

  accounting prefixes ipv6 mode per-prefix per-nexthop srv6-locators

YANG Data Models:

• Cisco-IOS-XR-accounting-cfg

• Cisco-IOS-XR-fib-common-oper.yang

(see GitHub, YANG Data Models Navigator)

SRv6 Traffic Engineering

You can now control the traffic flows within the network by defining the explicit and dynamic paths for traffic flows using the Segment Identifier (SID) within the IPv6 packet header.

Defining explicit and dynamic paths based on different attributes and constraints allow the router to optimize routing decisions and enhance resource utilization.

SRv6-TE policies supports the following functionalities:

• SRv6-TE with SRv6 micro-SIDs (uSIDs)

• Explicit SRv6 policies

• Automated steering for Layer 3-based BGP services (IPv4 L3VPN, IPv6 L3VPN, IPv4 BGP global, IPv6 BGP global)

• SRv6-aware Path Computation Element (PCE)

• PCEPv4 and PCEPv6

• Path computation optimization objectives (TE, IGP, latency)

• Path computation constraints (affinity, disjointness)

This feature introduces the following changes:

CLI:

• policy srv6 locator

• segment-routing traffic-eng srv6

• srv6 locator

• srv6 maximum-sid-depth

• segment-lists segment-list

• segment-lists srv6

YANG Data Model:

• Cisco-IOS-XR-segment-routing-ms-cfg

(see GitHub, YANG Data Models Navigator)

Static Route Traffic-Steering using SR-TE Policy

IPv4 and IPv6 static routes now leverage the SR policies to aid Segment Routing Traffic Engineering (SR-TE). This facilitates traffic steering because you can now configure IP Static Route with SR static policy.

BGP

EIBGP Policy-Based Multipath with Equal Cost Multipath and Default VRF

Now, with the inclusion of the default VRF in policy-based multipath selection, you gain control over traffic distribution and load-balancing capabilities across various BGP variations, including iBGP, eBGP, and eiBGP. This is achieved through the utilization of BGP communities, nexthops, and path types.

Additionally, by employing the equal cost multipath (ECMP) option in eiBGP, this feature provides the capability to select ECMP across the iBGP paths chosen for eiBGP.

The feature introduces these changes:

CLI:

The keywords

route-policy and equal-cost are added to the command:

maximum-paths

YANG Data Model:

• Cisco-IOS-XR-um-router-bgp-cfg

(see GitHub, YANG Data Models Navigator)

Enabling BGP Flowspec for IPv6 Packet Length

Services such as end-to-end security, quality of service (QoS), and globally unique addresses are now supported for IPv6 packet lengths, which allows your networks to scale and provides them with global reachability. Support for IPv6 packet lengths also means that, in terms of the matching criteria, support for BGP Network Layer Reachability Information (BGP NLRI) type-10 flowspec for IPv6 is added.

This feature introduces the following to enable BGP flowspec for IPv6 packet length:

• CLI: Introduces the hw-module profile flowspec ipv6-packet-len-enable command.

• YANG Data Model: New XPaths for Cisco-IOS-XR-um-8000-hw-module-profile-cfg.yang (see GitHub, YANG Data Models Navigator).

Exclusion of Label Allocation for Non-Advertised Routes

We have enabled better label space management and hardware resource utilization by making MPLS label allocation more flexible. This flexibility means you can now assign these labels to only those routes that are advertised to their peer routes, ensuring better label space management and hardware resource utilization.

Prior to this release, label allocation was done regardless of whether the routes being advertised. This resulted in inefficient use of label space.

Protection of Directly Connected EBGP Neighbors through Interface-Based LPTS Identifier

We have enhanced the network security for directly connected eBGP neighbors by ensuring that only packets originating from designated eBGP neighbors can traverse through a single interface, thus preventing IP spoofing. This is made possible because we've now added an interface identifier for Local Packet Transport Services (LPTS). LPTS filters and polices the packets based on the type of flow rate you configure.

The feature introduces these changes:

CLI:

• bgp lpts-secure-binding

YANG Data Model:

• Cisco-IOS-XR-um-router-bgp-cfg

  (see GitHub, YANG Data Models Navigator)

Interface and Hardware Component

Designate a Member Link as Unviable

Earlier, when a member link is added to an interface link bundle, the peer starts using the link as soon as the LACP communication is up. Sometimes, the hardware programming for the data-path does not get complete in this time resulting in packet loss without any notification to the source.

