The SPAN to File feature is an extension of the pre-existing SPAN feature in traffic mirroring. SPAN over File allows packets of network data to be mirrored to a file instead of an interface, so that they can be analysed at a later stage. The file format is PCAP, so that it can be easily used with tools such as tcpdump or wireshark.

See SPAN to File.

This feature introduces support for Two-Way Active Measurement Protocol (TWAMP) Light (RFC5357) for link delay and SR policy delay measurement. TWAMP Light adds two-way or round-trip measurement capabilities.

Network performance data such as packet loss, delay and delay variation, and bandwidth utilization is a critical measure for Traffic Engineering (TE). This data provides service providers the characteristics of their networks for performance evaluation that is required to ensure the Service Level Agreements (SLAs). The performance measurement and delay variation feature allows you to measure those metrics and advertise them through IGP extensions as extended TE metrics.

See Configure Performance Measurement.

IPv4 and IPv6 SR policies can be advertised over BGPv4 or BGPv6 sessions between the SR-TE controller and the SR-TE headend. In earlier releases, Cisco IOS-XR implementation supported the following combinations:

• IPv4 SR policy advertised over BGPv4 session

• IPv6 SR policy advertised over BGPv4 session

• IPv6 SR policy advertised over BGPv6 session

This release introduces support for IPv4 SR policy advertised over BGPv6 session.

See BGP SR-TE.

The EVPN Port-Active Multhoming feature supports single-active redundancy load balancing at the port-level or at the interface-level. You can use this feature when you want to forward the traffic to a specific interface, rather that have a per-flow load balancing across multiple PE routers. This feature provides a faster convergence during a link failure. This feature enables protocol simplification as only one of the physical ports is active at a given time. You can enable this feature only on bundle interfaces.

See the EVPN Port-Active Multihoming.

Generic UDP Encapsulation (GUE) is a UDP-based network encapsulation protocol that encapsulates IPv4 and IPv6 packets. GUE provides native UDP encapsulation and defines an additional header to determine the payload carried by the IP packet. Encapsulating packets using UDP facilitates efficient transport across networks and significant performance benefits for load-balancing.

See Configuring Generic UDP Encapsulation.

The PCE Support for MPLS-TE LSPs feature allows Cisco's SR-PCE to act as a Path Computation Element (PCE) for MPLS Traffic Engineering Label Switched Paths (MPLS-TE LSPs).

See PCE Support for MPLS-TE LSPs.

The Cisco IOS XR 7.1.2 Release introduces Hardware based timestamp using TWAMP. This feature provides greater accuracy than other time synchronization protocols which enables the service providers to achieve microsecond precision and better performance at scale.

See Hardware Timestamp Using TWAMP.

The Access Pseudowire Redundancy feature allows you to configure a backup pseudowire under the bridge domain. When the primary pseudowire fails, the provider edge (PE) router switches to the backup pseudowire. The primary pseudowire resumes operation after it becomes functional. The primary pseudowire fails when the PE router fails or when there is a network outage.

See Access Pseudowire Redundancy.

File mirroring feature enables the router to copy files or directories automatically from /harddisk:/mirror location in active RP to /harddisk:/mirror location in standby RP or RSP without user intervention or EEM scripts.

See Introduction to File Mirroring.

Generic Routing Encapsulation (GRE) Tunnel configuration support is added to oc-interfaces data model. This data model is used to manage network interfaces and subinterfaces.

Obtain this data model from Github repository.

See New and Changed Programmability Features.

The openconfig-network-instance (oc-ni) data model is defined by OpenConfig community. This model defines the network instance concept to model Layer 3 and Layer 2 network instances applicable for services such as L3VPN, L2VPN, and EVPN.

The table-conection container in the oc-ni data model contains policies that dictate how routing information base (RIB) or forwarding information base (FIB) entries are propagated between routing tables.

The leaf list consists of a list of connections between pairs of routing or forwarding tables, the leaking of entries between which is specified by the import policy. A connection connecting a source table to a destination table implies that routes that match the policy specified for the connection are available for the destination protocol to advertise, or match within its policies. It shows the configuration and state parameters that relate to the connection between tables.

The oc-ni data model is available in the Github repository.

See New and Changed Programmability Features.

With the introduction of this feature, you can set both qos-group and DSCP values within the same QoS policy that is applied in the ingress direction. You can use any permitted value to set the qos-group value.

To set the possible DSCP values for set dscp, configure these values using the following command:

RP/0/RP0/CPU0:ios(config)# hw-module profile qos qosg-dscp-mark-enable 13 15

In the preceding example, only the set dscp 13 and set dscp 15 values are allowed in any QoS policy that contains both set qos-group and set dscp configurations.

Note	Ensure that you reload the router for the hw-module command to be functional.

See Setting QoS-group and DSCP at Ingress.

