BGP

256-way ECMP

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can enable efficient routing by supporting configuration of up to 256 ECMP next hops for BGP in both IPv4 and IPv6, enhancing bandwidth through multipath load balancing.

*This feature is supported on Cisco 8712-MOD-M router.

BGP DMZ transitive-bandwidth extended community support

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now enable BGP to process incoming DMZ transitive-bandwidth extended community, allowing bandwidth-aware routing decisions using Unequal Cost Multi-Path (UCMP). The feature allows RPL to manually set the DMZ transitive-bandwidth extended community for BGP neighbors.

This extended propagation supports multivendor interoperability, optimizes traffic distribution, prevents link over utilization, and balances load across available paths.

Previously, BGP supported only the non-transitive extended community.

The feature introduces these changes:

CLI:

The transitive-bandwidth type is introduced as an extended community in RPL.

YANG Data Models:

• Cisco-IOS-XR-um-route-policy-cfg

• Cisco-IOS-XR-policy-repository-cfg

(see GitHub, YANG Data Models Navigator)

BGP nexthop resolution over MPLS LSPs with RSVP-TE tunnels

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now prevent BGP prefixes from defaulting to native IP paths, which could lead to traffic drops due to the lack of BGP routing information on downstream core routers, by enforcing BGP nexthop resolution over MPLS LSPs with RSVP-TE tunnels. The feature gives you precise control over traffic steering by defining how BGP resolves nexthops and enabling route policies that consistently forward prefixes over RSVP-TE tunnels.

Previously, in core networks, downstream routers without BGP routes caused traffic to default to native IP paths instead of RSVP-TE LSPs, leading to potential drops.

The feature introduces these changes:

CLI:

The next-hop-type keyword is introduced as a filter type in route-policy .

YANG Data Models:

Cisco-IOS-XR-um-route-policy-cfg (see GitHub, YANG Data Models Navigator)

ECMP out of resource avoidance using ASN-based prefix download delay

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now ensure minimum packet loss and service disruption during network reconfigurations or migrations by preventing ECMP OOR conditions. The feature allows BGP to delay the download of BGP prefixes into the RIB and FIB until the router learns all paths from a specific ASN. This ASN-based delay dynamically optimizes resource utilization, and actively manages ECMP paths in real-time during network changes.

Previously, you could apply a fixed delay to all BGP prefixes using the prefix-ecmp-delay command.

The feature introduces these changes:

CLI:

• The ecmp-delay submode is introduced in the address-family command.

• show bgp { ipv4 unicast | ipv6 unicast } as-neighbors [as-number ]

YANG Data Models:

Cisco-IOS-XR-um-router-bgp-cfg

(see GitHub, YANG Data Models Navigator)

Flexible BGP Persistence

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You ensure continuous connectivity by enabling non-Long Lived Graceful Restart (LLGR) eBGP neighbors to use LLGR stale routes, allowing LLGR capability to be advertised without configuring a timeout value, and enhancing route management flexibility by advertising stale routes to non-LLGR peers using the NO_EXPORT community.

*This feature is supported on Cisco 8712-MOD-M router.

Per-VRF label allocation for VPN routes

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

Modifies the default label allocation from per-prefix to per-VRF, enabling you to enforce per-VRF label allocation for imported VPN routes with the advertise vpn-imported label-mode per-vrf command.

*This feature is supported on Cisco 8712-MOD-M router.

Selective FIB Download

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now selectively download BGP prefixes to the Routing Information Base (RIB) and Forwarding Information Base (FIB), preventing traffic drops by ensuring traffic follows default routes when specific destination routes are unavailable.

*This feature is supported on Cisco 8712-MOD-M router.

Programmability

Data logging with gNSI AcctzStream service

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now replace the bi-directional Acctz service with the unidirectional AcctzStream service, where the router continuously sends accounting records to the collector, while the collector initially sends only a timestamp. You configure maximum memory allocation for cached accounting history records, ensuring effective network optimization and resource utilization.

*This feature is supported on Cisco 8712-MOD-M router.

LLDP global and interface-level configuration enhancement

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now configure LLDP (Link Layer Discovery Protocol) global parameters without automatically enabling LLDP on all interfaces by default. This feature provides a granular operational control of the LLDP interface-level configurations.

By aligning with OpenConfig models, this feature introduces a more efficient operational control where LLDP is enabled on an interface only when both global and interface-level LLDP configurations are enabled.

Previously, LLDP was enabled if either configuration was present, potentially leading to inconsistent behavior.

The feature introduces these changes:

CLI:

• lldp interface-only

• Cisco-IOS-XR-um-lldp-cfg

(see GitHub, YANG Data Models Navigator)

TPM Enrollment and Attestation

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now enhance networking device security using the new gNSI service, EnrollZ and AttestZ, which verifies device identity and integrity during boot-up and provides owner-specific certificates. This open-source solution bypasses router vendor certificate authorities, ensuring a user-friendly and secure system where sensitive credentials are accessible only to devices completing the EnrollZ and AttestZ processes.

*This feature is supported on Cisco 8712-MOD-M router.

gNOI Containerz

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

The Containerz - gNOI service enables the onboarding and management of third-party applications via gNOI RPCs. Applications can be deployed using Docker images, ensuring easy integration and management. The service offers operations such as starting, stopping, updating containers, and managing docker volumes. This feature simplifies application deployment and management, enhancing operational efficiency.

For the specification on gNOI.healthz, see the GitHub repository.

gNOI Healthz

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

With gNOI Healthz, you monitor and troubleshoot device health by collecting logs and performing root-cause analysis on detected issues, enabling early identification and resolution of system health problems to reduce downtime and enhance reliability.