You can now mark a member link as unviable to introduce a delay during which the link is treated as standby. By delaying the usage of the member link for data transmission, you can ensure that the link configuration is fully established, which enables successful data transmission.

This feature introduces these changes:

• CLI: forwarding-unviable

• YANG Data Model: New XPath for Cisco-IOS-XR-bundlemgr-oper (see Github, YANG Data Models Navigator).

Extended Support for DP04QSDD-HE0 Optical Module

This release introduces support for the Cisco 400G QSFP-DD High-Power (Bright) Optical Module DP04QSDD-HE0, Ethernet Variant on the Cisco 8608 router.

IP Addresses and Services

ACL Log Message Collection for Egress Traffic

We have made it easier for you to monitor ACL egress traffic, assess traffic load on an ACL, and troubleshoot issues. This is made possible by adding a log option to the ACEs that are associated with an interface and identify the packet counts matching the ACEs. With this log option, for an egress traffic, you can fetch information, such as access list number, packets permitted or denied, and source or destination addresses of the packets.

Authentication Header (AH) and Encapsulating Security Payload (ESP) Headers Support in User Managed Control Plane and Management Plane ACLs

We’ve enhanced our traffic security by introducing the Authentication Header (AH) and Encapsulating Security Payload (ESP) IPv6 headers in the IPv6 ACLs. While AH provides data integrity and data origin authentication, ESP is for data confidentiality.

You can configure ingress IPv6 ACL extensions for AH and ESP headers to permit or deny packets. These protocols ensure that the sensitive information travelling on the network reaches its destination safely.

Egress Hybrid ACL Support

From this release onwards, you can apply compression levels for object-group ACLs, also known as hybrid ACLs, at the egress traffic. Because ACL compression optimizes TCAM space usage, it enables the router to accommodate additional ACLs or features.

MPLS

MPLS MTU

You can now enforce the size of MPLS frames in your MPLS network by configuring the MPLS MTU of the MPLS interface. This enables interworking with routers from other vendors that have a strict MPLS MTU enforcement. When a transit packet exceeds the MPLS MTU, the router either fragments the packet or drops it.

Cisco 8000 Series Routers and Line Cards with Cisco Silicon One Q200, Q201, or Q202 ASIC support this feature.

In earlier releases, Cisco 8000 Series Routers didn’t support MPLS MTU feature. While interworking with other routers that had MPLS MTU configured, the Cisco 8000 Series Router sent packets exceeding the MPLS MTU of those router interfaces. This resulted in packet drops at the peer routers.

You can configure MPLS MTU with either CLI or YANG data model:

CLI:

• mpls mtu

YANG Data Model:

• Cisco-IOS-XR-um-if-mpls-cfg.yang (see GitHub, YANG Data Models Navigator)

Automatic Bandwidth Bundle TE++ for Numbered Tunnels

We have optimized network performance and enabled efficient utilization of resources for numbered tunnels based on real-time traffic by automatically adding or removing tunnels between two endpoints. This is made possible because this release introduces support for auto-bandwidth TE++ for numbered tunnels, expanding upon the previous support for only named tunnels, letting you define explicit paths and allocate the bandwidth to each tunnel.

The feature introduces these changes:

• CLI:

  The auto-capacity keyword is added to the interface tunnel-te command.

• YANG Data Model:

  New XPaths for Cisco-IOS-XR-mpls-te-cfg.yang (see GitHub, YANG Data Models Navigator)

Netflow

sFlow Agent Address Assignment

You can now monitor traffic from a specific source by configuring the sFlow agent ID with the specific IPv4 or IPv6 address.

Upon configuration, you can determine the source of the sFlow data.

Earlier, by default, the sFlow agent ID had the source address of the sFlow export packet.

The feature introduces these changes:

CLI

New Command:

• router-id

Modified Command:

• The show flow exporter-map command is modified to display flow exporter map with router-id information.

YANG Data Model

• New XPaths for openconfig-sampling-sflow.yang (see GitHub, YANG Data Models Navigator)

System Security

Display Username for Failed Authentication for Telnet Protocols

With this feature, we have enhanced the security of the routers and introduced better tracking functionality to the router.

The failed authentication sys log now displays the details of users who tried to log in but failed due to authentication failure.

With this feature provisioned, the router can now display the user ID of both SSH and Telnet protocols.

In earlier releases, this feature was available only for SSH protocol.

This feature introduces the following change:

CLI: aaa display-login-failed-users .

