Release Notes for Cisco 8000 Series Routers, IOS XR Release 26.3.1

BGP

Software Reliability

BGP full add-path reflection

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100, Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You gain full visibility into all unique eligible BGP paths per prefix as route reflectors can now advertise multiple unique paths, not just one per next hop. This enables more informed routing and traffic engineering, with exact duplicate paths still suppressed.

Software Reliability

BGP FIB Out of Resources mitigation

Introduced in this release on: Fixed Systems (8010 [ASIC: A100]), (8200 [ASIC: Q100, Q200], (8700 [ASIC: K100]) (select variants only*)

When the IOS-XR Forwarding Information Base (FIB) approaches hardware resource limits, the system employs a BGP-driven eviction mechanism to maintain operational stability. This process ensures that system performance is preserved by selectively removing routes rather than suffering unpredictable hardware-level failures.

IP Addresses and Services

Software Reliability

Inline ACL action modifications

Introduced in this release on: Fixed Systems (8010 [ASIC: A100], 8700 [ASIC: K100, P100], 8200 [ASIC: P100]); Modular Systems (8800) (select variants only*)

Adds inline hardware updates for supported action-only changes to existing ACL entries. Match-field changes continue to use the existing hardware update method.

The update method is selected automatically and does not add a configuration command.

*This feature is supported on:

Line cards:

Interface and Hardware Component

Ease of Setup

Support for auto negotiation on 1G fiber optics

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This release introduces auto negotiation on 1G fiber optics across 1G-capable hardware. Enable this support by configuring the negotiation auto command on the 1G optics.

*This feature is supported on 8KMPA-18Z1D Modular Port Adapter.

Upgrade

Optics firmware management and upgrade using CMIS CDB

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100]); Modular Systems (8800 [LC ASIC: P100]

You can centrally manage, upgrade, and monitor optical transceiver firmware using CLI commands and CMIS CDB, streamlining bulk and targeted updates while reducing manual steps and errors. This feature delivers faster, automated firmware operations in large or multi-vendor environments.

Upgrade

Extended Support for DP04QSDD-ULH-A1 optical module

This release introduces support for the Cisco 400G QSFP-DD Ultra Long-Haul (ULH) coherent optical module on this router:

The 400G QSFP-DD ULH optics are supported on port numbers 0 and 3.

Software Reliability

Auto-negotiation support for 1G SFP optical ports

Introduced in this release on: Fixed Systems (8010 [ASIC: A100]) (select variants only*)

You can ensure compatibility between new and legacy routers by enabling auto-negotiation on the Gigabit interfaces of the connected routers. This process allows the routers to exchange key parameters such as mode, speed, and flow control, enabling them to agree on common transmission settings. As a result, the link achieves optimal bandwidth utilization.

*This feature is supported on:

Ease of Use

CFM Down MEPs without L2VPN services

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200], 8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: Q200, P100])

You can now monitor direct L2 links and L2 transport interfaces with CFM Down MEPs without creating an L2VPN service only to enable CFM. This support reduces configuration overhead for standalone L2 interface monitoring.

The support applies to physical interfaces, physical subinterfaces, bundle interfaces, and bundle subinterfaces. CFM continues to operate when L2VPN configuration is added to or removed from the same interface.

Hardware Reliability

Partial breakout for 4×100GE QSFP‑DD optics

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

This feature enables flexible port combinations and maximizes hardware utilization on the Cisco 8011-32Y8L2H2FH router by allowing a 4x100GE optic to be used as a 1x100GE, 2x100GE, or 3x100GE so that unused SerDes (Serializer/Deserializer) lanes can be reallocated to other ports.

*This feature is supported only on the Cisco 8011-32Y8L2H2FH router.

Software Reliability

Increase in number of CFM sessions to 4000

Introduced in this release on: Fixed Systems (8010 [ASIC: A100]) (select variants only*)

The number of supported Connectivity Fault Management (CFM) sessions is now increased to 4000 from the previously supported value of 500. This enhancement enables faster fault detection and simplifies troubleshooting in high-performance networks.

*This feature is now supported on:

·       8011-4G24Y4H-I

·       8011-32Y8L2H2FH

·       8011-12G12X4Y-A/D

L2VPN

Ease of Setup

Encapsulation default catch-all mode

Introduced in this release on: Fixed Systems (8010 [ASIC: A100], 8700 [ASIC: K100, P100], 8210 [ASIC: P100]); Centralized Systems (8400); Modular Systems (8800 [LC ASIC: K100, P100])

This feature enables an encapsulation default Layer 2 subinterface to match untagged traffic and unsupported encapsulation formats, in addition to unmatched VLAN-tagged traffic. This catch-all capability allows the matched traffic to be carried over VPWS or VPLS services through a single subinterface.

