BGP

Scaling BGP Flowspec to 32K Entries

You can now assign 32K BGP Flowspec entries, thus increasing the number of matches and actions covered.

In earlier releases, you could configure 16K BGP Flowspec entries.

This feature introduces the following command:

stats resource-reassign

The following command is deprecated with this feature:

hw-module profile stats j2-dynamic-stats

Programmability

Accounting Records for NETCONF Operations

Depending on the accounting configuration command you use, every NETCONF operation that the router performs is reported to the local server as syslog messages or remote AAA servers like TACACS+ as accounting messages, or both.

Interface and Hardware Component

CFM and Y1731 on VPLS over BGP Signaling

VPLS over BGP Signaling services supports CFM continuity check, ITU-T Y.1731 compliant Delay Measurement Message (DMM), and Synthetic Loss Measurement (SLM) functions.

This feature allows you to effectively manage a network with L2VPN services running VPLS using BGP AD.

VLAN Subinterface as Ingress or Egress Source for Traffic Mirroring

You can now configure the VLAN subinterface as an egress or ingress source for traffic mirroring, enabling monitoring of traffic mirrored on either egress or ingress or both directions.

You could configure mirror functionality only at the main interface level in earlier releases.

CFM Monitoring on EVPN

Ethernet Connectivity Fault Management (CFM) is a service-level OAM protocol that provides tools for monitoring and troubleshooting end-to-end Ethernet services per VLAN. With this release, CFM over EVPN is supported on routers that have Cisco NC57 line cards installed and operate in compatibility mode.

Local LAG hashing with PPPoE traffic

Load Balancing for Link Aggregation (LAG) AC and Equal Cost Multipath (ECMP) for PPPoE traffic is now available on Cisco NCS 5700 series fixed-port routers with Cisco NC57 line cards installed and operating in the native and compatible modes. This load balancing is achieved by distributing PPPoE traffic on all available links.

Accurate Display of Interface Capacity

This enhancement enables you to utilize the correct capacity of the bundle interfaces by using the show interface command, thus allowing you to plan for and operate your network bandwidth effectively. In earlier releases, 64 X 100GE interfaces displayed a maximum interface capacity of 4.2 Tbps instead of 6.4 Tbps.

SPAN over PW

Pseudowire-Switched Port Analyzer (PW-SPAN) is now available on Cisco NCS 5500 series modular routers with Cisco NC57 line cards installed or Cisco 5700 series fixed-port routers operating in the native mode.

You can mirror designated traffic on the source port over a pseudo-wire to a central location with PW-SPAN. This functionality, also known as pseudo-wire traffic mirroring, allows the centralization of expensive network traffic analysis tools.

IP Addresses and Services

ACL-Based Policing

You can control the traffic that an access control entry (ACE) allows in the ingress direction by configuring the policing rate for the ACE in an IPv4 or IPv6 Hybrid ACL. This functionality limits packet rates and takes different actions for different packets.

The following commands are modified in this feature:

• permit (IPv4)

• permit (IPv6)

• show access-lists ipv4

• show access-lists ipv6

Enable Ingress Interface Logging on ACE

Using the log-input keyword, you can now enable Access Control Entries (ACEs) to generate log messages that help you identify the interface through which a particular traffic stream ingresses the routers. This information aids in optimizing traffic flow across the network.

There was no option to enable logging of ingress interfaces with an ACE in earlier releases. This feature introduces an optional keyword log-input for the following commands:

• permit (IPv4)

• permit (IPv6)

• deny (IPv4)

• deny (IPv6)

Increased Ingress ACLs

You can now configure an increased number of either traditional (non-compression) or hybrid (compression) ingress ACLs in shared ACL mode, as listed below:

• A maximum of 512 different traditional ingress ACLs per line card.

• A maximum of 1000 different hybrid ingress ACLs per line card.

Increased ACLs provide you with enhanced traffic filtering capabilities to control how traffic packets move through the network and restrict the access of users and devices to the network.

In earlier releases, you could configure up to 127 different traditional ingress ACLs and 255 different hybrid ingress ACLs in shared ACL mode per line card.

