Additional Features

We've extended support for the following features to these platforms.

• Configure concurrent connections (SRX Series devices and vSRX running iked). Configure the number of concurrent connections that the group profile supports using the connections-limit configuration statement at the [edit security ike gateway gateway-name dynamic] hierarchy level. We support this configuration for both IKEv1 and IKEv2. This configuration is applicable only to AutoVPN, ADVPN, dynamic endpoint, and remote access (preshared-key and PKI-based tunnels).

  There are no restrictions on the number of connections accepted if you haven't configured the connections-limit option.

  [See dynamic (Security)].

• DHCP security (EX9200, MX240, MX480, MX960, MX2010, MX2020). MPC10E line cards support the following DHCP security features:

  • DHCP snooping with Option 82.
  • DHCPv6 snooping with Option 16, Option 18, Option 37, and Option 79.
  • Lightweight DHCPv6 Relay Agent.

  [See DHCP Snooping.]

• Dynamic routing protocols (MX240, MX480, and MX960 with MX-SPC3, SRX5000 line of devices with SPC3 card and vSRX running iked). We support the exchange of dynamic routing information through IPsec VPN tunnels. You can now enable the dynamic routing protocol, such as OSPF, BGP, BFD, PIM, and RIP on a st0 interface of an IPsec VPN tunnel.

  This feature is supported only if the junos-ike package is installed in your device.

  [See Routing Protocols Support on IPsec VPN Tunnels.]

• Enhancements to increase traffic selector flexibility (MX240, MX480, and MX960 with MX-SPC3). You can do the following to add flexibility to your traffic selectors in different deployment scenarios:

  • Configure the routing metric for a traffic selector.
  • Define the source port range, destination port range, and protocol for a traffic selector.
  • Define multiple terms within a traffic selector, instead of creating multiple traffic selectors (or child security associations or SAs) for a VPN. Each term comprises the local and remote IP prefixes, the source and destination port ranges, and the protocol identifier. You can use these parameters in a single IPsec SA negotiation. In earlier Junos OS releases, you configure each traffic selector with one set of local and remote IP prefixes to be used in an IPsec SA negotiation with a peer.

  This feature is supported only if the junos-ike package is installed in your device.

  We recommend that you configure the same metric value if you define multiple traffic selectors under the same [edit security ipsec vpn vpn_name] hierarchy with the same value for remote-ip ip-address/netmask. If you configure different metric values, then the metric value of the st0 route installed will be the same as that for the traffic selector that is negotiated or installed first.

  [See traffic-selector and show security ipsec security-associations detail.]

• EVPN-VXLAN support (QFX5120-48YM):

  • EVPN-VXLAN with MAC-VRF routing instances

  • Filter-based forwarding in EVPN-VXLAN

  • IPv6 data traffic support through an EVPN-VXLAN overlay network

  • IPv6 support for firewall filtering and policing on EVPN-VXLAN traffic

  • Port mirroring and analyzers on EVPN-VXLAN

  • Storm control on EVPN-VXLAN

  [See EVPN User Guide.]

• EVPN Type 2 and Type 5 route coexistence (EX9200, EX9251, EX9253, MX204, MX240, MX480, MX960, MX2010, MX10003, MX10008, and QFX10002-60C)

  [See EVPN Type 2 and Type 5 Route Coexistence with EVPN-VXLAN.]

• Hybrid mode (Synchronous Ethernet and Precision Time Protocol) over LAG supports PTP over IPv4 and PTP over Ethernet (MX204 and MX10003)

  [See PTP Overview and Hybrid Mode Overview.]

• Hold timer support on aggregated Ethernet (ae-) interfaces (MX150, MX204, MX240, MX304, MX480, MX960, MX2008, MX2010, MX2020, MX10003, MX10004, MX10008, MX10016, PTX1000, PTX5000, PTX10002, PTX10008, PTX10016) Specify the hold-time value to delay the advertisement of up and down transitions (flapping) on an interface.

  [See hold-time.]

• G.8275.1 Telecom profile support (ACX5448)

  [See G.8275.1 Telecom profile support.]

• Increase in the number of supported aggregated Ethernet (ae-) interfaces to 256 from 128(PTX1000, PTX5000, PTX10002, PTX10008, and PTX10016)

  [See Aggregated Ethernet Interfaces.]

• MACsec bounded delay protection (EX4400 and SRX380)

  [See bounded-delay.]

• MACsec timer-based SAK refresh (QFX5120-48YM)

  [See sak-rekey-interval.]

• Precision Time Protocol (PTP) transparent clock (EX4300 and EX4300-48MP)

  [See PTP Transparent clocks.]

• Redistribution of IPv4 routes with IPv6 Next Hop into BGP through tunnels: (MX10008 and MX10016):

  IPv4 traffic is tunneled from CPE devices to IPv4-over-IPv6 gateways as described in RFC 5549.

  [See Understanding Redistribution of IPv4 Routes with IPv6 Next Hop into BGP.]

• Storm control in an EVPN-VXLAN fabric with Layer 3 gateway (QFX5210)

  Note:

  We recommend that you do not configure storm control on the aggregated Ethernet interface used as the loopback port to support RIOT functionality.

  [See Understanding Storm Control.]

• Support for Advanced RISC Machines (ARM)64 (cRPD) cRPD is packaged as a Docker container to run on a 64-bit ARM platform.

  cRPD on ARM64 does not support the following features:

  • Sharding and updateIO. The set system processes routing bgp rib-sharding number-of-shard and set system processes routing bgp update-threading number-of-threads commands are not supported.
  • SRv6

  [See Server Requirements .]

• Support for Precision Time Protocol (PTP) G.8275.2 enhanced profile with PTP over IPv4 and IPv6 unicast traffic (QFX5120-48T)

  [See G.8275.2 Enhanced Profile.]

• Support for Precision Time Protocol (PTP) over Ethernet in hybrid mode over link aggregation group (LAG) (MX10008 with JNP10K-LC2101 MPC line card)

  [See Precision Time Protocol Overview and Hybrid Mode Overview.]

• Support for OSPF, IS-IS, BGP, and static routing on IRB interfaces in EVPN-VXLAN networks (EX4300-48MP and EX4400)

  [See Supported Protocols on an IRB Interface in EVPN-VXLAN.]

• Support for sFLow with EVPN-VXLAN Layer 3 gateway (QFX5210)

  [See sFlow Monitoring Technology and Using a Default Layer 3 Gateway to Route Traffic in an EVPN-VXLAN Overlay Network.]

• Support for IEEE 802.1ag CFM on service provider interfaces and Q-in-Q (point-to-point) interfaces (EX2300, EX3400, EX4300, EX4300-48MP, and EX4400)

  [See Introduction to OAM Connectivity Fault Management (CFM).]

• Supported transceivers, optical interfaces, and DAC cables (ACX Series, EX Series, PTX Series, MX Series, and QFX Series).—Select your product in the Hardware Compatibility Tool to view supported transceivers, optical interfaces, and DAC cables for your platform or interface module. We update the HCT and provide the first supported release information when the optic becomes available.