Licensing

Licensing Process

Support for Smart Licensing Using Policy

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]); Modular Systems (8800 [LC ASIC: K100]) (select variants only*)

Cisco Smart Licensing Using Policy (SLP) streamlines the licensing process for Cisco IOS XR products. You no longer need to register your device during installation, and there is no evaluation license state or period.

*This feature support is extended to

Licensing Process

Configure device data privacy for Smart Licensing

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

Device data privacy for Smart Licensing provides a privacy control that suppresses the device hostname and Smart Agent version in Smart Licensing usage reports.

MACsec

Software Reliability

PQC-enabled MACsec with EAP-TLS

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]) (select variants only*); Centralized Systems (8400 [ASIC: K100]) (select variants only*)

Introduces PQC-capable TLS key exchange support to 802.1X EAP-TLS, with default CiscoSSL group advertisement and per-profile group configuration.

*This feature is supported on all MACsec-supported IOS XR platforms.

Modular QoS

Software Reliability

Queue buffer optimization based on average packet size

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200])

You can now optimize the maximum buffering available to a queue based on the configured average packet size. This increases burst absorption before packet drops in non-PFC deployments and helps prevent queue drops in PFC deployments that require high pause thresholds and headroom, such as long-distance Data Center Interconnect solutions and 4K MTU RoCEv2 traffic used by high-throughput AI and storage RDMA workloads.

Upgrade

Egress feature capability

Introduced in this release on: Fixed Systems (8700 [ASIC: K100])(select variants only*); Centralized Systems (8400 [ASIC: K100])

You can now enable Egress feature capability on supported platforms to expand support for egress traffic management features. It uses an egress processing path to enable capabilities such as scalable egress queuing, egress policing, and multicast QoS scheduling.

The feature introduces these changes:

CLI:

·       hw-module profile edge-mode

·       show hw-module profile edge-mode

*This feature is now supported on:

·       8711-28H8F-M 

·       8404-SYS-D 

Ease of Use

Absolute-value shaping on bundle interfaces

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200], 8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: Q200, P100, K100])

You can control egress bandwidth with fixed shaping rates on supported bundle interfaces. This helps enforce predictable bandwidth allocations for customers, services, or AI workloads without relying on interface-relative percentages.

Ease of Use

Absolute-value policing on bundle interfaces

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200], 8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: Q200, P100, K100])

You can control ingress bandwidth with fixed policing rates on supported bundle interfaces. This helps enforce predictable bandwidth limits for customers, services, or AI workloads using explicit bandwidth values instead of interface-relative percentages.

Ease of Use

Egress QoS policing with configurable burst values

Introduced in this release on: Fixed Systems (8700 [ASIC: K100])(select variants only*); Centralized Systems (8400 [ASIC: K100])(select variants only*); Modular Systems (8800 [LC ASIC: P100, K100])(select variants only*)

You can now enforce bandwidth limits on outbound Layer 2 and Layer 3 traffic and configure burst values to control how the policer handles short-term traffic bursts.

This capability helps prevent excessive outbound traffic from affecting downstream network resources while providing granular control over permitted burst traffic.

*This feature is supported on:

Ease of Use

Bandwidth remaining percent for class-based queuing

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: P100, K100])

You can configure percentage-based sharing of remaining egress bandwidth among class-based queues on supported main interfaces and subinterfaces. This helps service provider and data center operators express bandwidth-sharing policies for customer services, AI workloads, and application traffic more intuitively without calculating scheduler ratios.

Ease of Use

Identify the source of stuck VOQs

Introduced in this release on: Modular Systems (8800 [LC ASIC: Q100, Q200])

You can now determine whether a detected stuck VOQ condition originates on the ingress or egress
NPU and line card. Previously, isolating the affected side required debug-shell commands. The new operational commands display the affected VOQ and interface information, diagnostic status, and recommended action.

*This feature is supported on:

·       8800-LC-36FH

·       8800-LC-48H

·       88-LC0-36FH

·       88-LC0-36FH-M

·       88-LC0-34H14FH

Ease of use

Two-level hierarchical ingress policing

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: P100, K100])

You can enforce an aggregate bandwidth limit for a customer, service, or traffic aggregate while preserving per-class traffic policies. This helps keep aggregate ingress traffic within contracted bandwidth limits while maintaining application-level and class-level traffic handling.

Multicast

Software reliability

Full 128-bit IPv6 multicast route keys

Introduced in this release on: Fixed Systems (8010 [ASIC: A100], 8700 [ASIC: K100, P100], 8210 [ASIC: P100]); Modular Systems (8800 [LC ASIC: K100, P100])

IPv6 Layer 2 and Layer 3 multicast route programming now uses all 128 bits of the IPv6 source and multicast group addresses as the hardware route key. Multicast group addresses that differ in any bit are programmed as distinct hardware entries. Previously, group addresses were restricted to a /96 mask and could vary only in the last 32 bits.