YANG DATA Model: New XPaths for Cisco-IOS-XR-um-aaa-task-user-cfg (see Github, YANG Data Models Navigator)

Extend Device Ownership

Your router can now run in a dual-ownership mode wherein you can securely migrate the operating system from Cisco IOS XR to third-party software such as SONiC. You can only install the signed SONiC image authorized by Cisco using an ownership voucher (OV) and authenticated variables (AV) on the router. This authorization prevents tampering with the software using unauthorized third-party images.

Multi-Tier Certificate Authority for Trustpoint Authentication

Apart from the root certificate authority (CA), you can now use a subordinate CA to issue certificates and authenticate your network devices. This feature is beneficial when you have an existing CA hierarchy where it is not the root CA but the subordinate CA that issues the leaf or router certificates.

In earlier releases, you could associate only a single CA, not a multi-tier CA, to a trustpoint. And, you could use only the root CA certificate to enroll the router certificates.

This feature modifies the show crypto ca certificates command to display the Trusted Certificate Chain field.

Public Key-Based Authentication of SSH Clients on Cisco IOS XR Routers

You are now assured of cryptographic strength even as you avail of automated password-less login while establishing SSH connections with the server. With the password and keyboard-interactive authentication, Cisco IOS XR routers configured as SSH clients now support public key-based authentication. In this authentication method, passwords need not be sent over the network; hence, it provides an additional layer of security and aids in automation processes. This feature is available only for users locally configured on the router; not those configured on remote servers.

Previous releases supported SSH public key-based authentication only for Cisco IOS XR routers configured as SSH servers.

The feature introduces these changes:

• CLI:

  • crypto key generate authentication-ssh rsa

  • crypto key zeroize authentication-ssh rsa

  • show crypto key mypubkey authentication-ssh rsa

• Yang Data Models:

  New Xpaths for:

  • Cisco-IOS-XR-crypto-act.yang

  • Cisco-IOS-XR-crypto-cepki-new-oper.yang

  (see GitHub, YANG Data Models Navigator)

System Management

Auto-Save and Copy Router Configuration Using Public Key Authentication

You can now experience passwordless authentication while automatically saving running configurations and securely copying them on the router. The feature uses public key-based authentication, a secure logging method using a secure shell (SSH), which provides increased data security. This feature offers automatic authentication and single sign-on benefits, which also aids in a secure automation process.

The feature introduces these changes:

CLI:

• The configuration commit auto-save command supports password-less authentication.

• The copy command supports password-less authentication.

Programmability

Cisco-IOS-XR-accounting-cfg

We have introduced this Cisco native data model to enable the router to record the amount of data transmitted between every pair of network routers using the SRv6 locator counter.

Cisco-IOS-XR-fib-common-oper

We have modified this Cisco native data model to view SRv6 locator counters.

Cisco-IOS-XR-crypto-act.yang

The following new leaves are added to this Cisco native data model to enable public key-based authentication of users on Cisco IOS XR routers that are configured as SSH clients:

• key-generate-authentication-ssh-rsa-keys

• key-zeroize-authentication-ssh-rsa

Cisco-IOS-XR-crypto-cepki-new-oper.yang

A new container, auth-ssh-keys, is added to this Cisco native data model to display the details of SSH RSA cryptographic keys that are used for public key-based authentication of users on Cisco IOS XR routers that are configured as SSH clients.

Cisco-IOS-XR-um-aaa-task-user-cfg

A new container, display-login-failed-users, is added to this Cisco unified data model to display username of the users who tried to log in to the router using invalid credentials, in the system logs.

openconfig-platform-port.yang Version 0.4.2

The OpenConfig data model is used to configure and retrieve operational data for the port components such as port breakouts, the number of interfaces using this breakout group and the number of lanes or physical channels assigned to the interfaces in this breakout group.

You can stream Model-driven telemetry data for the operational state of the port components.

openconfig-ospfv2.yang Version 0.4.0

The OpenConfig data model is introduced as part of the openconfig-network-instance.yang data model to configure OSPF functionalities, such as multiple processes, areas, and interfaces.

Event-driven telemetry and Model-driven telemetry are not supported.

openconfig-acl.yang Version 1.2.2

The OpenConfig data model is revised from version 1.2.0 to 1.2.2 to retrieve operational state data for network access control lists using YANG Get requests. You can now view the operational state data of the acl along with the packet matches.

Model-driven telemetry data is supported.

openconfig-isis.yang

The OpenConfig data model defines the configuration and state information related to ISIS protocol configuration running on a router. With this release, you can configure the following XPaths:

openconfig-network-instance/network-instances/network-instance/protocols/protocol/isis/interfaces/interface/

• config/hello-padding: controls the padding type for IS-IS Hello PDUs.