Apart from IPv4 ACLs, this enhancement is also applicable for:

• IPv6 ACLs

• Chained ACLs

ACL Chaining with ACL Based Forwarding (ABF)

You can now enable ABF in conjunction with ACL chaining in Common ACL. With this feature, the router can inspect and forward the packets based on the ABF rule in Common ACL.

In earlier releases, ABF and ACL chaining with Common ACL were mutually exclusive features.

Scaling to higher LPTS entries using eTCAM

Implementing LPTS infrastructure using external TCAM (eTCAM) is supported on Cisco NCS 5700 series fixed-port routers and the Cisco NCS 5500 series routers that have the Cisco NC57 line cards installed and operating in the native mode. With this functionality, the LPTS routing packet entries are scaled to 12000. This helps in scaling the other protocol entries up to 1.5 times the current scale.

IPV6-Neighbor Discovery proxy

IPV6-Neighbor Discovery proxy on the interface allows the hosts on the same subnet prefix to communicate, which are separated by the L2 broadcast domain. You can configure it with the ipv6 nd proxy-nd command or disable this feature with the no ipv6 nd proxy-nd command. This proxy feature provides faster and safer communication between the hosts on the same subnet prefix.

L2VPN and Ethernet Services

Configurable Recovery Time for EVPN Core Isolation Group

You can now configure the recovery time for the EVPN core isolation group after the core interfaces recover from a network failure. This functionality is important because post-failure recovery, you can provide sufficient time for the EVPN PE nodes to relearn the MAC addresses and BGP routes received from the remote PEs. There's also time to handle delays in exchanging EVPN routes after recovery.

This feature introduces the core-de-isolation  command under the EVPN Timers configuration mode.

MSTP and PVRST

This feature is now supported on routers that have Cisco NC57 line cards installed and operate in native and compatibility modes.

Hierarchical EVPN Access Pseudowire

You can configure EVPN VPWS in the access node under the same bridge domain as EVPN in the core to build a PW to the nearest high-end PE that stitches those access circuits using EVPN. This allows the access nodes to leverage the benefits of EVPN.

This feature also allows you to reduce the number of pseudowires (PWs) between the network provider edge (N-PE) devices by replacing PE devices with user provider edge (U-PE) and network provider edge (N-PE) devices. This feature prevents signaling overhead and packet replication.

Enhancement to the show ethernet cfm command to include LTR and LTM statistics

This enhancement adds statistics for Linktrace Messages (LTM) and Linktrace Replies (LTR) in the show ethernet cfm local meps verbose command output. Using LTM and LTR count, you can trace the source of network failure and track the path to a unicast destination MAC address.

Flow-Label Support on FAT-PW

This enhancement enables the MPLS OAM pings to work between Cisco devices and the third-party devices. Thus, allowing Flow-Aware Transport (FAT) Pseudowires (PW) to provide the load-balance capability across equal-cost multipath (ECMP) routes by adding a new label, called Flow Label, onto the bottom of the label stack.

MPLS

Enhanced Targeted LDP Session Scale Values

With the unidimensional scale parameter value increased to 1999 on the router, you can now configure more targeted LDP sessions to discover extended neighbors.

Multicast

Access Pseudowire in VPLS Bridge Domains

You can configure EVPN in the access node under the same bridge domain as EVPN in the core and create a pseudowire (PW) to the nearest PE that binds the access circuits using EVPN. This PW between the access PE and the single-homed PE ensures that the access nodes can leverage the benefits of EVPN.

Modular QoS

Egress Traffic Management

The egress traffic management model employs a two-pass model per NPU core to get up to 50% of NPU core bandwidth as recycle bandwidth. VOQ lookup takes place in the second pass to get the outgoing interface or sub-interface VOQ. This lookup at the second pass enhances the egress queuing policy by making the feature-rich ingress pipeline available to the outgoing traffic.

Also, this functionality is configurable at the port level and not at the global level. This approach limits the usage of VOQ connectors required on all ingress devices to only physical ports or main interfaces, thus enabling scaling of egress QoS policies.

This functionality introduces the mode etm option for the controller optics command.