Programmability

Software reliability

GNSS Anti-jamming and Anti-Spoofing

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100]) (select variants only*)

You are alerted in real time to GNSS jamming and spoofing events, with syslog alarms and alarm states displayed in show command outputs when a GNSS receiver detects or mitigates a threat. This enables you to monitor GNSS threats quickly and maintain service reliability.

*This feature is supported on:

Software reliability

gNOI Containerz on active and standby route processors

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600[ASIC: Q200])

You can now reduce downtime and maintain uninterrupted operation of the gNOI Containerz services. With high availability enabled for Containerz on both active and standby Route Processors (RPs), switchover occurs without the need to reset or reload line cards. This high availability facilitates smooth onboarding and management of third-party applications without disrupting service.

For the specification on gNOI.containerz, see the GitHub repository.

Routing

Software reliability

RCC-based encapsulation ID checks

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200, P100])

This enhancement improves the RCC (Route Consistency Checker) output by reflecting a broader set of validation checks, giving better visibility into what RCC has verified across the system.

With this enhancement, RCC accounts for Encap ID verification on non-active RPs. As a result, number of checks performed for non-active RPs increases by the number of Encap IDs present on those nodes.

Software reliability

Inter-area route propagation limits in IS-IS

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100, Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]) (select variants only*); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100]) (select variants only*)

This feature helps protect the network from excessive inter-area route propagation caused by misconfiguration or unexpected route growth by limiting the number of prefixes propagated between IS-IS levels.

This feature, using the new maximum-propagated-prefixes command, allows operators to define propagation thresholds, receive early warnings, and optionally stop advertising additional prefixes when limits are exceeded.

Segment Routing

Ease of use

EVPN RT5 support for L3VPN over SRv6

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Modular Systems (8800 [LC ASIC: P100])

Simplifies Layer 3 route advertisement across an SRv6 core by reducing the need for separate VPNv4 and VPNv6 unicast address families. This feature supports carrying L3VPN routes in the L2VPN EVPN Route Type 5 address family to provide end-to-end Layer 3 connectivity across an SRv6 core.

Ease of use

Lightweight host routing using LLDP

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100, Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Modular Systems (8800 [LC ASIC: K100)]

You can now simplify host reachability by advertising IPv6 prefixes or SRv6 locators from a host or hypervisor to a directly connected Leaf or ToR router through LLDP IP Host Prefix TLVs. This capability removes the need to run a routing protocol stack on each host or hypervisor. The Leaf router installs the LLDP-learned prefixes in the routing table and redistributes them into routing protocols such as IS-IS or BGP.

Software reliability

Loopback-based performance monitoring for IPv6 endpoints

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200, P100])

You can now simplify IPv6 endpoint performance monitoring by eliminating the need to configure remote devices, enable IPM or STAMP support on those endpoints, or synchronize clocks with PTP. IPM loopback mode uses hardware-offloaded SRv6 probes to measure latency, packet loss, and liveness, and uses flow-label spraying to validate available Equal-Cost Multipath (ECMP) paths. The feature provides high-precision performance metrics through hardware-based timestamping and exports real-time results through telemetry and syslog alerts.

Ease of Use

EVPN ELAN Services over SRv6 TE Policies

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Modular Systems (8800 [LC ASIC: P100])

You can now maintain consistent path selection and efficient traffic delivery across your IPv6 networks. This is achieved by deploying a multipoint Layer 2 VPN service that uses colored routes to select specific SRv6 Traffic Engineering (TE) paths between your Provider Edge (PE) routers. You will use Route Type 1 (Ethernet Auto-Discovery) to advertise multihoming reachability and Route Type 3 (Inclusive Multicast Ethernet Tag) to support the forwarding of broadcast, unknown-unicast, and multicast (BUM) traffic. By applying an export route policy that adds a Segment Routing color extended community, you can steer both route types to matching SRv6 TE policies.

Software reliability

SRv6 Layer 3 gateway traffic class propagation

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200, P100])

Maintain consistent Quality of Service across your SRv6 domain and prevent high-priority traffic degradation caused by inner IPv4 or IPv6 DSCP values overwriting transport-level markings during packet re-origination.

Software reliability

SRv6 Per-Flow next-hop redirection using ABF

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200, P100])

Simplifies traffic steering by providing a lightweight, scalable alternative to full SR-TE policy configurations. This feature enables ABF policy-based redirection of IPv4 or IPv6 flows to a configured next-hop with SRv6 reachability, allowing for granular, per-flow steering without requiring explicit segment lists or candidate paths.

Setup and Upgrade

Ease of setup

Bootz dynamic configuration

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100, Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200], 8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100, K100])

You can now set initial device configuration at first boot that remains flexible for future changes. This feature allows you to modify or overwrite dynamic boot-time settings through standard CLI or gNMI Set RPC calls without requiring a factory reset.