*This feature is supported on Cisco 8712-MOD-M router.

gNSI Acctz Logging

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now log and monitor AAA accounting of gRPC operations and CLI accounting data using gNSI Acctz, effectively managing the network for improved performance and resource utilization. Additionally, you configure the number of gNSI accounting records that can be streamed.

*This feature is supported on Cisco 8712-MOD-M router.

gRPC server TLS version 1.3 support

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now enhance network security by enabling TLS 1.3 support for gRPC services, providing stronger protection against vulnerabilities, eliminating outdated ciphers, and ensuring forward secrecy through unique session keys for each network session

*This feature is supported on Cisco 8712-MOD-M router.

Interface and Hardware Component

Copy TTL value to IP headers

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200]; Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q200])

We've introduced support for Time-to-Live (TTL) uniform mode, which allows copying TTL values from inner to outer headers during encapsulation and from outer to inner headers during decapsulation. This functionality allows the receiving device to accurately interpret the remaining lifespan of a packet. TTL uniform mode is enabled only for the pbr vrf-redirect mode in IP-in-IP tunnels.

DSCP bitmask to filter ingress ERSPAN traffic

Introduced in this release on: Fixed Systems ( 8700 [ASIC: K100]) (select variants only*)

You can now mirror multiple traffic flows on Encapsulated Remote SPAN (ERSPAN) by matching Differentiated Service Code Point (DSCP) values of the IP header, using the DSCP value and bitmask configured in Access Control List (ACL) rules. Previously, monitoring was limited to single traffic flows using RFC 4594 defined DSCP values in the GRE tunnel header. This feature expands monitoring capabilities across multiple traffic flows on supported hardware.

*This feature is supported on Cisco 8712-MOD-M router.

DSCP marking on egress GRE tunnel in ERSPAN

Introduced in this release on: Fixed Systems ( 8700 [ASIC: K100]) (select variants only*)

You can now set or modify the Differentiated Service Code Point (DSCP) value on the ERSPAN GRE tunnel header, allowing you to control the QoS for ERSPAN GRE tunnel traffic and simplify bandwidth management across next-hop routers for your customers.

*This feature is supported on Cisco 8712-MOD-M router.

Display of traffic rates for bundle interfaces

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

Routers now display a snapshot of traffic throughput and rate on all bundle interfaces over the last few seconds, presenting these statistics in a tabular format for easy analysis and quick reference.

*This feature is supported on Cisco 8712-MOD-M router.

ERSPAN over GRE IPv6

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

With this release, the router enables mirroring of IPv4 or IPv6 traffic using ERSPAN over GRE IPv6 sessions, allowing traffic monitoring on remote analyzers, expanding capabilities beyond the previous support limited to IPv4 networks.

*This feature is supported on Cisco 8712-MOD-M router.

ERSPAN rate limit

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature helps you monitor traffic flow through any IP network including third-party switches and routers by providing rate limiting of the mirroring traffic.

*This feature is supported on Cisco 8712-MOD-M router.

ERSPAN traffic to a destination in a non-default VRF

Introduced in this release on: Fixed Systems ( 8700 [ASIC: K100]) (select variants only*)

Encapsulated Remote Switched Port Analyzer (ERSPAN) now supports transporting mirrored traffic through GRE tunnels across multiple VRFs, facilitating network designs with multiple Layer 3 partitions. Previously, ERSPAN was restricted to GRE tunnels within the default VRF only.

*This feature is supported on Cisco 8712-MOD-M router.

Extended Support for QDD-400G-ZR-S and QDD-400G-ZRP-S Optical Module

This release introduces support for the QDD-400G-ZR-S and QDD-400G-ZRP-S optical module on the following line cards -

• 88-LC1-12TH24FH-E

• 88-LC1-36EH

Factory reset of routers to remove SSD data

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now securely reset your router to its original factory settings for troubleshooting or re-purposing. We have enhanced the existing factory reset functionality to remove data from the entire hard disk of the router, except the disaster recovery partition on the active RP.

Fault Recovery Handling

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now configure the number of fault recovery attempts by a line card, fabric card or a route processor before it permanently shuts down, thus preventing a faulty card from entering into a cycle of automatic recovery

*This feature is supported on Cisco 8712-MOD-M router.

Increase in number of CFM sessions

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

The number of supported Connectivity Fault Management (CFM) sessions has been increased to 500, enhancing fault detection, network visibility, scalability, and troubleshooting capabilities essential for managing high-performance networks.

*This feature is supported on Cisco 8712-MOD-M router.

Machine check error notifications

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now identify and resolve MCE-related issues quickly and easily because Cisco IOS XR Software displays a syslog notification for MCE errors, eliminating the need to manually check for them in the MCE log file.

*This feature is supported on Cisco 8712-MOD-M router.

Minimum-delay bin

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100]).

For statistics aggregation, you can now configure a distinct width for the first bin to adjust for large propagation delay. By using this feature, you can avoid wasting several bins that would be empty in some unavoidable situations such as delay due to speed of light limitations.

The feature introduces these changes:

CLI:

• The minimum-delay keyword is introduced in the aggregate and cfm-delay-measurement probe commands.

YANG Data Models: New XPaths for

• Cisco-IOS-XR-infra-sla-cfg.yang

• Cisco-IOS-XR-um-ethernet-sla-cfg.yang

• Cisco-IOS-XR-infra-sla-oper.yang

(see GitHub, YANG Data Models Navigator)

Monitor multiple ERSPAN sessions with SPAN and security ACL

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature now enables you to use SPAN and security ACL together to monitor multiple ERSPAN sessions under the same source interface thus distributing the mirrored traffic over different destination interfaces and allowing selective incoming traffic.