Low Rate Shaper

This functionality allows your hardware to program low shaper bandwidth with accuracy. Earlier, if one of your customers wanted, say, a bandwidth of 500 kbps, the Cisco NC 57 line card ASIC could only program a minimum bandwidth of 3.9 Mbps for a particular traffic class, resulting in unnecessary wastage of bandwidth. With low shaper rates now made possible, you can limit bandwidth for specific subscribers whose requirements don’t call for excessive bandwidth. This functionality thus allows you to save on your bandwidth costs.

This functionality is only available for and automatically enabled in the egress traffic management mode.

MPLS EXP Marking for EVPN Multi-Homed Services

This feature enables you to differentiate traffic in the MPLS forwarding domain and manage traffic from ingress PE to egress PE based on the MPLS EXP bit of the MPLS header for EVPN multi-home scenarios.

Routing

32 IS-IS Instances

You can now configure up to 32 IS-IS instances, thus enhancing the ability to isolate resources within your router and on the network. This ability enables you to configure more instances consuming network-wide resources at different rates, giving you more flexibility to manage your networks efficiently.

In earlier releases, you could configure up to16 IS-IS instances.

MPLS TE Preference for Tunnels

You can now configure the MPLS TE traffic for equal-cost multipath (ECMP) such that it flows only through TE tunnels. This is useful in scenarios where the hardware has resource constraints that limit the number of mixed ECMP routes.

In earlier releases, IS-IS installed multiple ECMPs for a route in the Routing Information Base (RIB) through TE tunnels and physical interfaces by default.

This feature introduces the following command:

mpls traffic-eng tunnel preferred

IGP IP Flexible Algorithm for IS-IS Protocol

With IS-IS protocol extensions supporting Interior Gateway Protocol (IGP) Flexible Algorithm (Flex-Algorithm) on the IP data plane, you can now use the Algorithm to calculate IGP paths in an IP network without running Segment Routing. The IGP Flex-Algorithm allows for user-defined algorithms where the IGP computes paths based on a user-defined combination of metric type and constraints.

Earlier, you could calculate IGP only using the Shortest Path First (SPF), which meant that you didn't have any choice except to use the default IGPpath calculated based on a native IGP metric.

The following command is introduced:

• data-plane ip

The following commands are modified:

• ipv4 address

• ipv6 address

• show isis topology

Segment Routing

MPLS LSP Ping and Traceroute Nil FEC Target

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

This feature allows operators to provide the ability to freely test any label stack by allowing them to specify the following:

• label stack

• outgoing interface

• nexthop address

MPLS Ping and Traceroute for BGP and IGP Prefix-SID

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

The MPLS LSP Ping feature is used to check the connectivity between ingress Label Switch Routers (LSRs) and egress LSRs along an LSP.

Programming Non-Active Candidate Paths of an SR Policy

By programming non-active candidate paths (CPs) in the forwarding plane, you ensure that if the existing active CP is unavailable, the traffic switches quickly to the new CP, thus minimizing loss of traffic flow.

In earlier releases, instantiating a non-active CP to the forwarding plane after the unavailability of the active CP could take a few seconds, resulting in potential loss of traffic flow.

This feature introduces the following command:

• max-install-standby-cpaths

SR Performance Measurement: IP Endpoint Delay Measurement and Liveness Monitoring

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

This feature measures the end-to-end delay and monitors liveness of a specified IP endpoint node, including VRF-aware (awareness of multiple customers belonging to different VRFs).

SR Performance Measurement: Link Delay Measurement

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

This feature provides a way to measure the real-time delay between links.

SR Performance Measurement: Measurement Modes

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

This feature supports one-way, two-way, and loopback measurement modes.

SR Performance Measurement: Named Profiles

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

You can use this feature to create specific performance measurement delay and liveness profiles, and associate it with an SR policy.

SR Performance Measurement: SR Policy End-to-End Delay Measurement

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

This feature provides a way to monitor the end-to-end delay experienced by the traffic sent over an SR policy to ensure that the delay does not exceed the requested “upper-bound” and violate SLAs.

SR Performance Measurement: SR Policy Liveness Monitoring

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

This feature allows you to verify end-to-end traffic forwarding over an SR Policy candidate path by periodically sending performance monitoring (PM) packets.

SR Performance Measurement: Static Delay Value on an Interface

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

This feature allows you to configure an interface to advertise a static delay value, instead of the measured delay value.