System Management

Software Reliability

Configure SNMP secure-v3

Introduced in this release on: Fixed Systems-Cisco 8010 Series Routers (ASIC: A100), Cisco 8200 Series Routers (ASICs:Q100, Q200, and P100), and Cisco 8700 Series Routers (ASICs: P100 and K100)

This feature enhances the SNMP security by configuring only SNMPv3 with SHA-2 authentication and AES-based privacy using the secure-v3 CLI.

The router continues to support SNMPv1, SNMPv2c, and legacy SNMPv3 configurations, but these configurations are deprecated. If a legacy SNMP configuration remains active, the router logs a deprecation warning every 30 days. The router rejects the commit if the same group, user, or notification host user is configured through both legacy SNMP and SNMP secure-v3.

System Monitoring

Software reliability

AuditD process keepalive

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200, P100])

AuditD process keepalive improves compliance verification and helps detect silent AuditD failures earlier by periodically generating identifiable AuditD keepalive events at a configurable interval to confirm that the AuditD service is running and that the audit logging path remains operational.

Software reliability

Persistent logging

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200, P100])

This feature preserves the contents of the IOS XR logging buffer across node reloads, router reloads, and RP failovers. Syslog messages are written to both the in-memory logging buffer and a persistent file on local storage. After a reload or failover, the system restores the logging buffer from persistent storage so that retained log messages before the event and current logs, are displayed.

System Security

Software reliability

Monitor XR shell commands

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100, Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800[LC ASIC: Q100, Q200, P100])

You can now trace run and bash commands to specific users and identify potential system compromises. By implementing shell-level user activity tracking, the router records each action, the user who performed it, and its timestamp. You can use this data to monitor user behavior, detect potentially malicious activity, and respond rapidly to security incidents.

This feature introduces these changes:

CLI:

Software Reliability

Upgrade CURL libraries for HTTP client

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100, Q200, P100], 8700[ASIC: P100, K100], 8010 [ASIC: A100]; Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

You gain enhanced security and improved reliability through an upgraded embedded libcurl library. This transparent update preserves existing functionality and continues to support HTTP/1.0 and HTTP/1.1.

Software reliability

FIPS 140-3 certification

Introduced in this release on: Modular Systems (8800 [LC ASIC: K100]) (select variants only*)

FIPS 140-3 (Federal Information Processing Standard 140-3) certification provides extended cryptographic standards including software, firmware, and hybrid modules.

FIPS140-3 is used to approve cryptographic modules for the security of both hardware and software products.

*This feature is supported on:

Ease of setup

SSH remote public key authentication using TACACS

Introduced in this release on: Fixed Systems (8010 [ASIC: A100], 8200 [ASIC: Q100, Q200, P100], 8700 [ASIC: P100, K100]); Modular Systems (8800 [LC ASIC: P100]) (select variants only*)

You can centrally manage SSH public keys on IOS XR by enabling devices to retrieve and validate user public keys from TACACS+ servers at login. This feature simplifies key management, streamlines access control, and supports fallback to local keys for continued access if the server is unavailable.

Software Reliability

Gated shell access

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100, Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

Gated shell access requires consent token authorization for direct root shell access initiated through supported shell commands.

Software Reliability

SSH client strict host key check

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200], 8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: Q200, P100])

You enhance SSH security by enforcing strict host key checking, allowing you to control how the SSH client handles new or changed server keys - accept, reject, or prompt for approval. Trusted host keys are stored system-wide and persist across reloads, ensuring consistent validation for your outbound SSH connections.

Telemetry

Software reliability

gNMI Internal Path sharing

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [ASIC: Q100, Q200, P100])

You can now reduce redundant processing and ensure that collectors receive synchronized, reliable data. With Internal Path sharing, the router automatically detects duplicate Internal Paths across different gNMI subscription lists and consolidates data collection for those paths. This optimization provides consistent data snapshots to collectors without requiring any user configuration.

This feature introduces these changes:

CLI:

Timing and Synchronization

Software reliability

Use PTP Virtual Port and APTS to Select Timing Source

Introduced in this release on: Fixed Systems (8400 [ASIC: K100], 8700 [ASIC: K100]) (select variants only*)

*This feature is supported on:

Software reliability

Synchronous Ethernet ESMC and SSM on Cisco 88-LC1-16H16F-EM cards

Introduced in this release on: Modular Systems (8800 [LC ASIC: K100]) (select variants only*)

SyncE provides synchronization signals transmitted over the Ethernet physical layer to downstream devices, while the Synchronization Status Message (SSM) indicates the quality level of the transmitting clock to the neighboring nodes, informing the nodes about the level of the network's reliability. Ethernet Synchronization Message Channel (ESMC) is the logical channel that uses an Ethernet PDU (protocol data unit) to exchange SSM information over the SyncE link.

