Hardware

Optics

This release introduces the following optics:

• Cisco 100/1000BASE-LX SFP for long-reach single-mode fibers

  • GLC-GE-DR-LX SFP

• Cisco 1000BASE-ZX SFP Transceiver Module for SMF

  • SFP-GE-Z

• Cisco 100GBASE CFP Module

  • QSFP-100G-LR4-I

Routing

Multihop BFD over nondefault VRF

IPv4 Multihop BFD is a BFD session between two nodes, such as a PE and CE node, or between routers that are several TTL hops away. You can extend the BFD session to nondefault VRFs.

This feature enables you to extend the BFD session to nondefault VRFs.

Thus, the advantage of BFD, low-overhead, and short-duration detection of path failures between routers, is extended to a multihop scenario.

Setting SPF interval in IS-IS to postpone the IS-IS SPF computations

You can now define a standard algorithm to postpone the IS-IS SPF computations by setting an SPF interval. This reduces the computational load and churn on IGP nodes when multiple temporally close network events trigger multiple SPF computations.

This algorithm also reduces the probability and the duration of transient forwarding loops during native IS-IS convergence when the protocol reacts to multiple temporally close events.

This feature complies with RFC 8405.

This feature introduces the spf-interval ietf command.

Modular QoS

QoS IP DSCP Preservation for SR-TE

In terms of preserving IP DSCP markings, this release covers two scenarios for SR-TE traffic:

• For two or less than two topmost or imposition labels: when you set the MPLS experimental bits (EXP) values (also called Traffic Class values), the IP DSCP markings are now preserved by default in the ingress policies when the MPLS labels are pushed into the packet.

• For more than three imposition labels: you must enable this functionality to preserve IP DSCP markings.

With preservation, traffic with IP packets with DSCP marking for priority, flows as intended and there’s no drop in traffic because of incorrect or missing labels.

In previous releases, irrespective of the number of MPLS labels, when the EXP values were copied into the packet header during imposition, even the IP DSCP markings were modified. This modification resulted in traffic drops at the next-hop routers in SR-TE tunnels.

This feature introduces the hw-module profile mpls-ext-dscp-preserve v4uc-enable command.

Ingress QoS scale improvement

This enhancement increases the number of supported ingress policers. The policer scale is now enhanced from 48000 policers per NPU to 56000 policers per NPU. Also, the policy map scale is enhanced from 6000 to 7000.

Now you can have more interfaces with ingress QoS policies applied.

Multicast

Qos DSCP Preservation

In terms of preserving IP DSCP markings, when you set the MPLS experimental bits (EXP) values (also called Traffic Class values), the IP DSCP markings are now preserved by default in the ingress policies when the MPLS labels are pushed into the packet.

Traffic with IP packets with DSCP marking for priority, flows as intended and there’s no drop in traffic because of incorrect or missing labels.

In previous releases, irrespective of the number of MPLS labels, when the EXP values were copied into the packet header during imposition, even the IP DSCP markings were modified. This modification resulted in traffic drops at the next-hop routers.

Extending Selective Multicast using IGMP Proxy

The IGMP Proxy function enables PE routers to act as a proxy for the CE routers connected to it.

IGMP Proxy function provides the following benefits:

• Reduces the flooding of IGMP messages in an EVPN network.

• Enables EVPN network to act as a distributed anycast multicast router.

• Helps in having selective multicast over EVPN network.

Earlier, connecting an external network directly to an EVPN fabric was not possible. With this IGMP Proxy support, it is possible to have seamless connectivity over the EVPN network for its hosts with respect to multicast operations.

Interface and Hardware Component

Enhancement to Ethernet SLA Statistics Measurement

You can now configure the size of bins for the delay and jitter measurement in Ethernet SLA statistics with a width value ranging from 1 to 10000000 microseconds. This enhancement provides granularity to store more accurate results of SLA statistics in the aggregate bins.

In earlier releases, you could only configure the width value for the delay and jitter measurement in milliseconds.

This feature introduces usec keyword in the aggregate command.

Network Synchronization

PTP Double Failure Clock Class

This feature enables you to configure a clock class that will override the existing class during a state of double-failure where PTP and SyncE are lost.

This feature introduces the double-failure-clock-class command.

System Security

Non-Default SSH Port

We have enhanced the system security to minimize the automated attacks that may target the default Secure Socket Shell (SSH) port on your router. You can now specify a non-default port number for the SSH server on your router. The SSH, Secure Copy Protocol (SCP), and Secure File Transfer Protocol (SFTP) client services can then access your router only through this non-default port. The new port option also enables the SSH, SCP, and SFTP clients on your router to connect to SSH servers on the network that use a wide range of non-default port numbers. In earlier releases, these SSH, SCP, and SFTP connections were established through the default SSH port, 22. The non-default SSH port is supported only on SSH version 2.

The feature modifies these commands to include the port option:

• ssh

• sftp

• scp

Password Policy to Restrict Consecutive Characters

We have enhanced the router security by enforcing a strong password policy for all users configured on the router. You can now specify a new password policy for the user that restricts the usage of a specific number of consecutive characters for the login passwords. These characters include English alphabets, the sequence of QWERTY keyboard layout, and numbers, such as, 'abcd', 'qwer', '1234', and so on. Apart from passwords, the feature is also applicable for secrets–the one-way encrypted secure login passwords that are not easy to decrypt to retrieve the original unencrypted password text.

The password policy is applicable only for the users configured on the local AAA server on the router; not those configured on the remote AAA server.

The feature introduces the restrict-consecutive-characters command.

Segment Routing

SRv6 Traffic Class QoS Enhancement

The modified hw-module profile segment-routing srv6 mode command option provides you with better flexibility to customize the optional SRv6 encapsulation parameters. The updated command will now support both L2 and L3 traffic types of SRv6 parameters.

Encapsulation is a sub-mode from Release 7.7.1.

The l3-traffic config supports the additional policy-map option that sets SRv6 traffic-class DSCP based on qos-group selected by input policy-map.

The following commands are updated:

• hw-module profile segment-routing srv6 mode: Mode is a mandatory parameter

The following commands are introduced:

• encapsulation l2-traffic

• encapsulation l3-traffic

System Monitoring

Out of Resource handling of Input Logical Interface and Router Interface

You can now reconfigure the threshold level for NPU resources - Input Logical Interface (INLIF) and Router Interface (RIF) by changing the predefined threshold level at which Out of Resource (OOR) situation is triggered. Graceful handling of OOR helps you to minimize traffic loss.

You get notified via systemlogs, when the utilization of resources reaches their OOR limit. Also, you can view the utilization of resources by using the following commands:

• show controllers npu resources

• show grid pool

System Management

Unified Model: Cisco-IOS-XR-um-fpd-cfg

We have introduced the Cisco-IOS-XR-um-fpd-cfg unified model to enable or disable the automatic reload and automatic upgrade of Field Programmable Devices.

You can access this unified model from the Github repository.