*This feature is supported on Cisco 8712-MOD-M router.

Remote Link State Propagation

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

Remote Link State Propagation enables link status communication to remote devices, ensuring network-wide awareness of link state changes. Link Loss Forwarding (LLF) utilizes this feature to propagate link failures to remote endpoints. By enabling remote state propagation and LLF on an interface, you ensure rapid communication of link state changes, facilitating quick failover and traffic rerouting.

*This feature is supported on Cisco 8712-MOD-M router.

SPAN-to-file in Tx direction

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

The routers can now provide reliable, always-available packet capture for post-event analysis, eliminating the need for prior configuration or user interaction.

The enhanced SPAN-to-File feature provides continuous packet capture and debugging capability with always-on functionality that starts automatically upon destination configuration. It prevents data loss during node reloads by periodically writing packet buffer contents to disk, without stopping the capture. A default SPAN-to-File session for forwarding and buffer drops is always active and can be disabled if not needed. The feature also supports packet truncation and sampling in software for software-mirrored packets, independent of NPU capabilities.

*This feature is supported on Cisco 8712-MOD-M router.

Secure erase of router SSD data

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now efficiently and securely manage the data and configuration settings on your routers by ensuring complete removal of sensitive data from the routers that are to be decommissioned, or for security purposes. This feature securely erases the solid state drive (SSD) data on a particular card such as a line card or a route processor, or on the entire router and shuts it down.

The feature introduces these changes:

CLI:

• secure-erase

YANG Data Model:

• Cisco-IOS-XR-secure-erase-act

Up MEP and Down MEP Support in CFM

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature introduces Maintenance End Points (MEP) entities that you can configure in a domain.

*This feature is supported on Cisco 8712-MOD-M router.

Integrated Routing and Bridging (IRB)

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]) (select variants only*)

Integrated Routing and Bridging (IRB) provides the ability to exchange traffic between bridging services on a router and a routed interface using a Bridge-Group Virtual Interface (BVI). IRB over BVI enables seamless communication between Layer 2 bridging and Layer 3 routing by using BVI as a logical interface.

• 88-LC1-12TH24FH-E

• 88-LC1-52Y8H-EM

IP Addresses and Services

Configure DHCPv6 relay source address

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now select an IPv6 address from the configured relay source-interface to be used as the source address for forwarding packets to a server. By selecting a fixed source address, the need to frequently update firewall rules when new, lower-value IPv6 addresses are added is minimized.

Previously, the router automatically used the lowest numbered IPv6 address configured on that interface as the source address.

The feature introduces these changes:

• The dhcpv6 relay source address variable is introduced in the helper-address (ipv6) command.

YANG Data Model: Cisco-IOS-XR-ipv6-new-dhcpv6d-cfg.yang

(see GitHub, YANG Data Models Navigator)

Viewing TCAM usage for source prefixes

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200], Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q200])

This features ensures that source prefixes of the egress hybrid ACLs are now stored in a separate TCAM interface, enabling accurate resource monitoring and tracking. Use the show controllers npu resource egressacltcam location command to view the TCAM usage.

In earlier releases, while the destination prefixes of the hybrid ACLs were stored in the ACL TCAM interface, the source prefixes were unreported, making it challenging to monitor their accurate TCAM resource usage.

Enhanced 24 bit compression for object-group ACLs

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

This release introduces support for more efficient handling of extended network object-groups by expanding source and destination compression results.

This is achieved by enabling support for 24 bit bincode sizes for both source and destination prefixes in the ingress object-group ACLs, which accommodates larger and more detailed prefix lists for supporting more complex network object-groups and configurations.

Prior to release 25.1.1, this capability was limited to 20 bit compression for both source and destination prefixes, restricting the length and variability of network prefixes that could be managed within ACLs.

Extending egress hybrid ACL support to P100-based ASICs

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100]); Modular Systems (8800 [LC ASIC: P100])

Compression levels for object-group ACLs, also known as hybrid ACLs, can now be applied to egress traffic. This ACL compression optimizes the usage of TCAM space, allowing the router to support additional ACLs or features and ensuring efficient utilization of the limited TCAM resources available.

Option 82 support in DHCP packets

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]) (select variants only*)

By utilizing DHCP Relay Agent Option 82 functionality, you can now enhance the network security by ensuring that DHCP allocates network addresses only to trusted sources. This reduces the risk of unauthorized devices gaining network access. You can achieve this by assigning Option 82 circuit ID and Remote ID per Ethernet Flow Points (EFP) or per ingress Layer 2 interface in the DHCP packet.

*This feature is supported on:

• 88-LC1-52Y8H-EM

• 88-LC1-12TH24FH-E

Support for DHCP client

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]) (select variants only*)

This release introduces the Dynamic Host Configuration Protocol (DHCP) client functionality. DHCP client is crucial for efficiently managing IP address allocation in a network. It enables router interfaces to dynamically obtain server information for DHCPv4 or DHCPv6, and ensures that the configuration responses are sent to the appropriate Layer 2 addresses. This process ensures that each device on the network receives the correct configuration data.

*This feature is supported on:

• 88-LC1-52Y8H-EM

• 88-LC1-12TH24FH-E

Extending DHCP Relay agent support

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]) (select variants only*)

This release introduces support for DHCP Relay Agent and DHCPv6 Relay Over BVI for IANA Address Allocation to Cisco Silicon One P100 ASIC-based systems.

The feature, enabled by default, efficiently allocates IP addresses from a centralized DHCP server to clients across multiple subnets. It ensures that devices can receive IP addresses even when they are not on the same local network as the DHCP server.