Supported SyncE profiles:

*This feature is supported on Cisco 88-LC1-16H16F-EMline cards.

Software reliability

PTP profiles support on Cisco 88-LC1-16H16F-EM line cards

Introduced in this release on: Modular Systems (8800 [LC ASIC: K100]) (select variants only*)

Based on the IEEE 1588-2008 standard, Precision Time Protocol (PTP) is a protocol that defines a method to synchronize clocks in a network for networked measurement and control systems.

Supported PTP profiles:

*This feature is supported on Cisco 88-LC1-16H16F-EM line cards.

Software reliability

Synchronous Ethernet ESMC and SSM on Cisco 88-LC1-16H16F-EM cards

Introduced in this release on: Modular systems (8800 [LC ASIC: K100])(select variants only*)

SyncE provides synchronization signals transmitted over the ethernet physical layer to downstream devices, while the synchronization status message (SSM) indicates the quality level of the transmitting clock to the neighboring nodes, informing the nodes about the level of the network's reliability. ethernet synchronization message channel (ESMC) is the logical channel that uses an ethernet PDU (protocol data unit) to exchange SSM information over the SyncE link.

Supported SyncE profiles:

*This feature is supported on cisco 88-LC1-16H16F-EMline cards.

Software reliability

Synchronous Ethernet ESMC and SSM on Cisco 8711-28H8F-M

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*); Modular Systems (8800 [LC ASIC: K100]) (select variants only*)

SyncE provides synchronization signals transmitted over the Ethernet physical layer to downstream devices, while the Synchronization Status Message (SSM) indicates the quality level of the transmitting clock to the neighboring nodes, informing the nodes about the level of the network's reliability. Ethernet Synchronization Message Channel (ESMC) is the logical channel that uses an Ethernet PDU (protocol data unit) to exchange SSM information over the SyncE link.

Supported SyncE profiles:

*This feature is supported on Cisco 8711-28H8F-M routers.

Software reliability

PTP profiles support on Cisco 8711-28H8F-M

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*); Modular Systems (8800 [LC ASIC: K100]) (select variants only*)

Based on the IEEE 1588-2008 standard, Precision Time Protocol (PTP) is a protocol that defines a method to synchronize clocks in a network for networked measurement and control systems.

Supported PTP profiles:

*This feature is supported on Cisco 8711-28H8F-M routers.

Software reliability

Global Navigation Satellite System (GNSS) support on Cisco 8711-28H8F-M

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*); Modular Systems (8800 [LC ASIC: K100]) (select variants only*)

Global Navigation Satellite System (GNSS) is a satellite system used as a timing interface. GNSS receiver receives signals from GNSS satellites and decodes the information from multiple satellites to determine its distance from each satellite. Based on this data, the GNSS receiver identifies the location of each satellite.

The supported GNSS class is PRTC-B.

*This feature is supported on Cisco 8711-28H8F-M routers.

Software reliability

PTP frequency-assisted holdover

Introduced in this release on: Fixed Systems (8010 [ASIC: A100]), 8700 [ASIC: K100]; Modular Systems (8800 [LC ASIC: K100])

The frequency-assisted holdover feature enhances network stability by allowing for an extended holdover duration within the network-limits specification, when a Primary Reference Clock (PRC) frequency source remains available. This ensures that even if the GNSS or PTP time source is lost, the system can advertise timing stability for a longer, user-defined period without significant degradation.

CLI:

Traffic Mirroring

Ease of Use

Egress Traffic Mirroring Support on Local SPAN

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: P100])

You can now mirror outgoing traffic on the Cisco 8000 Series routers to verify exactly what the device forwards toward the next hop. This egress-only mirroring focuses on outgoing traffic without mixing in unrelated ingress traffic.

With this feature, you create a monitor session, define a destination interface, and attach the source interface to this session and specify the transmission direction. The router replicates the egress packets to the destination, allowing you to troubleshoot network performance and connectivity effectively. This enhancement provides better visibility into your network traffic flow.

Optics

This release introduces the following new optic on selective hardware within the product portfolio. For details, refer to the Transceiver Module Group (TMG) Compatibility Matrix

Cisco QSFP28 100G ZR module

88-LC1-16H16F-EM Line Card based on K100 NPU

The 88-LC1-16H16F-EM line card based on K100 NPU supports the following:

The 88-LC1-16H16F-EM line card is supported on the following modular chassis configurations, both requiring the 8800-RP2 route processor:

For more information on this line card, see the Cisco 8000 Series Routers Data Sheet.

88-LC1-48Y8H-EM Line Card based on K100 NPU

The 88-LC1-48Y8H-EM line card based on K100 NPU supports the following:

The 88-LC1-48Y8H-EM line card is supported on the following modular chassis configurations, both requiring the 8800-RP2 route processor:

Updates in fan replacement guidelines

Introduced in this release on: Centralized Systems (8600 [ASIC: Q200]); (select variants only*)

With this release, the chassis does not initiate an immediate shutdown upon fan failure. To ensure system stability, we recommend to replace the failed fan within two minutes.

