Tenant Routed Multicast over BGP EVPN VXLANv6

Tenant Routed Multicast over BGP EVPN VXLANv6 enables the delivery of IPv4 and IPv6 multicast host traffic in BGP EVPN overlay multi-tenant fabric in an efficient and resilient manner. The new software capability enables IPv4 and IPv6 multicast in overlay with underlay network infrastructure natively running single-stack IPv6. The Tenant Routed Multicast over BGP EVPN VXLANv6 is supported over IPv6 Default MDT group.

For more information, see Configuring Tenant Routed Multicast over BGP EVPN VXLANv6.

There are no new WebUI features in this release.

BGP EVPN VXLAN

• Dynamic BGP Peering for EVPN

• EVPN Microsegmentation

• EVPN Route Map Support

• Multi-Homing in a BGP EVPN VXLAN Fabric

The following BGP EVPN VXLAN features are introduced in this release:

• Dynamic BGP Peering for EVPN: Introduces support for BGP dynamic neighbor sessions to the L2VPN EVPN address family.

• EVPN Microsegmentation: BGP EVPN VXLAN integrates Cisco TrustSec to provide microsegmentation and end-to-end access control with the propagation of the security group tag (SGT). Using security group-based access control lists (SGACLs), you can control the operations that a user can perform, based on the security group assignments and destination resources in a VXLAN campus fabric.

• EVPN Route Map Support: The Leaf, Spine, and Border nodes of a BGP EVPN fabric now support route map for the L2VPN address-family. With route map support, the BGP attributes and their values can be modified to customize the routing policy based on the requirement. The routing policy can be applied for both inbound and outbound EVPN routes.

• Multi-Homing in a BGP EVPN VXLAN Fabric: BGP EVPN is enhanced to restrict the ethernet segment operations to the EVPN-controlled VLANs on the trunk port. This allows traditional Layer 2 domains to co-exist with Layer 2 VNI-enabled VLANs at access layer. It also allows selective VLAN migration to overlay VXLAN segmentation.

Customizable SDM Template for FIB and ACL Features

Introduces support for customizable SDM templates for FIB and ACL features on Cisco Catalyst 9400X Series Switches.

Default Limits for redistributed routes and LSA in OSPF

Default values have been assigned to the number of redistributed routes and LSAs in OSPF to prevent the device being flooded with routes. The default values for redistributed routes is 10240 routes. The default value for LSAs is 50,000 LSAs. You can customize the default values.

Deprecation of Weak Ciphers

The minimum RSA key pair size must be 2048 bits. The compliance shield on the device must be disabled using the crypto engine compliance shield disable command to use the weak RSA key.

IPsec NAT Transparency

Introduces support for IPsec NAT Transparency on Cisco Catalyst 9400X Series Switches. This feature allows IP Security (IPsec) traffic to travel through Network Address Translation (NAT) or Port Address Translation (PAT) points in the network by addressing many known incompatibilities between NAT and IPsec.

LAN MACsec over MPLS

Introduces support for MACsec with MPLS. This feature allows MPLS packets to be encrypted with a MACsec tag.

NETCONF support for PTPv2

Introduces support for configuring PTPv2 with NETCONF. NETCONF provides a mechanism to install, manipulate, and delete the configuration of network devices.

Programmability

• gNMI Dial-Out Telemetry

• Multicast Routing Support on the AppGigabitEthernet Port

• PROTO Encoding

• Secure Zero-Touch Provisioning

• YANG Data Models

The following programmability features are introduced in this release:

• gNMI Dial-Out Telemetry: This feature introduces a tunnel service for gNMI dial-out connections. Using this feature, you can use the device (that acts as a tunnel client) to dial out to a collector (that acts as a tunnel server). The tunnel server forwards requests from gNMI or gNOI clients.

• Multicast Routing Support on the AppGigabitEthernet Port: Multicast traffic forwarding is supported on the AppGigabitEthernet interface. Applications can select the networks that allow multicast traffic.

• PROTO Encoding: gNMI protocol supports PROTO encoding. The gnmi.proto file represents the blueprint for generating a complete set of client and server-side procedures that instantiate the framework for the gNMI protocol.

• Secure Zero-Touch Provisioning: Secure ZTP is a technique to securely provision a device, while it is booting in a factory-default state. The provisioning updates the boot image, commits an initial configuration, and executes customer-specific scripts. The provisioned device can establish secure connections with other systems.

  This feature is supported only on Cisco Catalyst 9400 Series Switches.

• YANG Data Models: For the list of Cisco IOS XE YANG models available with this release, navigate to: https://github.com/YangModels/yang/tree/master/vendor/cisco/xe/17111.

show aaa dead-criteria radius enhancement command

The show aaa dead-criteria radius enhancement command allows you to use the configured radius server name as the input to identify the unique server in the server group and print the server dead criteria configuration.

show access-session command

The info keyword was introduced for the show access-session command.

Silent Host Handling

The silent-host-detection keyword was introduced for the following commands:

• database-mapping

• show lisp instance-id ipv4 database

• show lisp instance-id ipv6 database

• show lisp instance-id ipv4 server

• show lisp instance-id ipv6 server

TCN Flood

The no ip igmp snooping tcn flood command was introduced to disable the flooding of multicast traffic during a spanning-tree Topology Change Notification (TCN) event on STP non-edge ports. STP Edge Ports do not flood multicast traffic during a spanning-tree Topology Change Notification (TCN) event.

There are no new WebUI features in this release.