*The feature is supported on:

• 88-LC1-52Y8H-EM

• 88-LC1-12TH24FH-E

Enabling HSRP and VRRP over BVI

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]) (select variants only*)

You can now enable Hot Standby Router Protocol (HSRP) and Virtual Router Redundancy Protocol (VRRP) over BVI on Cisco Silicon One P100 ASIC-based systems.

This feature, enabled by default, ensures continuous network availability by automatically switching to a standby router if the active router fails. This minimizes downtime and maintains network reliability.

*The feature is supported on:

• 88-LC1-52Y8H-EM

• 88-LC1-12TH24FH-E

L2VPN

EVPN IRB with distributed anycast gateway

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100])(select variants only*)

EVPN Integrated Routing and Bridging (IRB) facilitates efficient Layer 3 communication across subnets, leveraging PE routers for connectivity over MPLS or IP networks. It supports single and multi-homing, processes packets using VRF table lookups, and enables seamless EVPN to IP VPN communication without route stitching or re-origination.

A distributed anycast gateway enhances routing by sharing IP/MAC addresses for load balancing and redundancy, ensuring optimal performance and reduced latency.

* This feature is supported on:

• 88-LC1-12TH24FH-E

• 88-LC1-52Y8H-EM

L2 VLAN Subinterface Encapsulation and Rewrite

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now use the VLAN Subinterface Encapsulation and Rewrite operations to:

• Configure exact matching for all single-tagged encapsulations.

• Support legacy Q-in-Q encapsulation 0x9100/0x8100.

• Enable priority tagged traffic to map to the specified interface.

*This feature is supported on Cisco 8712-MOD-M router.

VLAN tag format support for load balancing for line cards and routers with the A100 and K100 based Silicon One ASICs

Introduced in this release on: Fixed Systems 8700 [ASIC: K100]), 8010 [ASIC: A100])

Introduced support for the following VLAN tags on line cards and routers with the A100 and K100 based Silicon One ASICs:

• Single VLAN tag 0x88A8

• QinQ with outer 0x8100 and inner 0x8100

• QinQ with outer 0x9100 and inner 0x8100

Introduced support for BUM traffic in VPLS service load balancing.

MPLS

Improved scale for MPLS over UDP tunnels

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

To handle high traffic volume, you can enhance the MPLS over UDP tunnel scale up to 15284 tunnels using the hw-module profile cef mplsoudp scale command.

*This feature is supported on Cisco 8712-MOD-M router.

Prevention of IP traffic steering over MPLS-TE tunnel

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature allows to prevent the MPLS labelled traffic or IP traffic to destinations associated with a segment routing prefix SID from resolving over the MPLS-TE tunnel thus ensuring optimal hardware resource utilization.

This feature enhances the existing configuration that prevents only the MPLS labelled segment routing traffic from steering into the MPLS-TE tunnel.

*This feature is supported on Cisco 8712-MOD-M router.

RSVP-TE Transport Solution with Flex LSP Headend

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can enable the router to compute

• a primary LSP path,

• a secondary LSP path,

• a dynamic restore path serves as a backup to the primary LSP path, and

• another dynamic restore path acts as a backup to the secondary LSP path.

During the primary LSP path failure, the headend router computes a new dynamic restore primary path by reusing the links from the failed primary LSP path, and during the secondary LSP path or backup path or protecting path failure, the headend router computes a new dynamic restore path by reusing the links from the failed secondary LSP path.

CLI:

The protected-by keyword is enhanced to include two backup paths in the path-option command.

RSVP-TE transport solution using PCE

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100])(select variants only*); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])(select variants only*)

You can now enable a centralized Path Computation Element (PCE) server to perform LSP path computations for primary, secondary, and restore paths.

The PCE efficiently tracks and manages network resources, handling multiple LSP requests and complex network environments.

It optimizes LSP routing by dynamically adapting to network changes, reducing crank-back, and enhancing traffic engineering.

*This feature is now supported on:

• 8212-48FH-M

• 8711-32FH-M

• 8712-MOD-M

• 88-LC1-12TH24FH-E

• 88-LC1-52Y8H-EM

Increased link bandwidth capacity for RSVP-TE

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

We have upgraded RSVP-TE to support link bandwidths up to 10 Pbps, essential for integrating high-capacity interfaces. This is made possible by enabling support for 64-bit in addition to the existing 32-bit bandwidths. Previously, RSVP-TE was limited to supporting link bandwidths up to 4.3 Tbps.

The feature introduces these changes:

CLI:

Increase in bandwidth range values for keywords in the bandwidth mam and bandwidth rdm commands:

• total-reservable- bandwidth

• max-reservable-bw

Multicast

IGMP snooping

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]) (select variants only*).

This feature is enhanced to support:

• IGMP snooping on BVI, and

• IGMP versions IGMPv2 and IGMPv3, providing backward compatibility and enhanced features like source-based filtering.

*This feature is supported on:

• 88-LC1-12TH24FH-E

• 88-LC1-52Y8H-EM

Internet Group Management Protocol

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

Internet Group Management Protocol (IGMP) is a network protocol that allows devices to join multicast groups in IPv4 networks. IGMP helps routers manage multicast group memberships, ensuring that it sends data only to networks where there are active members, further optimizing network efficiency.

*This feature is supported on Cisco 8712-MOD-M router.

LSM mLDP based MVPN bud or tail node enhancements on edge routers

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

With this feature, the BUD node is now supported on these profiles: 0, 1, 3, 4, 6, 7, 8, 11, 14, 21, and 22.

*This feature is supported on Cisco 8712-MOD-M router.

MLD snooping

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]) (select variants only*).

This feature is enhanced to support:

• MLD snooping on BVI, and

• MLD versions MLDv1 and MLDv2.

