What's Changed

Avoid multicast traffic loss on OISM server leaf and border leaf devices in scaled EVPN-VXLAN fabrics (QFX5130-32CD and QFX5700 switches)—You can configure QFX5130-32CD and QFX5700 switches as optimized intersubnet multicast (OISM) server leaf or border leaf devices in an EVPN-VXLAN fabric. In scaled fabrics with many VLANs, EVPN instances, and multicast streams, you might see multicast traffic loss on these devices due to the limited size of the multicast snooping route tables in the PFE. To avoid this problem on QFX5130-32CD and QFX5700 switches with OISM in scaled environments, we require that you configure the conserve-mcast-routes-in-pfe option at the [edit multicast-snooping-options oism] hierarchy on these platforms. This option is available only on QFX5130-32CD and QFX5700 switches. Use this option when you configure these devices as server leaf or border leaf devices with OISM. Do not configure this option when you configure these devices as standalone assisted replication (AR) replicators with OISM.

Flow-label configuration status for EVPN ELAN services—The output for the show evpn instance extensive command now displays the flow-label and flow-label-static operational status for a device and not for the routing instances. A device with flow-label enabled supports flow-aware transport (FAT) flow labels and advertises its support to its neighbors. A device with flow-label-static enabled supports FAT flow labels but does not advertise its capabilities.

Commit error if interconnect and local route distinguishers have the same value—On EVPN data center interconnect (DCI) gateway devices, if you configure an interconnect RD at the edit routing-instances name protocols evpn interconnect hierarchy, the interconnect RD must be different from the local RD in the routing instance. If you try to configure the same value for the interconnect RD and the local RD in a routing instance, the device enforces this requirement by throwing a commit error. However, with DCI seamless stitching for EVPN Type 5 routes, you don't see the commit error prior to this release. Starting in this release, the device throws the commit error to enforce this condition for DCI stitching with Type 5 routes.

[See route-distinguisher.]

Specify the UDP source port in a ping overlay or traceroute overlay operation —In Junos OS Evolved releases prior to 22.4R1, you could not configure the udp source port in a ping overlay or traceroute overlay operation. You may now configure this value in an EVPN-VXLAN environment using hash. The configuration option hash will override any other hash-* options that may be used to determine the source port value.

Before this change the output of a show task replication logical-system all | display xml validate command reported an error. After the change the output is correctly formatted with a logical-system root tag and no validation error occurs.

In the past inet6flow.0 was not allowed to be a primary rib in a rib-group. Starting with Release 22.3 this is now allowed.

Prior to this change the output of a show task replication | display xml validate returned an error of the form "ERROR: Duplicate data element <task-protocol-replication-name>. With this change the XML output is properly structured with no validation errors.

The Ethernet link fault management process (lfmd) runs only when the link-fault-management protocol is configured.

The connectivity fault management process (cfmd) runs only when the ethernet connectivity-fault-management protocol is configured.

operator login class is restricted from viewing NETCONF trace files that are no-world-readable (ACX Series, PTX Series, and QFX Series)—When you configure NETCONF tracing options at the [edit system services netconf traceoptions] hierarchy level and you restrict file access to the file owner by setting or omitting the no-world-readable statement (the default), users assigned to the operator login class do not have permissions to view the trace file.

Support for the junos:cli-feature YANG extension (ACX Series, PTX Series, and QFX Series)—The cli-feature YANG extension identifies certain CLI properties associated with some command options and configuration statements. The Junos YANG modules that define the configuration or RPCs include the cli-feature extension statement, where appropriate, in schemas emitted with extensions. This extension is beneficial when a client consumes YANG data models, but for certain workflows, the client needs to generate CLI-based tools.

[See Understanding the Junos DDL Extensions YANG Module.]

XML tag in the get-system-yang-packages RPC reply changed (ACX Series, PTX Series, and QFX Series)—The get-system-yang-packages RPC reply replaces the xmlproxy-yang-modules tag with the proxy-xml-yang-modules tag in the XML output.

Changes to the NETCONF server's <rpc-error> element when the operation="delete" operation deletes a nonexistent configuration object (ACX Series, PTX Series, and QFX Series)—We've changed the <rpc-error> response that the NETCONF server returns when the <edit-config> or <load-configuration> operation uses operation="delete" to delete a configuration element that is absent in the target configuration. The error severity is error instead of warning, and the <rpc-error> element includes the <error-tag>data-missing</error-tag> and <error-type>application</error-type> elements.

Multicast debug information added in EVPN options to request system information command (QFX Series)—The output from CLI command request support information evpn-vxlan now includes additional information to help debug EVPN multicast issues.

[See request support information.]

The ping host | display xml command produces CLI output without errors (ACX Series and QFX Series) — In Junos OS Evolved release 23.1R1, the ping host | display xml command now produces CLI output formatted in XML.

[See ping.]

When subscribing to the resource path /junos/system/linecard/environment, the prefix for the streamed path at the collector side was displaying as /junos/linecard/environment. This issue is resolved in Junos OS Evolved 23.1R1 and the subscription path and the streamed path match to display /junos/system/linecard/environment.

When disk usage for the run directory is above 85%, ZooKeeper logs and snapshots in the /run/zookeeper/conf/default/version-2 directory will be deleted if there are more than 3 files, leaving only the 3 most recent files.

Mozilla certification authority (CA) certificates removed (ACX Series, PTX Series, and QFX Series)—To minimize security risks, Junos OS Evolved no longer includes Mozilla's set of root certificates from various CA operators by default. To use Docker container images from a registry that requires TLS authentication, you must first save the image as a tar archive on a remote device and then import the contents of the archive on the device running Junos OS Evolved.

[See Running Third-Party Applications in Containers.]