Hardware

8-port 10/25G SFP+/SFP28 Multi-rate interface Module (N560-IMA-8Q/4L) support

The Cisco NCS 560-4 and NCS 560-7 routers and N560-RSP4 and N560-RSP4-E route processors (RSPs) now support the 8-port 10/25G SFP+/SFP28 Multi-rate interface Module (N560-IMA-8Q/4L) on additional slots with various speed combinations.

The IM is supported on NCS 560-7 with N560-RSP4 or N560-RSP4-E on:

• Slots 7 and 9 in 8x25G, 8x10G, 4x25G and 4x10G, 4x10G and 4x25G modes. Default mode is 8x25G.

• Slots 4, 5, 10 and 11 in 8x10G default mode.

The IM is supported on NCS 560-4 with N560-RSP4 or N560-RSP4-E on:

• Slots 0 and 1 in 8x25G, 4x25G and 4x10G, 4x10G and 4x25G modes. Default mode is 8x25G.

• Slots 2 and 3 in 4x25G and 4x10G, 8x10G, 2x50G and 4x10G modes. Default mode is 4x25G and 4x10G.

• Slots 4, 5 in 8x10G default mode.

4X10G Support on A900-IMA-8Z and A900-IMA-8Z-L

The Cisco N560-RSP4 and N560-RSP4-E route processors (RSPs) now support the 8-port 10-Gigabit Ethernet interface modules (A900-IMA-8Z and A900-IMA-8Z-L) on slots 2,3,12, and 13. In these slots, only 4 ports will be supported. If an IM is inserted in these slots, then ports 0-3 are created on A900-IMA-8Z and ports 4-7 are created in case of A900-IMA-8Z-L.

2-port 100-Gigabit Ethernet interface module

The Cisco NCS 560-4 router now supports 2-port 100-Gigabit Ethernet QSFP28 or QSFP-DD module (N560-IMA-2C-DD) on slots 0, 1, 2 and 3 of NCS560-4.

In NCS560-4, only one interface, corresponding to port 0 is created when N560-IMA-2C-DD is inserted on slots 2 and 3 and port 1 is not effective. Only 100G mode is supported on port 0 of slots 2 and 3.

IP Addresses and Services

Jumbo packet handling for DHCPv6

This release introduces the handle-jumbo-packet configuration command under the dhcp ipv6 mode. This command enables processing of incoming DHCPv6 packets greater than 1280 bytes and upto 12,800 bytes in size. Prior to this release, the router discarded incoming DHCPv6 packets greater than 1280 bytes.

The newly introduced command is:

• handle-jumbo-packet

Custom Prefix Length Selection

By default, /48 prefix length is inserted in the LEM memory. This feature allows you to choose a custom IPv6 prefix length to be inserted into the largest exact match (LEM) memory.

This feature introduces the hw-module fib scale ipv6 custom-lem command.

L2VPN and Ethernet Services

Control-word support for EVPN Bridge-Mode (E-LAN)

Control word is now supported and enabled by default in ELAN mode. If the control-word-disable command is not configured, ensure to configure it under EVPN or EVI configuration mode before an upgrade to avoid inconsistent behaviour with routers before this release.

Router# configure
Router(config)# evpn
Router(config-evpn)# evi 1
Router(config-evpn-instance)# control-word-disable           // Apply to interop with older releases EVPN ELAN

If you want to enable control-word command for EVPN Bridging feature, then you must configure it only when both the endpoints run Release 7.4.1 or later.

PPPoE Traffic-Based Load Balance using Flow-Aware Transport Labels

This feature allows you to load balance the incoming PPPoE traffic received based on the inner PPPoE payload, source and destination IPv4 or IPv6 header. When you enable this feature, the router generates a unique Flow-Aware Transport (FAT) label for the incoming traffic based on inner IPv4 or IPv6 headers and uses the FAT labels for load balancing the PPPoE traffic.

This feature introduces the hw-module profile load-balance algorithm PPPoE command.

Maximum MAC addresses on UNI port

This feature introduces MAC limit and MAC limit action on bridge port, which was earlier only available on bridge domain.

This feature supports:

• MAC limit of 1-64K

• MAC limit action of flood and shutdown

Thus, allowing you to limit the maximum number of clients connected to a bridge on a site.

VLAN list

VLANs separated by a comma are called VLAN lists. This feature allows you to configure a VLAN list on the L2 sub interface. VLAN-IDs of up to 9 are supported, per VLAN list.

This feature overrides any limit set on the number of customers that can be supported in an Ethernet network.

