Application Hosting

Virtual IP address in the Linux networking stack

Virtual IP addresses allow a single IP address to connect to the current active RP after an RP switchover event. In addition, this functionality enables your network stack to support virtual IP addresses for third-party applications and IOS XR applications that use the Linux networking stack.

The following commands are modified:

• ipv4 virtual address

• ipv6 virtual address

• show kim status

Programmability

OpenConfig YANG Model:MACsec

You can now use the OpenConfig YANG data model to define the MACsec key chain and policy, and apply MACsec encryption on a router interface.

You can access the OC data model from the Github repository.

System Setup and Software Installation

Automatic Bridging of Bug Fix RPMs

This release enables an easy, one-step, no-prompt upgrade or downgrade based on GISO. This removes the dependency on manually installing RPMs that bridge bug fixes across release versions.

IOS XR Configuration File in Golden ISO (GISO)

GISO is a customized image with the standard functional components and additional configuration files. This feature extracts the IOS XR configuration file in GISO and automates the updating of configuration files when the router is reloaded with the new GISO.

This feature introduces iso-config [ignore | replace] keywords to the install replace and install package replace commands.

Telemetry

Enhanced Syslog Notifications for Unresolved Line Card Forwarding Paths

Segment Routing

BGP Best Path Computation using SR Policy Paths

BGP best-path selection is modified for a prefix when at least one of its paths resolves over the next hop using SR policies (SR policy in “up” state). Under this condition, paths not steered over an SR policy (those using native next-hop resolution) are considered ineligible during best-path selection.

You can thus control the best path selection in order to steer traffic, preferably or exclusively, over SR policies with the desired SLA.

This feature introduces the bgp bestpath sr-policy {force | prefer} command.

Optimal Utilization of ECMP FEC Resources

BGP-SR multipath ECMP FEC optimization is enhanced to support 32k BGP-LU prefixes (from the earlier 4k BGP-LU prefixes) on multipath with the same outgoing label. This results in the consumption of lesser ECMP FEC resources, thus avoiding out-of-resource (OOR) situations for your router.

In earlier releases, all 4k BGP-LU prefixes consumed all the 4k ECMP FEC resources.

Use the hw-module fib mpls bgp-sr lsr-optimized command to enable BGP-SR multipath ECMP FEC optimization.

Cisco NC57 Native Mode: SRv6 Micro-Segment (uSID)

The following features are now supported on Cisco NCS 5700 series fixed port routers and the Cisco NCS 5500 series routers that have Cisco NC57 line cards installed and operating in the native mode:

• SRv6 Micro SID (uSID)

• IS-IS: TI-LFA, Microloop Avoidance, Flexible Algorithm, OAM, Performance Measurement

• SRv6 BGP Services: IPv4 L3VPN, IPv6 L3VPN, IPv4 BGP Global, IPv6 BGP Global

  SRv6 Services: Dual-Stack L3 Services (IPv4 BGP global, IPv6 BGP global), EVPN VPWS (ELINE)

• SRv6/MPLS L3 Service Interworking Gateway

Flexible Algorithm Prefix-SID Redistribution for External Route Propagation

This feature enables the propagation of flexible algorithm prefix-SIDs and their algo-specific metric from other domains into OSPF, and from OSPF to other domains.

The show ospf route command has been modified to include additional attributes to indicate the external routes.

Flexible Algorithm to Exclude SRLGs for OSPF

You can now configure the flexible algorithm to exclude any link belonging to the Shared Risk Link Groups (SRLGs) from the path computation for OSPF. The ability to exclude the at-risk links ensures that the rest of the links in the network remain unaffected.

SRv6: Ultimate Segment Decapsulation (USD) behavior

This feature supports the Ultimate Segment Decapsulation (USD) variant on SRv6 endpoint nodes using full-length SIDs. Previously, USD variant was supported on SRv6 endpoint nodes using using Micro SIDs (uSIDs).

The USD variant enables interworking with SRv6 underlay headend nodes that push SIDs using H.Encaps (SR Headend Behavior with Encapsulation in an SRv6 Policy) or H.Encaps.Red (H.Encaps with reduced Encapsulation) instead of H.Insert (SR Headend with insertion of an SRv6 Policy) or H.Insert.Red (H.Insert with reduced insertion).

One of the applications of the USD variant is the case of TI-LFA in P routers with encapsulation with H.Encaps. The USD variant allows the last Segment Endpoint Node in the repair path list to decapsulate the IPv6 header added at the TI-LFA Point of Local Repair and forward the inner packet.

SRv6 Services: Ethernet VPN Emulated LAN (ELAN)

This feature builds upon EVPN BGP signaling to provide Emulated Local Area Network (ELAN) multipoint-to-multipoint Ethernet services over an SRv6-based network.

This feature introduces the following ELAN-related behaviors:

• Ingress PE:

  • H.Encaps.L2.[Red] – Encapsulation of L2/Ether frame using SRv6

• Egress PE

  • End.DT2U – Decapsulation and Unicast MAC L2 Table Lookup

  • End.DT2M – Decapsulation and L2 Table Flooding

Automated steering of traffic of an EVPN ELAN service into the path associated with a best-effort or Flex-Algo locator is supported.

Modular QoS

Setting MPLS Experimental Bits on Inner MPLS Headers to Classify Traffic

For MPLS over GRE scenarios that tunnel MPLS traffic over non-MPLS networks across CE devices, you can now perform QoS classification for specific traffic or applications by setting MPLS EXP bit field values in the inner MPLS header.