This feature is supported on:

8812-FAN-V2 fan tray

To maintain optimal cooling, the 8812-FAN-V2 high-performance fan tray must be installed in the Cisco 8812 router.

TLS 1.0

TLS 1.1

Use TLS 1.2 or TLS 1.3.

SSH key-exchange algorithm diffie-hellman-group1-sha1

Use stronger SSH key-exchange algorithms. Do not configure diffie-hellman-group1-sha1.

SSH ciphers 3des-cbc

Use stronger SSH ciphers.

SSH host-key DSA algorithm

Use ECDSA, ED25519, or RSA host keys.

Note: The SSH host-key DSA algorithm is not recommended. However, it has not been removed. If required, you can still generate and use DSA host keys. Cisco recommends using ECDSA, ED25519, or RSA host keys.

SSHv1

Use SSHv2.

CSCww26715

LSPNH_ASYNC_ERROR and HW_PROG_ERROR occur on PE1 during IS-IS remove/add operations at 3K scale.

CSCws11743

DMM TS correction on 1-Gigabit Ethernet interfaces requires the ingress-port SSP value.

CSCwu12973

Vendor information is not displayed for optics in the show controller speed CLI.

CSCww29358

Continuous MACsec session flaps on 10-Gigabit Ethernet subinterfaces after optics OIR.

CSCwv82429

After the router reload, the system encounters an "unable to open trace file" error, which prevents the Active RP from completing its startup sequence. This failure leads to a watchdog timeout and a subsequent unexpected RP reload once the maximum restart attempt threshold is exceeded.

Release 26.3.1

Cisco Crosswork Network Controller 6.0

Evolved Programmable Network Manager 8.1.1

Cisco 8010 Series Routers - Chassis

8011-12G12X4Y-A

Cisco 8011 12x1G, 12x1/10G, 4X1/10/25G

Release 25.4.1

8011-12G12X4Y-D

Cisco 8011 12x1G, 12x1/10G, 4X1/10/25G

Release 25.4.1

8011-32Y8L2H2FH

Cisco 8010 32X25G SFP28, 8x50G, 2x100GQSFP28, 2x400G QSFP-DD

Release 25.4.1

8011-4G24Y4H-I

Cisco 8010 1 RU Fixed System - 4 QSFP28 100GbE, 24 SFP28 25GbE, and 4 RJ-45 100MbE

Release 25.1.1

Cisco 8010 Series Routers – Power Supply Unit (PSU)

PWR-650-AC-R

Cisco 650W AC Power Module

Release 25.4.1

PWR-930-DC-R

Cisco 930W DC Power Module

Release 25.4.1

PWR-400-AC

Cisco 400W AC Power Module

Release 25.1.1

PWR-400-DC

Cisco 400W DC Power Module

Release 25.1.1

Cisco 8200 Series Routers - Chassis

8201-32FH

Cisco 8200 1 RU Fixed System - 32 QSFP56-DD 400GbE

Release 7.3.15

8201-24H8FH

Cisco 8200 1 RU Fixed System - 8 QSFP56-DD 400GbE and 24 QSFP28 100GbE

Release 7.7.1

8202-32FH-M

Cisco 8200 2 RU Fixed System - 32 QSFP56-DD 400GbE with MACsec

Release 7.5.2

8212-48FH-M

Cisco 8200 2 RU Fixed System - 24 QSFP-DD 800G or 48 QSFP56-DD 400GbE with MACsec

Release 24.3.1

Cisco 8200 Series Routers – Power Supply Unit (PSU)

PSU1.4KW-ACPI

Cisco 1.4KW AC Power Module with Port-side Air Intake

Release 7.0.12

PSU1.4KW-ACPE

Cisco 1.4KW AC Power Module with Port-side Air Exhaust

Release 7.0.12

PSU2KW-ACPI

Cisco 2KW AC Power Module with Port-side Air Intake

Release 7.3.1

PSU2KW-ACPE

Cisco 2KW AC Power Module with Port-side Air Exhaust

Release 7.3.1

PSU3KW-HVPI

Cisco 3KW HV AC/DC Power Supply Unit

Release 7.5.3

Cisco 8400 Series Routers - Chassis

8404-SYS-D

Cisco 8404 – 4-Slot Centralized Chassis

Release 26.1.1

Cisco 8400 Series Routers - Modular Port Adapters (MPA)

84-MPA-2H12Z-M

Cisco 8404 MPA with 2x100G QSFP28 + 12x1/10/25/50G SFP56

Release 26.1.1

84-MPA-2FH/6H-M

Cisco 8404 MPA with 2x400G / 6x100G QSFP56-DD

Release 26.1.1

Cisco 8400 Series Routers - Power Entry Module (PEM)

