Modular QoS

Conditional Marking of MPLS Experimental Bits for EVPN-VPWS Single-Homing Services

This feature enables you to differentiate traffic in the MPLS forwarding domain and manage traffic from ingress PE to egress PE based on the MPLS EXP bit of the MPLS header. This feature is supported only for EVPN-VPWS single-homing services, and not supported for EVPN-VPWS multi-homing services.

Shared Policy Instance

This feature allows you to share a single instance of QoS policy across multiple subinterfaces, allowing for aggregate shaping of the subinterfaces to one rate. The ability to facilitate queue consumption in this manner offers the advantage of saving on QoS and hardware resources, while ensuring that the specified rate is not exceeded.

BGP

BGP PIC for MPLS for multipath backup

Unlabeled BGP PIC EDGE for global prefixes is not supported.

Per-Prefix Label Allocation Support on BVI

You can configure connected routes and static routes in per-prefix mode on the BVI. However, dynamic protocols such as BGP in per-prefix mode on the BVI is not supported.

Routing

BFD v6 - HW Offload and IPv6 BFD/BoB (Bundle over Bundle)

The Bidirectional Forwarding detection (BFD) Hardware Offload feature enables the offload of a BFD session in an IPv6 network. With this feature, each bundle member link with IPv6 address runs its own BFD session This feature improves scale and reduces the overall network convergence time by sending rapid failure detection packets to the routing protocols for recalculating the routing table.

Interface and Hardware

Bundle Consistency Checker (BCC)

This feature provides an on-the-router mechanism to check and verify the correct programming for the bundle interface. The system performs the check on ingress and egress traffic. From the running configuration, BCC fetches information from bundle, sub-bundle, and member information and saves that information in a database. Later, BCC collects data from all the running nodes and verifies the information with the information saved in the database.

BCC then reports inconsistencies, programming errors, stale entries, and deletes any pending objects.

Multicast

Bundle Member Selection

This feature enables selecting a bundle member in the control plane to steer the L2 and L3 multicast traffic traversing over bundle at the egress NP. This feature helps optimize fabric bandwidth as the member selection is performed in the control plane.

Multicast Counters

When enabled, this feature provides information on the rate of packets received for a multicast route. Starting this release, the feature is extended on the Cisco NCS 540 series routers.

System Security

Support for Ed25519 Public-Key Signature System

This feature allows you to generate and securely store crypto key pair for the Ed25519 public-key signature algorithm on Cisco IOS XR 64-bit platforms. This signature system provides fast signing, fast key generation, fool proof session keys, collision resilience, and small signatures. The feature also facilitates integration of Cisco IOS XR with Cisco Crosswork Trust Insights.

Commands introduced for this feature are:

• crypto key generate ed25519

• crypto key zeroize ed25519

• show crypto key mypubkey ed25519

Commands modified for this feature are:

• ca-keypair

• keypair

Password Masking

With this feature, when you key in a password or secret, it is not displayed on the screen. This enhances security. The feature is enabled by default. The following options are added to the username command:

• masked-password

• masked-secret

SSD Encryption

This feature enables trust and security in the system’s steady state by encrypting data at the disk level. The encrypted data can be accessed only with a specific key stored in the TAm.

User Configurable Maximum Authentication Attempts for SSH

This feature allows you to set a limit on the number of user authentication attempts allowed for SSH connection, using the three authentication methods that are supported by Cisco IOS XR. The limit that you set is an overall limit that covers all the authentication methods together. If the user fails to enter the correct login credentials within the configured number of attempts, the connection is denied and the session is terminated. This command is introduced for this feature: ssh server max-auth-limit.

Ed25519 Public-Key Signature Algorithm Support for SSH

Support for this algorithm is added, when establishing SSH sessions, to Cisco IOS XR 64-bit platforms. It is a modern and secure public-key signature algorithm that provides several benefits, particularly resistance against several side-channel attacks. Prior to this release, DSA, ECDSA, and RSA public-key algorithms were supported. This command is modified for this feature: ssh server algorithms host-key

Segment Routing

Advertisement of SID-Mapping Entries Between IS-IS Levels

This feature supports the advertisement of SID-mapping entries between IS-IS levels (for example, from L1 to L2-only and from L2 to L1). A mapping server is not required for each IS-IS area.