In earlier releases, you could perform QoS classification only in the outer GRE IP header using DiffServ Code Point (DSCP) or IP precedence bits that helped you achieve the required line rate minus the granularity.

This feature introduces the hw-module profile qos gre-exp-classification-enable command.

BGP

BGP-LU Multipath PIC with Auto Protection

BGP-LU multipath prefix independent convergence (PIC) supports auto protection. Each active path has a backup path, ensuring almost immediate restoration of multicast traffic when a path fails.

In earlier releases, multipath configuration supports primary and backup path with a limitation that backup path can support only one failed path at a time.

BGP AS Path Replacement with Custom Values

You can now configure to replace the AS Path in BGP with custom values, based on route policy. While selecting the BGP best path, a shorter AS Path makes the selection process simple and flexible.

This feature introduces the following command:

replace as-path all

RIPng

RIPng (RIP next generation) is a RIPv2 extension that supports IPv6 which is the next-generation Internet Protocol. RIPng provides routing functionalities for an IPv6-based network. RIPng functions as an interior gateway protocol (IGP) in moderate-sized autonomous systems. RIPng uses Bellman-Ford distance-vector algorithm to determine the best route to an IPv6 destination. RIP enhancements for IPv6 include support for IPv6 addresses and prefixes; and the use of the all-RIP-devices multicast group address FF02::9 as the destination address for RIP update messages.

L2VPN and Ethernet Services

MAC Loop Prevention

This feature helps reduce network congestion and avoid traffic loss by shutting down a port after it reaches the configured number of MAC moves within the specified move interval. You can configure this feature at the bridge-domain level using the mac secure command.

This feature is now supported on routers that have Cisco NC57 line cards installed and operate in native and compatibility modes.

Multicast

Naming Data MDTs

You can deterministically control the multicast flows by assigning the flows to the named data MDTs.

Flexible Algorithm for Loop-Free Alternative Fast Reroute

You can build disjoint live-live paths or create specific paths with flexiblle algorithm constraints, have low-latency routing without IGP constraints.

MLDP route-policy supporting flexible algorithm-based filtering, which provides more granular enablement of FRR for LSPs, is also available

Flexible Algorithm for multicast VPN profiles

Flexible Algorithm is now available for the following profiles:

• Profile 12: Default MDT - MLDP - P2MP - BGP-AD - BGP C-Mcast Signaling

• Profile 14: Partitioned MDT - MLDP P2MP - BGP-AD - BGP C-Mcast Signaling

Interface and Hardware Component

2x50GbE Breakout Ports on Cisco NCS-55A1-24H Routers

You can now configure 2x50GbE breakout ports on all QSFP28 ports of the Cisco NCS-55A1-24H fixed port router.

SPAN Mirror First

This feature allows you to mirror only the first x-bytes of a packet, that is, only the packet header and not the payload to the destination. Thus, allowing enhanced data security without compromising user data.

With the introduction of this feature, you can use the mirror first option in the global configuration mode of the monitor-session command.

VLAN Subinterface as Source for Traffic Mirroring

You can now configure the VLAN subinterface as a source for traffic mirroring for:

• Traffic ingressing at the interface

• Traffic egressing at the interface

• Traffic egressing and ingressing at the same interface

You could configure mirror functionality only at the main interface level in earlier releases.

IP-in-IP tunnels with IPv6 over IPv4 Decapsulation

Routers can now transport IPv6 packets across routers supporting only IPv4 by encapsulating the IPv6 packets within IPv4 packets. Such an encapsulation helps the efficient passing of packets across different network protocols. These packets are eventually decapsulated at the destination IPv6 network. For more information, see IP-in-IP De-capsulation.

IP Addresses and Services

Scaling to higher LPTS entries using eTCAM

Implementing LPTS infrastructure using external TCAM (eTCAM) is supported on Cisco NCS 5700 series fixed-port routers and the Cisco NCS 5500 series routers that have the Cisco NC57 line cards installed and operating in the native mode. With this functionality, the LPTS routing packet entries are scaled to 12000. This helps in scaling the other protocol entries up to 1.5 times the current scale.

System Management

Automatic FPD upgrade for PSU

This feature enables the automatic FPD upgrade for PSUs. Prior to this release, automatic upgrades were not applicable to FPDs associated with the PSUs.

PTP and Frequency Synchronization on the NCS-57C1-48Q6-S chassis

Based on the IEEE 1588-2008 standard, PTP is a protocol that synchronizes clocks in a network for networked measurement and control systems.

With this release, timing support for IEEE 1588-2008 (PTPv2) telecom profiles is extended to the NCS-57C1-48Q6D-S chassis.

Flexible Consumption Model Licensing on the NCS-57C1-48Q6-SYS chassis

The Flexible Consumption Model (FCM) of licensing, which provides you with the capability and flexibility to purchase software capacity per your changing business requirements, is now available on the NCS-57C1-48Q6-SYS chassis.

System Monitoring

Platform Automated Monitoring for Blocked Processes

You can enable the Platform Automated Monitoring tool integrated into the Cisco IOS XR software image and receive alerts if any process is blocked. Several system failures can cause a blocked process, such as memory leak, network connection loss, and so on.

The tool collects the required data to troubleshoot the issue and generates a system log message with the name of the process that is currently blocked.

This feature introduces the following commands:

• enable-pam process-monitoring

• disable-pam process-monitoring

• show pam process-monitoring-status

System Security

MACSec Encryption on NCS-57C1-48Q6D-S

The NCS-57C1-48Q6D-S chassis on 400GE ports 0, 2, and 4 now support MACsec. This Layer 2 encryption protocol secures the data on physical media and provides data integrity and confidentiality.