• mpls/igp-ldp-sync/config/enabled: synchronisation between the LDP and IS-IS.

• levels/level/hello-authentication/config/keychain: refers to a keychain that should be used for hello authentication.

• enable-bfd/config/enabled: when this leaf is set to true, BFD is used to detect the liveliness of the remote peer or next-hop.

• levels/level/config/enabled: when set to true, the functionality within which this leaf is defined is enabled and when set to false it is explicitly disabled.

openconfig-network-instance/network-instances/network-instance/protocols/protocol/isis/

• global/mpls/igp-ldp-sync/config/enabled: synchronization between the LDP and IS-IS.

• global/config/maximum-area-addresses: supports maximum area.

• globalconfig/Iid-tlv: (ISIS Instance Identifier TLV) when set to true, the IID-TLV identifies the unique instance as well as the topology/topologies to which the PDU applies.

• levels/level/authentication/config/keychain: refers to the keychain that should be used for authenticating IS-IS packets.

Event-driven and Model-driven telemetry is supported.

openconfig-sampling-sflow.yang Version 1.1.0

The OpenConfig data model defines the sampling mechanisms implemented in an sFlow agent for monitoring traffic. This data model augments the openconfig-sampling.yang model. The model is revised from version 0.1.0 to 1.0.0 with the following XPaths:

• openconfig-sampling-sflow:sampling/sflow/config/

  • agent-id-ipv4 and agent-id-ipv6: to configure the agent identifier (ID) with IPv4 or IPv6 address for all collectors. These XPaths are not mandatory. If they are not configured, then the router picks the source-address as the agent ID.

  • polling-interval: to configure an interface counter polling-interval for all sFlow enabled interfaces.

  • ingress-sampling-rate and egress-sampling-rate: to set the ingress and egress packet sampling rate respectively.

  • dscp: DSCP marking of sFlow export packets generated by the sFlow subsystem on the network device.

• openconfig-sampling-sflow:sampling/sflow/collectors/collector/config/

  • source-address: to set the source IPv4 or IPv6 address for sFlow datagrams sent to sFlow collectors. In this release, the XPath is moved from the config container to collectors container. Upon configuration, the flow exporter-map associated with this collector gets the source-address configuration. Earlier, by default, the sFlow agent ID had the source address of the sFlow export packet.

• openconfig-sampling-sflow:sampling/sflow//interfaces/interface/config/

  • ingress-sampling-rate and egress-sampling-rate: to set the ingress and egress packet sampling rate respectively. In the absence of ingress sampling rate configuration at the interface level, the global ingress-sampling-rate will be used. For egress sampling on the interface, egress-sampling-rate must be used.

Model-driven telemetry is supported.

openconfig-system-grpc.yang Version 1.0.0

The OpenConfig data model is revised from version 0.1.1 to 1.0.0. This version enables the gRPC server to listen on any IP address bound to an interface and port of the system or listen for any specific list of IP addresses. The maximum number of supported IP addresses are 32, which may be IPv4 or IPv6, or both.

Earlier, the gRPC server had the listen functionality for any IP address on the gRPC port but not to a specific list of listen addresses.

Event-driven telemetry and Model-driven telemetry are supported.

openconfig-system.yang Version 0.13.1

The OpenConfig data model is revised from version 0.12.0 to 0.13.1 to configure and retrieve the domain-name-server (DNS) processes running on the router.

This version enables you to configure DNS processes using the following XPaths:

openconfig-system:system/

• config/domain-name: Domain-name of the requested process

• dns/servers/server/config/address: IP address of the DNS server (IPv4 or IPv6)

• dns/host-entries/host-entry/config/ipv4-address: Host IPv4 addresses (up to 8 IPv4 addresses)

• dns/host-entries/host-entry/config/ipv6-address: Host IPv4 addresses (up to 4 IPv6 addresses)

• dns/host-entries/host-entry/config/hostname: Host-name for static DNS entry

You can now collect the DNS processes information for one or more processes using Model-driven telemetry.

This version enables you to collect information of DNS processes using the following XPaths:

openconfig-system:system/

• state/domain-name

• dns/servers/server/state/address

• dns/host-entries/host-entry/state/ipv4-address

• dns/host-entries/host-entry/state/ipv6-address

• dns/host-entries/host-entry/state/hostname

• dns/servers/server/state/port: Port number of DNS server (default value: 53)

• dns/state/search: Ordered list of domains to search when resolving a host name

openconfig-policy-forwarding.yang Version 0.5.0

This OpenConfig data model is part of the openconfig-network-instance.yang model that configures the actions to be performed on an inbound traffic when a packet matches the conditions defined in the policy-map.

