The Cisco IOS XR Software extends the existing password policy support for the user authentication to all types of user secret. The types of secret include Type 5 (MD5 ), 8 (SHA256 ), 9 (sCrypt ) and 10 (SHA512 ). Prior to this release, the support for a password policy was only for the Type 7 passwords. The new policy is common to both password and secret of the user. Using irreversible hashed-secrets have the benefit that the other modules in the device cannot retrieve the clear-text form of these secrets. Thus, the enhancement provides more secure secrets for the user names. This policy for user secrets is applicable for local and remote users.

gRPC Network Management Interface (gNMI) defines 3 modes for a streaming subscription that indicates how the router must return data in a subscription: SAMPLE, ON_CHANGE, and TARGET_DEFINED.

When a client creates a subscription specifying the TARGET_DEFINED mode, the target, here, the router, determine the best type of subscription to be created on a per-leaf basis. If the path specified within the message refers to some leaves which are event-driven, then an ON_CHANGE subscription is created.

In Cisco IOS XR Release 7.2.1, the TARGET_DEFINED subscription mode is supported only for sensor paths of OpenConfig model; native model is not supported. The supported models are: OC Interfaces, OC Telemetry, OC Shell Util, OC System NTP, and OC Platform.

See gRPC Network Management Interface.

The router streams telemetry data at predefined gather points in the data model even if sensor-path configuration is to an individual leaf. The gather points are collection units; collection always happens at that level for operational data.

Starting from release 7.2.1, the router supports the following sensor-path resolutions:

• Streaming data at the leaf-level or at the container-level under a gather point for cadence-based subscriptions.

• For event-driven subscriptions, streaming is always at the gather point in the model, even if specific leaves or leaf is configured as sensor-path.

See Sensor Path.

Cisco IOS XR routers support gNMI remote procedure calls (RPCs). The gNMI subscribe RPC supports JSON encoding in addition to the previously supported proto encoding format.

The following enhancements are supported for programmability features:

• New additions to CLI-based data models.

• Export LLDP output via gRPC.

• Support to display the label information about the software version for the oc-platform data model.

• gNOI supports for the following new remote procedure calls (RPCs):

  • Interface

    • SetLoopbackMode

    • GetLoopbackMode

    • ClearInterfaceCounters

  • Layer2

    • ClearLLDPInterface

  • BGP

    • ClearBGPNeighbor

For more information, see New and Changed Feature Information.

The destination for dial-out configuration supports IP address (Ipv4 or IPv6), and fully qualified domain name (FQDN) using domain name services (DNS). To use FQDN, you must assign IP address to the domain name.The domain name is limited to 128 characters. If DNS lookup fails for the provided domain name, the internal timer is activated for 30 sec. With this, the connectivity is continually tried every 30 sec until the domain named is looked-up successfully. DNS provides an address list depending on the address-family being requested. For example, on the router, the IP address for domain name is set using the following commands for ipv4 and ipv6 respectively:

domain ipv4 host abcd 172.x.x.1 172.x.x.2

domain ipv6 host abcd fd00:xx:xx:xx:1::1 fd00:xx:xx:xx:1::3

See Monitor CPU Utilization Using Telemetry Data to Plan Network Infrastructure.

The default parameters of a data node can be retrieved using a NETCONF operation that includes the <with-defaults> capability.

This capability indicates which default-handling mode is supported by the server. It also indicates support for additional defaults retrieval modes. These retrieval modes allow a NETCONF client to control whether the server returns the default data.

The <get>, <get-config>, <copy-config> and <edit-config> operations support with-defaults capability. Currently, the <with-defaults> capability is supported only for openconfig-interface.yang data model.

See Retrieve Default Parameters Using with-defaults Capability.

You must follow these guidelines while enabling FIPS mode:

• You must configure the session with a FIPS-approved cryptographic algorithm. A session configured with non-approved cryptographic algorithm for FIPS (such as, MD5 and HMAC-MD5) does not work. This is applicable for OSPF, BGP, RSVP, ISIS, or any application using key chain with non-approved cryptographic algorithm, and only for FIPS mode (that is, when crypto fips-mode command is configured).

• If you are using any HMAC-SHA algorithm for a session, then you must ensure that the configured key-string has a minimum length of 14 characters. Otherwise, the session goes down. This is applicable only for FIPS mode.

• If you try to execute the telnet configuration on a system where the FIPS mode is already enabled, then the system rejects the telnet configuration.

• If telnet configuration already exists on the system, and if FIPS mode is enabled later, then the system rejects the telnet connection. But, it does not affect the telnet configuration as such.

• It is recommended to configure the crypto fips-mode command first, followed by the FIPS-related commands in a separate commit. The list of commands related to FIPS with non-approved cryptographic algorithms are:

  • key chain key-chain-name key key-id cryptographic-algorithm MD5

  • key chain key-chain-name key key-id cryptographic-algorithm HMAC-MD5

  • router ospfv3 1 authentication ipsec spi 256 md5 md5-value

  • router ospfv3 1 encryption ipsec spi 256 esp des des-value

  • router ospfv3 1 encryption ipsec spi 256 esp des des-value authentication md5 md5-value

  • snmp-server user username usergroup-name v3 auth md5 priv des56

  • ssh server algorithms key-exchange diffie-hellman-group1-sha1

  • telnet vrf default ipv4 server max-servers server-limit