With this feature, SRTE calculates a shortest path that satisfies multiple metric bounds. This feature provides flexibility for finding paths within metric bounds, for parameters such as latency, hop count, IGP and TE.

TI-LFA provides protection for SR-labeled traffic (IPv4 and IPv6 prefixes associated with a prefix SID) and for other unlabeled IPv4 prefixes. This feature introduces support for protecting unlabeled IPv6 prefixes.

Link Delay Measurement with IPv6 Link Local Address

With Performance Measurement, the source and destination IP addresses used in the OAM packet are determined by the IP address present on the interface where the delay-measurement operation is enabled. If an IPv4 or IPv6 address is not configured under the interface, this feature enables the use of the interface's IPv6 link-local address as the OAM packet source IP address.

Multicast VPN: Tree-SID MVPN With TI-LFA

With this feature, you can use SR for optimally transporting IP VPN multicast traffic between (BGP/MPLS) IP VPN customer sites, across an SP network. To optimize the traffic flow, SR-PCE is used. It dynamically builds, instantiates, and updates a multicast distribution tree on the multicast routers, through an SR policy.

SR OAM for SR Policy (Policy Name / Binding SID / Custom label stack)

This feature extends SR OAM ping and traceroute function for an SR policy (or binding SID)-LSP end-point combination. This addresses the limitations of the Nil-FEC LSP Ping and Traceroute function which cannot perform a ping operation to a segment list that is not associated with an installed SR policy. Also, it cannot validate egress device-specific SR policies.

SR Performance Measurement Named Profiles

With this feature, users can create specific performance measurement delay profiles for SR policies, based on the interface type or network area the performance management probes are enabled on. This enhances performance measurement capabilities.

SRv6 Micro-Segment (uSID)

This feature is an extension of the SRv6 architecture. It leverages the existing SRv6 Network Programming architecture to encode up to 6 SRv6 Micro-SID (uSID) instructions within a single 128-bit IPv6 address, called the uSID Container. In addition, this feature leverages the existing the SRv6 data plane (SRH) and the SRv6 control plane with no changes. It also provides low MTU overhead. SRv6 uSID supports the following existing SRv6 functionality:

• IS-IS: TI-LFA, Microloop Avoidance, Flexible Algorithm, OAM, Performance Measurement

• QoS SRv6 BGP Services: IPv4 L3VPN Per-VRF

• SRv6 BGP Services: BGP Global IPv4

SRv6 Services: BGP Global IPv6

With this feature, the egress PE can signal an SRv6 Service SID with the BGP overlay service route. The ingress PE encapsulates the IPv4/IPv6 payload in an outer IPv6 header where the destination address is the SRv6 Service SID provided by the egress PE. BGP messages between PEs carry SRv6 Service SIDs as a means to interconnect PEs.

SRv6 Services: IPv6 L3VPN

With this feature, the egress PE can signal an SRv6 Service SID with the BGP overlay service route. The ingress PE encapsulates the IPv4/IPv6 payload in an outer IPv6 header where the destination address is the SRv6 Service SID provided by the egress PE. BGP messages between PEs carry SRv6 Service SIDs as a means to interconnect PEs and form VPNs.

Weighted Anycast SID-Aware Path Computation

This feature extends Anycast SIDs with weighted nodes. Anycast routing enables the steering of traffic toward multiple advertising nodes, providing load-balancing and redundancy. With the default (unweighted) behavior, the traffic is load-balanced across each node in the group evenly. Weighted Anycast nodes advertise a cost (weight) along with the Anycast SID. Traffic is then distributed according to the weights. Weighted Anycast SIDs allow for highly available paths with node redundancy and path optimality that provide FRR for node failure of service provider edge (PE) routers and ABR/ASBRs nodes in multi-domain networks.

L2VPN

Layer 2 Protocol Tunneling

This feature enables you to send Layer 2 protocol data over IP or other L3 networks. Support of this feature is now extended to the Cisco NCS 540 series routers.