*This feature is supported on:

• 88-LC1-12TH24FH-E

• 88-LC1-52Y8H-EM

Multicast IRB

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]) (select variants only*).

Multicast Integrated Routing and Bridging (IRB) enables the routing of multicast packets into and out of a bridge domain through a Bridge-Group Virtual Interface (BVI). This feature supports:

• Both IPv4 and IPv6 protocols

• IGMP snooping and MLD snooping on BVI Interfaces, and

• Native multicast for MVPN profiles 0, 6, and 14.

*This feature is supported on:

• 88-LC1-12TH24FH-E

• 88-LC1-52Y8H-EM

Multicast Route Statistics

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

Starting with this release, the route statistics counters are programmed on the ingress line card, making traffic measurement more efficient.

The stats-ole counter-based implementation is activated when at least one of the Cisco Silicon One Q100 or Q200 ASIC-based systems, along with the Cisco Silicon One P100 ASIC-based systems, is operational on a router.

When stats-ole counter-based implementation is active, the show mrib route detail command output shows stats-ole location; otherwise, it shows INVALID.

*This feature is supported on Cisco 8712-MOD-M router.

Multicast Traffic over Layer 2 IPv6 Network

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature allows you to forward the IPv6 multicast packets only to the interested MLD-snooped Access Controllers (AC), whereas in the default case, the bridge floods the IPv6 multicast packets to all AC.

Routers use Multicast Listener Discovery (MLD) protocol to discover the devices in a network and create route entries in an IPv6 multicast network.

*This feature is supported on Cisco 8712-MOD-M router.

Protocol Independent Multicast

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

Protocol Independent Multicast (PIM) is a routing protocol used to route IP multicast traffic efficiently. Using PIM, you can route IP multicast traffic over various underlying unicast routing protocols, such as OSPF, BGP, or RIP. As a result, PIM Is a robust solution for managing multicast traffic in varied and evolving network environments.

*This feature is supported on Cisco 8712-MOD-M router.

mLDP Loop-Free Alternative Fast Reroute

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

When this feature is enabled, mLDP relies on the Loop-Free Alternative algorithm to calculate the primary and backup, which is also referred as fast re-route path. During the event of a link failure, the router uses this precomputed backup path to send the multicast traffic. The fast switchover helps to reduce multicast traffic loss and the switchover time is less than 50 milliseconds.

*This feature is supported on Cisco 8712-MOD-M router.

NetFlow and sFlow

Mirror and Stream Dropped Packets on sFlow with SPAN

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100])

sFlow now supports buffer drop and forward-drop streaming, enhancing its capability to capture packets dropped by the Traffic Management (TM) buffer when full. This feature allows streaming of mirrored copies of these packets using SPAN, ensuring effective traffic monitoring even during process restarts or network failovers. Additionally, it mirrors forward-drop packets to capture and analyze packets dropped at router ingress, aiding in understanding blocked traffic types, identifying potential security threats, and optimizing network performance.

The feature introduces these changes:

CLI:

• The destination flow command is introduced.

Cross AFI BGP NH Information Element

IPv4 or IPv6 flows in BGP can now handle next-hop Information Element (IE) across different address families, such as IPv4 and IPv6. This is particularly useful in scenarios where IPv4 and IPv6 networks need to interoperate.

These IEs are added to the existing NetFlow or IPFIX template for record ipv4 and all the IPv4 variant record types:

• BgpNextHopIPv6Address (IE 63)

• IpNextHopIPv6Address (IE 62)

• IpNextHopIPv4Address (IE 15)

These IEs are added to the existing NetFlow or IPFIX template for record ipv6 and all the IPv6 variant record types:

• BgpNextHopIPv4Address (IE 18)

• IpNextHopIPv6Address (IE 62)

• IpNextHopIPv4Address (IE 15)

These IEs provide a detailed and structured data that is essential for various network operations and analyses.

The feature uses the exiting CLI commands. For more information see, IPFIX Enablement for SRv6 and Services over SRv6 Core.

Modular QoS

Egress class-level traffic shaping for subinterfaces

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]))

Egress class-level traffic shaping for subinterfaces is now supported on the fixed systems using K100 Silicon One ASICs.

Priority Propagation on Egress Queues

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now ensure that high-priority traffic is consistently prioritized across multiple sub-interfaces on the same network port, enhancing the performance of critical applications.

This is achieved by enabling support for egress queuing policy maps that allow high-priority P1 traffic (on class TC7) to take precedence over non-P1 traffic across sub-interfaces. This feature ensures that critical traffic, such as voice or real-time video, is always given the highest priority, regardless of the sub-interface it is associated with, thereby maintaining optimal network performance and reducing latency for essential services.

* This feature is supported on Cisco 8712-MOD-M routers.

Routing

BFD over pseudowire headend

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature which allows rapid pseudowire failure detection minimizes downtime, ensuring service reliability by continuously monitoring end-to-end, maintaining Layer 2 VPN and Ethernet service integrity.

*This feature is supported on Cisco 8712-MOD-M router.

BGP 256-way UCMP for enhanced bandwidth and load distribution

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You can now configure up to 256 unequal cost multipath (UCMP) next hops for BGP in both IPv4 and IPv6, significantly enhancing the previous limit of 64. This increase allows for improved network bandwidth and more effective load balancing across parallel paths.

Bidirectional forwarding detection over VXLAN tunnel

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now monitor VXLAN tunnel health and rapidly detect failures, facilitating faster traffic rerouting and enhancing network availability. This feature ensures high availability by providing continuous oversight of VXLAN tunnel integrity, allowing network operators to swiftly address and mitigate potential disruptions, thereby maintaining seamless connectivity and service reliability.