8404-DC-PEM

Cisco 8404 DC Power Entry Module

Release 26.1.1

Cisco 8600 Series Routers - Chassis

8608

Cisco 8600 7 RU Centralized System

Release 7.10.1

Cisco 8600 Series Routers - Modular Port Adapters (MPA)

86-MPA-14H2FH-M

Cisco 8608 MPA - 2 QSFP-DD 400GbE and 14 QSFP / 16 QSFP 100GbE

Release 7.10.1

86-MPA-24Z-M

Cisco 8608 MPA - 24 SFP56 10/25/50 GbE

Release 7.10.1

86-MPA-4FH-M

Cisco 8608 MPA - 4 QSFP-DD 400GbE

Release 7.10.1

Cisco 8600 Series Routers – Power Supply Unit (PSU)

PSU3.2KW-ACPI

Cisco 3.2-kW AC Power Supply Unit

Release 7.10.1

PSU3.2KW-DCPI

Cisco 3.2-kW DC Power Supply Unit

Release 7.10.1

PSU4.3KW-HVPI

Cisco 4.3KW HV AC/DC Power Supply Unit

Release 7.10.1

Cisco 8700 Series Routers - Chassis

8711-28H8F-M

Cisco 8700 1 RU Fixed System - 8 QSFP-DD and 28 QSFP28 ports

Release 26.3.1

8711-48Z-M

Cisco 8700 1 RU Fixed System - 6 QSFP-DD, 4 QSFP56, and 48 SFP56 ports

Release 25.4.1

8711-32FH-M

Cisco 8700 1 RU Fixed System - 16 QSFP-DD800 and 16 QSFP56-DD

Release 24.3.1

8712-MOD-M

Cisco 8700 2 RU Fixed System

Release 24.4.1

Cisco 8700 Series Routers - Modular Port Adapters (MPA)

8K-MPA-4D

Cisco 8712 MPA - 4 QSFP-DD 400GbE

Release 24.4.1

8K-MPA-16H

Cisco 8712 MPA - 16 QSFP-28 100GbE

Release 24.4.1

8K-MPA-16Z2D

Cisco 8712 MPA - 2 QSFP-DD 400GbE, 2 QSFP-DD 200GbE, and 16 SFP 50GbE

Release 24.4.1

8K-MPA-18Z1D

Cisco 8712 MPA - 1 QSFP-DD 400 GbE and 18 zSFP56+ 50GbE

Release 25.1.1

Cisco 8700 Series Routers – Power Supply Unit (PSU)

PSU2KW-ACPI

Cisco 8711-32FH-M PSU – 2KW AC Power Module with Port-side Air Intake

Release 24.3.1

PSU2KW-ACPE

Cisco 8711-32FH-M PSU – 2KW AC Power Module with Port-side Air Exhaust

Release 24.3.1

PSU2KW-DCPI

Cisco 8711-32FH-M PSU – 2KW DC Power Module with Port-side Air Intake

Release 24.3.1

PSU2KW-DCPE

Cisco 8711-32FH-M PSU – 2KW DC Power Module with Port-side Air Exhaust

Release 24.3.1

PSU2KW-DCPI

Cisco 8712-MOD-M PSU – 2KW 48V DC Power Module with Port-side Air Intake

Release 24.4.1

PSU2KW-DCPE

Cisco 8712-MOD-M PSU – 2KW 48V DC Power Module with Port-side Exhaust

Release 24.4.1

PSU2KW-ACPI 

Cisco 8712-MOD-M PSU – 2KW AC Power Module with Port-side Air Intake

Release 24.4.1

PSU2KW-ACPE

Cisco 8712-MOD-M PSU – 2KW AC Power Module with Port-side Exhaust

Release 24.4.1

Cisco 8800 Series Routers - Chassis

8804-SYS

Cisco 8800 Modular System - 10 RU with 4 Line Card Slots

Release 7.3.2

8808-SYS

Cisco 8800 Modular System - 16 RU with 8 Line Card Slots

Release 7.0.12

8812-SYS

Cisco 8800 Modular System - 21 RU with 12 Line Card Slots

Release 7.0.12

8818-SYS

Cisco 8800 Modular System - 33 RU with 18 Line Card Slots

Release 7.0.14

Cisco 8800 Series Routers - Route Processors

8800-RP

Cisco 8800 Route Processor - 4 Core

Release 7.0.12

8800-RP2

Cisco 8800 Route Processor - 8 Core

Release 7.11.1

Cisco 8800 Series Routers - Fabric Modules

8808-FC

Cisco 8808 System Fabric Module - Q100-based fabric modules with 14.4T per LC slot

Release 7.0.12

8812-FC

Cisco 8812 System Fabric Module - Q100-based fabric modules with 14.4T per LC slot