The command, hw-module profile qos qosg-dscp-mark-enable is introduced.

Support is introduced in Cisco-IOS-XR-wdsysmon-fd-proc-oper.yang data model with process keys to poll specific processes and stream telemetry data.

See New and Changed Programmability Features.

OCNI BGP data model has global, neighbor and peer-group containers. Under the neighbor container are the Address Family Identifier (AFI) state-related leaves. Three leaves (sent, installed and advertised prefix count) are related to the prefixes received from and advertised to the neighbor specific to that AFI. The sent count is defined as how many prefixes are sent to the neighbor for a specific AFI.

In the existing implementation, the cumulative count may not display accurate value owing to various conditions such as route-refresh out, policy changes, route-target changes, configuration changes like nexthop-self to name a few.

In this release, BGP walks through the prefix table calculating exactly how many prefixes are advertised for each neighbor. The results are collected in an array, converted and sent to MDT.

Obtain this data model from Github repository.

See New and Changed Programmability Features.

You can subscribe to Sysadmin data models for streaming telemetry data.

The sensor-path Cisco-IOS-XR-sysadmin-show-media:ShowMedia/all-locations support is enabled for telemetry on all platforms that have sysadmin container.

See New and Changed Programmability Features.

This feature allows MPLS static forwarding over a single-pass GRE tunnel at line rate. One use case is for sending incoming customer traffic over the GRE tunnel, addressed to an anycast virtual IP address (VIP) destination shared by a set of load balancing servers.

See MPLS Over Single-Pass GRE Tunnels.

Y.1564 or Ethernet Service Activation (or performance test methodology) is a testing procedure which tests service turn-up, installation and troubleshooting of Ethernet-based services.

This feature is now supported on NCS-55A2 Series routers.

Y.1564 allows simultaneous testing of multiple Ethernet services and measures. It validates the different service level agreements (SLAs) to ensure the service meets guaranteed performance settings in a controlled test time. It helps to ensure all the services carried by the network meet the SLA objectives at the maximum committed rate proving that under maximum load, the network devices and paths can support the traffic as designed, even under stress.

See Y.1564 - Ethernet Service Activation Test.

You must follow these guidelines while enabling FIPS mode:

• You must configure the session with a FIPS-approved cryptographic algorithm. A session configured with non-approved cryptographic algorithm for FIPS (such as, MD5 and HMAC-MD5) does not work. This is applicable for OSPF, BGP, RSVP, ISIS, or any application using key chain with non-approved cryptographic algorithm, and only for FIPS mode (that is, when crypto fips-mode command is configured).

• If you are using any HMAC-SHA algorithm for a session, then you must ensure that the configured key-string has a minimum length of 14 characters. Otherwise, the session goes down. This is applicable only for FIPS mode.

• If you try to execute the telnet configuration on a system where the FIPS mode is already enabled, then the system rejects the telnet configuration.

• If telnet configuration already exists on the system, and if FIPS mode is enabled later, then the system rejects the telnet connection. But, it does not affect the telnet configuration as such.

• It is recommended to configure the crypto fips-mode command first, followed by the FIPS-related commands in a separate commit. The list of commands related to FIPS with non-approved cryptographic algorithms are:

  • key chain key-chain-name key key-id cryptographic-algorithm MD5

  • key chain key-chain-name key key-id cryptographic-algorithm HMAC-MD5

  • router ospfv3 1 authentication ipsec spi 256 md5 md5-value

  • router ospfv3 1 encryption ipsec spi 256 esp des des-value

  • router ospfv3 1 encryption ipsec spi 256 esp des des-value authentication md5 md5-value

  • snmp-server user username usergroup-name v3 auth md5 priv des56

  • ssh server algorithms key-exchange diffie-hellman-group1-sha1

  • telnet vrf default ipv4 server max-servers server-limit

You must follow this guideline while configuring MACsec:

• The MACsec key IDs (configured through CLI using the macsec key command under the key chain configuration mode) are considered to be case insensitive. These key IDs are stored as uppercase letters. Whereas, prior to this release, the key IDs were treated as case sensitive. These key IDs are now stored as uppercase letters. Whereas, prior to this release, the key IDs were treated as case sensitive. Hence, two key IDs with the same value, but of different case (one in uppercase and other in lowercase) were treated as two separate IDs in previous releases. However, the support for this case insensitive IDs is applicable only for the configurations done through CLI, and not for configurations done through Netconf protocol. Hence it is recommended to have unique strings as key IDs for a MACsec key chain to avoid flapping of MACsec sessions.

  For more information, see Guidelines for Configuring MACsec Keychain.

Cisco IOS XR Release 7.1.2 introduces the command logging format bsd which enables the router to send system log messages to a remote server in BSD (Berkeley Software Distribution) format. This enables systems that are dependent on the BSD format to correctly interpret the log message.

The command, logging format bsd is introduced.