*This feature is supported on Cisco 8712-MOD-M router.

IS-IS protocol shutdown mode

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now gracefully shut down IS-IS on an interface or router without abruptly interrupting network operations. This feature simplifies operations by consolidating multiple steps into a single command, ensuring network stability during maintenance or configuration changes.

*This feature is supported on Cisco 8712-MOD-M router.

LSP Fast-Flooding on IS-IS Networks

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now accelerate the rate at which Link State Packets (LSPs) are distributed across an IS-IS network. Faster LSP distribution means faster network convergence. This faster convergence ensures that the most accurate topology information is quickly available across all routers on the network, reducing the chances of routing loops or misrouting.

*This feature is supported on Cisco 8712-MOD-M router.

Segment Routing

BGP Signaling for co-existence of IP routes

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

SRv6 with BGP supports the coexistence of IP routes with or without SRv6 SID over an SRv6-enabled core network. This support enables integrating SRv6 capabilities into existing network infrastructures without replacing IP routing completely.

This feature enables flexibility and scalability, transition to new technologies, and enhanced network efficiency, making it easier to migrate from MPLS to SRV6.

*This feature is supported on Cisco 8712-MOD-M router.

Dual-Stack L3VPN Services (IPv4, IPv6) (SRv6 Micro-SID)

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature introduces support for Dual-stack (VPNv4/VPNv6) VRFs.

VPNv4/VPNv6 Dual-stack supports both IPv4 (uDT4) and IPv6 (uDT6) based SRv6 L3VPN service on the same interface, sub-interface, or VRF.

Dual stacking allows operators to access both IPv4 and IPv6 simultaneously and independent of each other. It avoids the need to translate between two protocol stacks. This results in high processing efficiency and zero information loss.

*This feature is supported on Cisco 8712-MOD-M router.

Far-end delay metrics in one-way measurement mode

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

Segment Routing Performance Monitoring (SR PM) allows operators to compute near-end and far-end delay metrics, enhancing end-to-end delay visibility and enabling precise monitoring and assessment of network performance. Previously, only near-end delay metrics were measurable, limiting the ability to fully evaluate delays across the entire data path.

*This feature is supported on Cisco 8712-MOD-M router.

Flexible algorithm with bandwidth optimization

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

The enhanced IGP flexible algorithm path computation optimizes routing paths by automatically adjusting to changes in link bandwidth, which is especially beneficial for handling parallel L3 links and dynamic bandwidth variations, such as in L2 link bundles. The algorithm ensures optimal capacity paths by considering the cumulative bandwidth of parallel links and prefers paths with the highest available bandwidth, improving performance for high-bandwidth traffic flows. In addition to traditional metrics like link delay or monetary cost, the algorithm can also optimize paths based on the maximum available bandwidth of links, which can be locally configured or computed from advertised link bandwidth.

* This feature is supported on Cisco 8712-MOD-M routers.

Full-Replace Migration to SRv6 Micro-SID

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature enables migration of existing SRv6 SID format1 to SRv6 Micro-SIDs (f3216) formats.

Earlier, only one format was supported at a time, and you had to choose either format1 or Micro-SID format for the deployment of services. Migration from Full-length SIDs to SRv6 Micro-SIDs was not possible.

*This feature is supported on Cisco 8712-MOD-M routers.

H.Encap.Red headend behavior

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

The H.Encap.Red is a headend behavior that encapsulates the original packet into a new IPv6 packet with a Segment Routing Header (SRH). By encapsulating with the SRH, you can control and manage the path the data packets take through a network.

*This feature is supported on Cisco 8712-MOD-M routers.

Per-Prefix SRv6 Locator Assignment

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature allows you to assign a specific SRv6 locator for a given prefix or a set of prefixes (IPv4/IPv6 GRT, IPv4/IPv6 VPN).

The egress PE advertises the prefix with the specified locator. This allows for per-prefix steering into desired transport behaviors, such as Flex Algo.

*This feature is supported on Cisco 8712-MOD-M routers.

SR Policy Liveness Monitoring - Hardware Offloading

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])

The process of liveness monitoring in performance measurement can now be offloaded to the router's dedicated hardware, which is the Network Processing Unit (NPU). This feature helps optimize and scale the measurement operation, enabling the operators to meet delay-bound Service Level Agreements (SLAs).

* This feature is supported on:

• 8212-48FH-M

• 8711-32FH-M

• 8712-MOD-M

• 88-LC1-36EH

• 88-LC1-12TH24FH-E

• 88-LC1-52Y8H-EM

SR-TE policy with enhanced flexible algorithm metric types

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

We have enhanced the SR-TE policy at headend with flexible algorithm that supports additional metric types, user-defined and bandwidth, ensuring consistent path computation across flexible algorithm metric types and constraints, on both intra-IGP and inter-IGP domains. The feature also supports headend computed inter-domain SR policies with Flex Algo constraints and IGP redistribution or leaking.

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6 Micro-Segment (uSID)

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6 Provider Edge (PE) Lite

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature provides VPN de-multiplexing-only behaviors (End.DT4/DT6/DT46) at an SRv6 PE node. This allows for a lightweight-PE implementation (no VPN encapsulation) that steers SRv6-encapsulated traffic across an SR-MPLS backbone after performing a VPN lookup.

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6 Services: BGP Global IPv6

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

With this feature, the egress PE can signal an SRv6 Service SID with the BGP global route. The ingress PE encapsulates the IPv4/IPv6 payload in an outer IPv6 header where the destination address is the SRv6 Service SID provided by the egress PE. BGP messages between PEs carry SRv6 Service SIDs to interconnect PEs.