Release 7.0.12

8818-FC

Cisco 8818 System Fabric Module - Q100-based fabric modules with 14.4T per LC slot

Release 7.0.14

8808-FC0

Cisco 8808 System Fabric Module - Q200-based fabric modules with 14.4T per LC slot

Release 7.3.15

8818-FC0

Cisco 8818 System Fabric Module - Q200-based fabric modules with 14.4T per LC slot

Release 7.3.16

8804-FC0

Cisco 8804 System Fabric Module - Q200-based fabric modules with 14.4T per LC slot

Release 7.3.16

8808-FC1

Cisco 8808 System Fabric Module - F100-based fabric modules with 28.8T per LC slot

Release 24.2.1

8804-FC1

Cisco 8804 System Fabric Module - F100-based fabric modules with 28.8T per LC slot

Release 25.1.1

8818-FC1

Cisco 8818 System Fabric Module - F100-based fabric modules with 76T per LC slot

Release 26.1.1

Cisco 8800 Series Routers - Line Cards

8800-LC-48H

Cisco 8800 Line Card with MACsec - Q100 ASIC based 4.8 Tbps line card

Release 7.0.12

8800-LC-36FH

Cisco 8800 Line Card - Q100 ASIC based 14.4 Tbps line card

Release 7.0.12

88-LC0-36FH

Cisco 8800 Line Card - Q200 ASIC based 14.4 Tbps line card

Release 7.3.15

88-LC0-36FH-M

Cisco 8800 Line Card with MACsec- Q200 ASIC based 14.4 Tbps line card

Release 7.3.15

88-LC0-34H14FH

Cisco 8800 Line Card - Q200 ASIC based 9 Tbps line card

Release 7.3.3
Release 7.5.1

88-LC1-36EH

Cisco 8800 Line Card - P100 ASIC based 28.8 Tbps line card

Release 24.2.11

88-LC1-12TH24FH-E

Cisco 8800 Line Card - P100 ASIC based 12 Tbps line card

Release 24.3.1

88-LC1-52Y8H-EM

Cisco 8800 Line Card - P100 ASIC based 3.7 Tbps line card

Release 24.3.1

88-LC1-16H16F-EM

Cisco 8800 Line Card - K100 ASIC based 9.6 Tbps line card

Release 26.3.1

88-LC1-48Y8H-EM

Cisco 8800 Line Card - K100 ASIC based 4.8 Tbps line card

Release 26.3.1

Cisco 8800 Series Routers – Power Supply Unit (PSU)

PSU4.8KW-DC100

4.8KW 48V 100A DC Power Supply

Release 7.3.2

PSU6.3KW-HV

6.3KW AC/HVAC/HVDC Power Supply

Release 7.0.12

PSU6.3KW-20A-HV

6.3KW AC/HVAC/HVDC Power Supply-20A

Release 7.0.12

Cisco 8800 Series Routers – FAN

8812-FAN-V2

Cisco 8812 12-slot chassis

26.3.1

8818-FAN-V2

Cisco 8818 18-slot chassis

26.2.1

8808-FAN-V2

Cisco 8808 8-slot chassis

26.2.1

8804-FAN-V2

Cisco 8804 4-slot chassis

26.2.1

8804-FAN

Cisco 8804 4-slot chassis

7.3.2

8818-FAN

Cisco 8818 18-slot chassis

7.0.14

8812-FAN

Cisco 8812 12-slot chassis

7.0.12

8808-FAN

Cisco 8808 8-slot chassis

7.0.12

Ask AI about this product

Provides access to Cisco product documentation for checking product support details. Start by selecting the product family, then use Ask AI About This Product tab for further information.

Cisco 8000 documentation

Provides CDC documentation for Cisco 8000 series routers.

Cisco IOS XR Error messages

Allows searching by release number, error strings, or comparing release numbers to view a detailed repository of error messages and descriptions.

Cisco IOS XR MIBs

Allows selecting the MIB of your choice from a drop-down to explore an extensive repository of MIB information.

Feature deprecation and removal details

Outlines the features currently supported by each operating system.

Feature deprecation phasing out insecure capabilities

Provides a list of insecure features and protocols that are scheduled for systematic deprecation and eventual removal from specified Cisco products.

Feature removal and suggested alternatives

Details the reasons why certain features or protocols are deemed insecure and offers secure alternatives when available.

Recommended release

Provides a general guide in case of upgrading IOS XR routers or new deployments that involve IOS XR routers.

Smart licensing

Provides information about Smart Licensing Using Policy solutions and their deployment on IOS XR routers.

Transceiver Module Group (TMG) compatibility matrix

Allows searching by product family, product ID, data rate, reach, cable type, or form factor to determine the transceivers that Cisco hardware device supports.

Yang data models in GitHub

Provides yang data models introduced and enhanced in every IOS XR release.