The OpenConfig data model is revised from version 0.4.0 to 0.5.0.

This version introduces these changes:

• New XPaths decapsulate-gue and decapsulate-gre are added for GUEv4 and GREv4 decapsulating actions respectively based on enhanced packet match criteria. The policy type should be PBR_POLICY.

• The XPath /ipv4/config/protocol is extended to allow the two new values: UDP and GRE to enable GUEv4 and GREv4 configurations respectively.

• An extended model, Cisco-IOS-XR-openconfig-policy-forwarding-ext.yang to manage the GUEv4 and GREv4 configurations.

Model-driven telemetry is supported.

openconfig-platform-integrated-circuit.yang

The OpenConfig data model defines extensions to the OpenConfig platform model that apply to integrated circuit components. These components are generically forwarding NPUs or ASICs within the system for which the configuration or state is applicable.

In this release, you can access a particular integrated circuit to know the available forwarding capacity across the backplane of NPUs or ASICs. The following XPaths helps to identify if there is an issue in the line card or any drop in traffic and steer the traffic out of the line card:

openconfig-platform-integrated-circuit:/backplane-facing-capacity/state/

• Total

• total-operational-capacity

• consumed-capacity

• available-pct

Model-driven telemetry is supported.

openconfig-qos.yang Version 0.x.0

The OpenConfig data model defines the configuration to avoid network congestion using queuing mechanism. The updated version of this model enables you to configure the priority schedulers and the queue of packets on the interface using the following XPaths:

openconfig-qos/

• scheduler-policies/scheduler-policy/schedulers/scheduler/inputs/input/config/weight: For priority schedulers, this indicates the priority of the corresponding input. Higher values indicate higher priority. For weighted round-robin schedulers, this leaf indicates the weight of the corresponding input.

• queue-management-profiles/queue-management-profile:

  • config/name

  • wred/uniform/config/min-threshold

  • wred/uniform/config/max-threshold

  • wred/uniform/config/enable-ecn

  • red/uniform/config/min-threshold

  • red/uniform/config/max-threshold

  • red/uniform/config/enable-ecn

These XPaths specifies how packets are ECN marked or dropped for a particular instance of a queue on a particular interface, for example, if RED or WRED is applied to manage the queue's occupancy.

openconfig-aft.yang Version 0.6.0

The Abstract Forwarding Table (AFT) OpenConfig data model is enhanced to support the following features:

• The gRPC Network Management Interface (gNMI) proto is revised from version 0.7.0 to 0.8.0 to set the atomic flag to send AFT next-hop group notifications in JSON and PROTO encodings using gNMI subscribe RPC. Network events can be represented as multiple updates in the data models. The atomic flag allows NMS to interpret those multiple updates as a single event.

• The nodes next-hop-group/state and next-hops/next-hop defines a list of next-hop addresses and a tunnel type for packets that match the specified criteria.

Model-driven telemetry and Event-driven telemetry is supported.

Cisco-IOS-XR-um-router-isis-cfg.yang

The latest update to the Cisco-IOS-XR-um-router-isis-cfg.yang unified data model includes the addition of the partition-detect and partition-repair containers. These new containers indicate the configuration of the partition-detect and partition-repair nodes.

openconfig-qos.yang Version 0.5.0

The OpenConfig data model defines the configuration to avoid network congestion using queuing mechanism. The updated version of this model enables you to configure the priority schedulers and the queue of packets on the interface using the following XPaths:

openconfig-qos/

• scheduler-policies/scheduler-policy/schedulers/scheduler/inputs/input/config/weight: For priority schedulers, this indicates the priority of the corresponding input. Higher values indicate higher priority. For weighted round-robin schedulers, this leaf indicates the weight of the corresponding input.

• queue-management-profiles/queue-management-profile/:

  • config/name

  • wred/uniform/config/min-threshold

  • wred/uniform/config/max-threshold

  • wred/uniform/config/enable-ecn

  • red/uniform/config/min-threshold

  • red/uniform/config/max-threshold

  • red/uniform/config/enable-ecn

These XPaths specifies how packets are ECN marked or dropped for a particular instance of a queue on a particular interface, for example, if RED or WRED is applied to manage the queue's occupancy.

Model-driven telemetry is supported.