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6 Services: IPv6 L3VPN

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

With this feature, the egress PE can signal an SRv6 Service SID with the BGP overlay service route. The ingress PE encapsulates the IPv4/IPv6 payload in an outer IPv6 header where the destination address is the SRv6 Service SID provided by the egress PE. BGP messages between PEs carry SRv6 Service SIDs to interconnect PEs and form VPNs.

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6 Services: L2 and L3 Services with Remote SIDs from Wide Local ID Block

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature enables an SRv6 headend node to receive and install remote SIDs with Wide (32-bit) functions (Remote W-LIB).

The Remote W-LIB is supported for Layer 3 (VPN/BGP global) and Layer 2 EVPN services (ELINE/ELAN).

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6 Traffic Accounting

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now enable the router to record the number of packets and bytes transmitted on a specific egress interface for IPv6 traffic using the SRv6 locator counter.

You can use this data to create deterministic data tools to anticipate and plan for future capacity planning solutions.

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6 VPN BGP Route Leaking

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature supports SRv6 VPN Route-leaking between Global Routing Table (GRT) and Virtual Routing and Forwarding (VRF). This enables Enterprise IPv4 internet connectivity.

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6 double recursion for multilayer BGP underlay

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

The feature introduces support for SRv6 double recursion, where network services such as BGP VPNs (Layer 2 and Layer 3) require multiple resolution layers. Specifically, one routing layer resolves over another before reaching the final destination. Double recursion is achieved by collapsing the underlay, typically involving protocols like IGP or BGP in the packet forwarding chain. This enables three-level load balancing and an even distribution of traffic across multiple layers of the network stack.

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6 services on EVPN E-Line

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

SRv6 services on EVPN E-Line offers a modern approach to simplify and enhance network operations.

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6 with Full-Length SIDs

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature extends Segment Routing support with IPv6 data plane.

In a Segment Routing over IPv6 (SRv6) network, an IPv6 address serves as the Segment Identifier (SID). The source router encodes the path to destination as an ordered list of segments (list of IPv6 addresses) in the IPv6 packet using a new header for SRv6 called a Segment Routing Header (SRH). In an SRv6 enabled network, the active segment is indicated by the destination address of the packet, and the next segment is indicated by a pointer in the SRH.

* This feature is supported on Cisco 8712-MOD-M routers.

SRv6-Services: L3 Services with Local SIDs from W-LIB

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature enables an SRv6 headend node to allocate and advertise local SIDs with Wide (32-bit) functions (Local W-LIB).

The headend router utilizes the local W-LIB functionality to define and implement SR policies using SRv6 SIDs.

The Local W-LIB is supported for Layer 3 (VPNv4/VPNv6/BGPv4/BGPv6 global) services.

* This feature is supported on Cisco 8712-MOD-M routers.

Segment routing Tree-SID interoperability and SR-P2MP enhancements

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

The feature introduces enhancements to the SR Tree-SID functionality and SR-P2MP Policy, enabling full alignment with the Path Computation Element Protocol (PCEP) standard as per IETF specifications. These improvements enable interoperability between Path Computation Client (PCC) devices from different vendors connected to the PCE.

* This feature is supported on Cisco 8712-MOD-M routers.

Support for End.DT46 SRv6 Endpoint Behavior

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature adds support for the “Endpoint with decapsulation and specific IP table lookup” SRv6 end-point behavior (End.DT46).

The End.DT46 behavior is used for dual-stack L3VPNs. This behavior is equivalent to the single per-VRF VPN label (for IPv4 and IPv6) in MPLS.

* This feature is supported on Cisco 8712-MOD-M routers.

Support for uDT46 SRv6 Endpoint Behavior

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature adds support for the “Endpoint with decapsulation and specific IP table lookup” SRv6 end-point behavior (uDT46).

The End.DT46 behavior is used for dual-stack L3VPNs. This behavior is equivalent to the single per-VRF VPN label (for IPv4 and IPv6) in MPLS.

* This feature is supported on Cisco 8712-MOD-M routers.

VRF-to-VRF route leaking in SRv6 core

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

VRF-to-VRF route leaking enables sharing of routes between VRFs while maintaining their isolation. This feature allows the source VRF to send leaked routes to remote PEs or Route Reflectors (RRs) across an SRv6 core network, similar to an MPLS core network, enabling communication between different service tenants or administrative domains without compromising VRF isolation.

* This feature is supported on Cisco 8712-MOD-M routers.

System Management

Concurrent Configuration Rebase during Commit

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

The router performs the commit and rebase operations simultaneously, ensuring that the commit operation remains unblocked during the rebase operation.

* This feature is supported on Cisco 8712-MOD-M routers.

Support for Precision Time Protocol on 8K-MPA-18Z1D Modular Port Adapter for the Cisco 8712-MOD-M router

Introduced in this release on: Fixed Systems ( 8700 [ASIC: K100] (select variants only*)

* With this release, support for PTP telecom profiles G.8275.1, G.8273.2, G.8265.1, and G.8275.2 is extended to the 8K-MPA-18Z1D Modular Port Adapter on the Cisco 8712-MOD-M router.

System Monitoring

Monitor data plane health

Introduced in this release on: Modular Systems (8800)

Routers and linecards with the P100, K100, and A100 based Silicon One ASIC support data plane health check utility.

Monitor interface

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

The filter physical keyword was introduced, along with new columns InDrops and OutDrops in the output, to provide enhanced monitoring capabilities for physical interfaces.

* This feature is supported on Cisco 8712-MOD-M routers.

Packet Tracer

Introduced in this release on: Fixed Systems (8700 [ASIC: K100])

Packet Tracer is a framework that enables you to trace custom flows through the router for service validation or troubleshooting.