L3VPN

Inter-AS Option B for L3VPN

This feature allows ISPs to provide MPLS Layer 3 VPN services to their end customers where the routing boundaries for a customer are spread across different geographical locations. Separate autonomous systems with autonomous system boundary routers (ASBRs) from different service providers can communicate by exchanging VPN-IPv4 addresses or IPv4 routes and MPLS labels. This feature provides better scalability as it requires only one BGP session to exchange all VPN prefixes between the ASBRs.

Multicast

Support for Multicast Over IPV4 Unicast GRE Tunnels

This feature allows encapsulation of multicast packets using GRE tunnels, thereby enabling transport of multicast packets securely between source and destination routers located in different IP clouds.

Draft-Rosen Multicast VPN (Profile 0)

Rosen draft (profile 0) is a widely used MVPN model and uses GRE tunnels to securely transmit multicast traffic between the PE routers. It also enables ease of deployment by using the Protocol-Independent Multicast (PIM) protocol between edge routers (PE) and hosts (CE), and between PE routers that are running in VRF mode.

Designated Router Election Using StickyDR

With this feature, the router sends a PIM hello message with a special PIM DR priority value on a multi-access LAN. The router with this special DR priority value is always elected as the designated router. The traffic now flows in the same path even when a new router is added.

This feature introduces the sticky-dr command.

Modular QoS

Packets-Per-Second-Based Policer

Prior to this functionality, when configuring policers, the only available option for policer rates was bit-rate measured in units of bits per second (bps). With this release, you can configure policer rates in units of packets per second (pps) as well. pps-based policer is critical in fending off malicious attacks—when attackers target your specific resources with a vast amount of traffic that contain higher number of packets, but move at a slower packet rate. Protection from such attacks is possible because pps-based policers ensure that regardless of the packet size and rate, the policer only accepts a fixed number of packets per second.

This functionality modifies the police rate command.

Network Synchronization

GNSS support on NCS 560 routers

GNSS is now supported on the Cisco NCS 560 series routers.

Support for Frequency Synchronization on the Cisco N560-IMA-8Q/4L interface module

Based on the ITU-T G.8262 recommendations, precision frequency is enabled on timing devices to deliver frequency synchronization for bandwidth, frequency accuracy, holdover, and noise generation. This support allows for correct network operations when synchronous equipment is timed from either another synchronous equipment clock or a higher-quality clock.

PTP Profiles Support for N560-IMA-8Q

PTP Profiles support is now extended on the N560-IMA-8Q interface module.

Routing

Coexistence of BFD over bundle and BFD over logical bundle

This feature provides the benefits of both BOB and BLB.

This feature enables you to configure both BFD over bundle (BOB) and BFD over logical bundle (BLB) over physical bundle interfaces and subinterfaces. BOB functionality allows you to detect failures in physical bundle interfaces. BLB functionality allows you to detect failures in the client protocols configured on the subinterfaces.

RIPv2

This feature enables RIP as the IGP of your network. RIP broadcasts UDP data packets to exchange routing information in networks that are flat rather than hierarchical, reducing network complexity and network management time.

Segment Routing

Advertisement of Link Attributes for IS-IS Flexible Algorithm

Link attribute advertisements used during Flexible Algorithm path calculation must use the Application-Specific Link Attribute (ASLA) advertisements, as defined in IETF draft draft-ietf-lsr-flex-algo.

This feature introduces support for ASLA advertisements during IS-IS Flexible Algorithm path calculation.

OSPF: Microloop Avoidance for Flexible Algorithm

This feature extends the current Microloop Avoidance functionality to support OSPF.

Path Invalidation Drop

By default, if an SR Policy becomes invalid (for example, if there is no valid candidate path available), traffic falls back to the native SR forwarding path. In some scenarios, a network operator may require that certain traffic be only carried over the path associated with an SR policy and never allow the native SR LSP to be used.

This feature allows the SR policy to stay up in the control plane (to prevent prefixes mapped to the SR policy from falling back to the native SR LSP) but drop the traffic sent on the SR policy.

Per-Flow Automated Steering: L3 / L2 BGP Services + BSID Steering

This feature introduces support for BGP VPNv6 (6VPE) and BGP EVPN (single-home/multi-homed) over PFP, labeled traffic (Binding SID as top-most label in the stack) steering over per-flow policy (PFP).

An ingress QoS policy applied to an input interface is used to classify flows and set corresponding MPLS experimental values.

SR ECMP-FEC Optimization L2 and L3 Recursive Services

This feature adds support for L2VPN service Label Edge Router (LER) and BGP PIC for Layer 3 BGP services when SR ECMP-FEC Optimization is enabled.