This feature introduces the l2protocol command.

EVPN Convergence Using NTP Synchronization

This feature leverages the NTP clock synchronization mechanism to handle the transfer of DF role from one edge device to another. In this mechanism, the newly added or recovered PE advertises the Service Carving Timestamp along with the current time to peering PEs. This improves convergence by reducing the time for DF election from three seconds to a few tens of milliseconds. The show evpn ethernet-segment command is modified to display the Service-Carving wall clock Timestamp (SCT).

EVPN Single-Flow-Active Multihoming Load-Balancing Mode

This feature introduces EVPN Single-Flow-Active multihoming mode to connect PE devices in an access network that run Layer 2 access gateway protocols. In this mode, only the PE that first advertises the host MAC address in a VLAN forwards the traffic in a specific flow. When the primary link fails, the traffic quickly switches to the standby PE that learns the MAC address from the originated path, thereby providing fast convergence. A keyword, single-flow-active is added to the load-balancing-mode command.

EVPN Access-Driven DF Election

This feature enables a new DF election mechanism to allow the access network to control EVPN PE devices through the interface state. This mechanism allows the PE devices to define the backup path much before the event of failure. This feature reduces the convergence time.

The following keywords are added to the service-carving command:

• preference-based

• access-driven

Layer 2 Fast Reroute

In the event of a link failure, this feature enables the router to switch traffic quickly to a precomputed loop-free alternative (LFA) path by allocating a label to the incoming traffic. Thus minimizes the traffic loss ensuring fast convergence. This feature is supported only when PE devices are in an EVPN single-flow-active mode This feature introduces the convergence reroute command.

System Setup and Software Installation

Secure Zero Touch Provisioning

This feature allows devices in the network to establish a secure connection with the ZTP server and authenticate information using a three-step validation process involving validation of the network device, the ZTP server, and onboarding information. This eliminates security risks or malicious actions during remote provisioning.

ztp secure-mode enable

Support ZTP Initialization File in Golden ISO (GISO)

GISO can be created with a ZTP initialization (ztp.ini) file. ZTP uses this file when starting the install operation. If you start an install replace or install package replace operation with a GISO that has a ztp.ini file, the ZTP configuration is updated on both RPs when the operation is applied. If you replace the image using an ISO without a ztp.ini file, the ZTP configuration is removed from both the RPs.

Network Synchronization

PTP Delay Asymmetry

Asymmetrical delays can significantly degrade synchronization in PTP networks and impact PTP accuracy. This feature allows you to set a delay asymmetry to offset the static delays on PTP paths. This facilitates better synchronization between real-time clocks of devices in a network.

The delay-symmetry command is introduced for this feature.

Hardware

GPIO external alarm

You can now enable external alarms, such as external doors, voltage, fire, thermal, water sensors, and so on, on the Cisco NCS 540 router variants.

• N540-24Z8Q2C-SYS

• N540-ACC-SYS

• N540X-ACC-SYS

For more information, see the Cisco NCS 540 Router Hardware Installation Guide.

System Security

MACsec support

MAcsec is now supported on Cisco NCS 540 routers.

System Setup and Software Installation

Install RPM Directly from TAR File

The source files to download and install RPMs from can be a repository name, repository URL or a local file path. You can extract the bugfix TAR file to obtain the RPMs, and install the RPMs. This feature extends support to install the RPMs directly from the TAR file. This installs all the packages present in the tarball. The TAR file is available in the Software Download page. The RPMs can be installed from the TAR file using CLI or Yang data model. CLI—

• Packaging operation: install package add source /harddisk:/<platform>-<version>.tgz synchronous

• Packaging operation and atomic change: install source /harddisk:/<platform>-<version>.tgz synchronous

<rpc xmlns="urn:ietf:params:xml:ns:netconf:
base:1.0" message-id="101">
<install-package-add xmlns=
"http://cisco.com/ns/yang/Cisco-IOS-XR-install-augmented-act">
<source-type>tar</source-type>
<source>/misc/disk1/<platform>-<version>.tgz</source>
</install-package-add>
</rpc>