Segment Routing Ping and Traceroute

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

Segment routing ping and traceroute features extendsthe MPLS LSP ping and traceroute functionality to perform the connectivity verification on the segment routing control plane.

Segment Routing Ping and Traceroute for Flexible Algorithm

This feature is supported on Cisco Network Convergence System 5700 Series routers and routers with the Cisco NC57 line cards operating in native mode.

Flexible Algorithm validation method is based on segment identifier (SID) label and label switched path (LSP) destination, instead of being based on IP address.

System Management

PTP and SyncE support on NC57-MPA-12L-S

With this release, timing support for IEEE 1588 and SyncE is available on NC57-MPA-12L-S MPA.

Precision Time Protocol on NC57-24DD and NC57-18DD-SE

 PTP is now supported on NC57-24DD and NC57-18DD-SE line cards operating in native mode. Based on the IEEE 1588-2008 standard, PTP is a protocol that defines a method to synchronize clocks in a network for networked measurement and control systems.

PTP Delay Asymmetry on NCS 5700 series routers

You can configure static asymmetry such that any delays on Precision Time Protocol (PTP) paths are accounted for, and the PTP synchronization remains accurate, thus avoiding any impact to clock settings for all devices in a network.

With this release, support for PTP Delay Asymmetry is extended to NCS 5700 series routers.

Flexible Consumption Model Licensing on the NC-57-MOD-S line card

Flexible Consumption Model (FCM) of licensing provides the capability and flexibility to purchase software capacity as needed.

Support for FCM licensing is now extended to the NC-57-MOD-S line card.

PTP and Frequency Synchronization on NC-57-MOD-S Line Cards

Based on the IEEE 1588-2008 standard, PTP is a protocol that defines a method to synchronize clocks in a network for networked measurement and control systems.

With this release, timing support for IEEE 1588-2008 (PTPv2) telecom profiles is extended to the line card NC-57-MOD-S.

System Monitoring

Bias-Free Terminology in Syslogs

As part of the ongoing efforts by Cisco to use inclusive language in the IOS XR software and documentation, discriminatory words in syslog messages and formats are being removed and replaced with bias-free words. There is also a list of bias-free words that you can enable in your syslog files using the service cli neutral enable command.

Verification of EEDB OOR

If the Egress Encapsulation Database (EEDB) resources exceed the Out of Resource (OOR) threshold levels, the resource utilization of EEDB hardware and other system logs on the console can be viewed. With these details, you can take corrective action by freeing up EEDB resources, thereby minimizing traffic loss.

This feature updates the show output of the following command to display utilization of EEDB hardware resources:

• show controllers npu resources

System Security

Lawful Intercept on Cisco NC57 line cards

Lawful intercept is a process that requires service providers to perform surveillance on an individual (or target) as authorized by a judicial or administrative order and share the communication intercepts with law enforcement agencies.

You can now activate and deactivate the lawful intercept package on routers that have Cisco NC57 line cards installed and operate in the native mode.

MACSec on NCS-57B1 Chassis

MACSec is now supported on the following variants of the NCS-57B1 chassis:

• NCS-57B1-5DSE-SYS

• NCS-57B1-6D24-SYS

This enhancement enables you to leverage features such as 400GE and 100GE optimized forwarding capacity, full line-rate MACSec, scalability, and low power consumption that the NCS-57B1 chassis offers.

System Setup and Software Installation

Build Golden ISO (GISO) Using gisobuild.py Tool

This feature allows you to build your GISO image without support from Cisco. You can now select the install files, add your RPMs, repackage them as a custom image, and install the image.

In previous releases, you had to contact Cisco to get your GISO built.

Hardware MDB Profiles for Layer 2 Services

You can now configure hardware modular database (MDB) profiles for Layer 2 services, enabling you to achieve higher scales in terms of the number of routers and sessions.

In earlier releases, you could configure hardware MDB profiles for Layer 3 services.

This release adds the following hardware MDB profiles to the hw-module profile mdb command:

• l2max

• l2max-se

Secure ZTP - Python3 Support

You can now run the ZTP Helper Python Library script by invoking Python 3.0.

In earlier releases, you could only invoke the ZTP Helper Python Library script with Python 2.0.