TE Metric Support for IS-IS Flex Algo

Flexible Algorithm allows for user-defined algorithms where the IGP computes paths based on a user-defined combination of metric type (path optimization objective) and constraint.

This feature add support for TE metric as a metric type for IS-IS Flexible Algorithm. This allows the TE metric, along with IGP and delay metrics, to be used when running shortest path computations.

Unprotected Adjacency SIDs

By default, the SR-TE process prefers the protected Adj-SID of the link if one is available. If there is no protected Adj-SID available, the policy will come up with unprotected Adj-SID.

This feature allows you to specify the Adj-SID protection behavior of the SR-TE process to prefer the protected or unprotected Adj-SID, or to use only the protected or unprotected Adj-SID.

Link Anomaly Detection with IGP Penalty

This feature allows you to define thresholds above the measured delay that is considered “anomalous” or unusual. When this threshold is exceeded, an anomaly (A) bit/flag is set along with link delay attribute that is sent to clients.

Licensing

Support for Flexible Consumption Model on N560-IMA8Q, N560-IMA2C-DD,A900-IMA8Z

Support for Flexible Consumption Model (FCM) is now extended to the following interface modules supported on the Cisco routers:

• N560-IMA8Q

• N560-IMA2C-DD

• A900-IMA8Z

Smart License support on new interface modules, N560-IMA-2C-DD, N560-IMA-8Q, and A900-IMA-8Z

Smart Licensing support is now extended on the following interface modules:

• N560-IMA-2C-DD

• N560-IMA-8Q

• A900-IMA-8Z

Smart Transport Support

You can now use Smart transport to communicate with CSSM. Smart transport is a transport method where a Smart Licensing (JSON) message is contained within an HTTPs message, and exchanged between a product instance and CSSM, to communicate. The following Smart transport configuration options are available:

• Smart transport: In this method, a product instance uses a specific Smart transport licensing server URL. This must be configured exactly as shown in the workflow section.

• Smart transport through an HTTPs proxy: In this method, a product instance uses a proxy server to communicate with the licensing server, and eventually, CSSM.

YANG Data Models for Smart Licensing

With this feature, you can use data models for all the smart licensing operations such as registering your device with a token, renewing token ID, deregistering device to remove the software entitlements and so on using NETCONF remote procedure calls (RPCs).

The following data models are introduced:

• Cisco-IOS-XR-smart-license-cfg.yang

• Cisco-smart-license.yang

• Cisco-IOS-XR-smartlicense-platform-oper.yang

• Cisco-IOS-XR-infra-smartlicense-oper.yang

• Cisco-IOS-XR-smart-license-act.yang

You can access these data models from the Github repository.

Essential and Advantage smart licenses in a combined entitlement

With this release, the Advanced licenses are now referred to as the Advantage licenses, without essential entitlement. Also, a new license model – Advantage with Essentials, has been introduced that contains both Essential and Advantage licenses as a combined entitlement in a single PID. This simplifies the license procurement and management effort by eliminating the need to procure separate PIDs for Essential and Advantage licenses.

System Monitoring

TWAMP Responder on IP VRF interface

TWAMP responder now supports VRF interfaces. Service providers can monitor and measure round-trip IP performance between any two devices and can check IP SLA compliance for both the core network and the customer network.

System Security

Admin Access for NETCONF and gRPC Sessions

This feature allows all authorized users on XR VM to access the admin data on the router through NETCONF or gRPC interface, like the CLI access. This functionality works by internally mapping the task group of the user on XR VM to a predefined group on System Admin VM. Therefore, the NETCONF and gRPC users can access the admin-related information on the router even if their user profiles do not exist on System Admin VM.

Prior to this release, only those users who were authorized on XR VM could access System Admin VM, and that too only through CLI, by using the admin command. Users who were not configured on System Admin VM were denied access through NETCONF or gRPC interface.

Hold-Down Timer for TACACS+

TACACS+ servers provide AAA services to the user. In the event a TACACS+ server becomes unreachable, the router sends the client request to another server, leading to considerable delay in addressing the requests. To prevent this delay, you can set a hold-down timer on the router. The timer gets triggered after the router marks the TACACS+ server as down. During this period, the router does not select the server that is down for processing any client requests. When the timer expires, the router starts using that TACACS+ server for client transactions. This feature improves latency in providing AAA services to the user by limiting the client requests from being sent to unresponsive servers. This feature introduces the holddown-time command.

Support for Display Compact Option

This release introduces:

• Display compact option in the dossier CLI, thereby allowing you to obtain IMA event logs in the protobuf format, which can be decoded at a client site. This provides flexibility to use any decoding mechanism.

Use the display compact keyword with the existing show platform security integrity dossier include system-integrity-snapshot command.