This feature utilizes the existing XR packet tracing infrastructure to facilitate debugging of packet flows at the ASIC and hardware levels.

CLI:

This feature introduces the following commands.

• packet-trace start

• packet-trace stop

• packet-trace condition

• clear packet-trace conditions all

• clear packet-trace counters all

• show packet-trace status [detail]

• show packet-trace result

• packet-trace description

Third-party applications logging on remote server

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature enables third-party applications to forward syslog messages to a remote server for handling a high rate of system logging.

* This feature is supported on Cisco 8712-MOD-M routers.

System Security

802.1X port-based authentication

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100]); Modular Systems (8800 [LC ASIC: P100])

You can now secure network access by requiring client network devices to authenticate with encrypted digital certificates before gaining access.

The 802.1X port-based authentication ensures that a port remains closed to all traffic until the connected client successfully completes authentication using the Extensible Authentication Protocol with TLS (EAP-TLS) encryption. This prevents unauthorized access and enforces secure, certificate-based communication, enhancing network security and integrity.

EST protocol for automated certificate provisioning

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

This release introduces support for Enrollment over Secure Transport (EST), a digital certificate provisioning protocol, which enhances certificate management by offering secure transport using TLS and designated certificate requestors. It enables automated certificate renewal.

EST is an enhancement of the existing Simple Certificate Enrollment Protocol (SCEP), providing improved security and flexibility for certificate management operations over both IPv4 and IPv6 networks.

The feature introduces these changes:

CLI:

• The method-est keyword is introduced in the crypto ca trustpoint command.

• The client-authentication command is introduced.

• The SSL-profile command is introduced.

YANG Data Model:

• Cisco-IOS-XR-crypto-cepki-cfg

• Cisco-IOS-XR-um-crypto-cfg

(see GitHub, YANG Data Models Navigator)

IPv6 support for CA enrollment URL

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can enhance network compatibility and simplify management in modern network environments using IPv6 addresses and CA server URLs that resolve to IPv6 addresses as enrollment URLs for the CA hosted on IPv6-based servers. This improvement addresses previous limitations that caused configuration issues and failures when using IPv6 CA enrollment URL.

* This feature is supported on Cisco 8712-MOD-M routers.

MACsec encryption on 8712-MOD-M

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

* This feature is supported on Cisco 8712-MOD-M routers.

Multi-auth MAC Authentication Bypass

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can enhance network flexibility by enabling multiple hosts on a single port using MAC Authentication Bypass (MAB). The router now supports up to two clients per port by expanding its MAC learning capability from one to two. It authenticates each MAC address individually, allowing multi-domain authentication and enabling independent management of two endpoints. This feature simplifies network management and increases the connectivity options for devices per port.

* This feature is supported on Cisco 8712-MOD-M routers.

Per-NPU hash rotation

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now configure the hash rotation value for each Network Processing Unit (NPU) to improve traffic load balancing and minimize traffic polarization. Alternatively, the value can be automatically calculated, eliminating the need for manual configuration.

* This feature is supported on Cisco 8712-MOD-M routers.

Power-on self-test KAT with MACSec on 8606 series routers

Introduced in this release on: Centralized Systems (8600 [ASIC: Q200])

We have introduced the integration of Known Answer Tests (KAT) with MACsec on Cisco 8606 Series Routers, supporting secure communication, operational reliability, and stringent security standards for government and enterprise networks. This integration ensures cryptographic integrity and enhances security through algorithms like SHA and DES, supporting FIPS compliance. To achieve this, you can enable the hw-module macsec-fips-post command. You can achieve this by enabling the hw-module macsec-fips-post command.

MACsec mode on Cisco 8608 routers

Introduced in this release on: Centralized Systems (8600 [ASIC:Q200])

Enabling MACsec mode ensures allocation of the required power for all MACsec ports and thereby prevents interface flap when MACsec feature is enabled on a port.

Starting this release, the functionality to enable MACsec mode using the hw-module macsec-mode command is extended to the physical layer transceiver (PHY) of Cisco 8608 routers.

8K-MPA-18Z1D on Cisco 8712-MOD-M Router

This release introduces the 8K-MPA-18Z1D is a Modular Port Adapter (MPA) with these highlights:

• Nineteen ports provide an overall throughput of 1.3T of Tbps -

  • Eighteen ports of 50GbE using zSFP56+optics; supports 50GbE, 25GbE, 10GbE and 1GbE

  • One port of 400GbE using QSFP-DD optics; supports 400G-ZR/ZR+, 400GE, 4x100GE, 2x100GE, 100G-ZR+/100G-ZR, 100GE, 4x25GE, 40GE,4x10GE

• PTP Timing with Class C performance

The 8K-MPA-18Z1D is supported on Cisco 8712-MOD-M fixed port chassis.

For more information on this line card, see the Cisco 8000 Series Routers Data Sheet.

8804-FC1 Fabric Card based on F100 Silicon Chip

The Cisco 8804 Series Routers supports the Cisco 8804 fabric card (8804-FC1).

The 8804-FC1 fabric card is based on a Silicon One F100 ASIC. It provides 20.4 Tbps of switching capacity with Q200 or P100 Silicon One line cards and can reach up to 21.2 Tbps throughput.

Because of the higher switching capacity, this fabric card offer benefits, such as faster communication, lower latency, and ability to manage higher data flows.

The fabric card supports 8FC modes.

Optics

Note: Optics support varies across devices (routers, line cards, RPs, and so on). To know if an optics is compatible with a specific Cisco device, refer to the Transceiver Module Group (TMG) Compatibility Matrix.

This release introduces the following optics:

• QSFP-100G-B20U4-I

• QSFP-B20D4-I