Release Notes for Cisco NCS 540 Series Routers, Cisco IOS XR Release 26.2.1
Available Languages
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
- US/Canada 800-553-2447
- Worldwide Support Phone Numbers
- All Tools
Feedback
Feedback
Cisco NCS 540 Series Routers, Release 26.2.1
Cisco NCS 540 Series Routers, Release 26.2.1
Cisco IOS XR Release 26.2.1 is a new feature release for Cisco NCS 540 Series routers.
For more details on the Cisco IOS XR release model and associated support, see Software Lifecycle Support Statement - IOS XR.
This section provides a brief description of the new software features introduced in this release.
Table 1. New software features for Cisco NCS 540 Series Routers, Release 26.2.1
| Product impact |
Feature |
Description |
| Interface and Hardware Component |
||
| Software Reliability
|
Down MEP support in bridge domains gives you direct visibility and control over attachment circuit failures within L2VPN services. By enabling fault detection at the source and propagating failures across attachment circuits, it helps ensure faster failover, improved service reliability, and consistent end-to-end monitoring. |
|
| L3VPN |
||
| Software reliability
|
Introduced in this release on: Cisco NCS 540 small and medium density routers. You can enhance your network scalability and operational efficiency by overcoming the recursion limit on your router. With large networks that cannot be managed by a single protocol or a single administrative domain, forwarding VPN traffic necessitates a three-layer label stack (VPN, Labeled Unicast, and IGP) The L3VPN label swap over BGP labeled unicast and IGP feature overcomes the recursion limit and manages VPN traffic that necessitates a three-layer label stack. The router's two-pass processing mechanism handles the three-layer label stack without manual intervention. |
|
| Setup and Upgrade |
||
| Upgrade
|
This feature improves platform security and reduces the threat surface of the Cisco Networking products by restricting insecure protocols such as Telnet, FTP, TFTP, and RCP (which were deprecated in Cisco IOS XR Release 25.4.1) from Cisco IOS XR base package. In this release, Telnet is added to the optional RPM, {{Telnet.rpm}}, and FTP, TFTP, and RCP are added to the optional RPM, {{IP-Insecure-Apps.rpm }}. We recommend you to migrate to secure alternatives such as SSH, SCP, SFTP as Telnet, FTP, TFTP, and RCP protocols will not be supported anymore starting from an upcoming Cisco IOS XR release. |
|
| System Security |
||
| Software Reliability |
uRPF strict mode increases network security by blocking IP spoofing and dropping packets whose source IP does not match the expected return path interface. It checks that incoming traffic uses the same interface that the router would use to reach the source IP address. uRPF strict modes supports up to 16 Equal-Cost Multipath (ECMP) paths. This release extends uRPF strict mode to devices with external TCAM. |
|
| Software Reliability |
Post-Quantum Cryptography key exchange support for Cisco SSH |
CiscoSSH mitigates quantum threats to ensure long term confidentiality and integrity of remote access and data transfer by introducing PQC (Post-Quantum Cryptography) hybrid key exchange algorithms. Supported algorithms include ML-KEM and NTRU Prime hybrids: ● mlkem768x25519-sha256 ● sntrup761x25519-sha512 ● sntrup761x25519-sha512@openssh.com |
This section provides a brief description of the new hardware features introduced in this release.
Table 2. New hardware for Cisco NCS 540 Series Routers, Release 26.2.1
| Hardware |
Description |
| Optics |
This release introduces these new optics that are available on supported hardware in the product portfolio. For details, refer to the Transceiver Module Group (TMG) Compatibility Matrix. Supported hardware ● N540X-16Z4G8Q2C-D/A Cisco 25GBASE SFP28 Module ● SFP-25G-ZR-I |
| Optics |
This release introduces these new optics that are available on supported hardware in the product portfolio. For details, refer to the Transceiver Module Group (TMG) Compatibility Matrix. Supported hardware ● N540-24Q2C2DD-SYS-A ● N540-24Q2C2DD-SYS-D ● N540-24Q8L2DD-SYS Cisco 400G QSFP-DD Ultra Long Haul Coherent Optics Module |
| N540X-8Z12G-SYS-D passive cooled small density router |
The N540X-8Z12G-SYS-D passive cooled small density router supports: ● 8 X 1G/10G SFP+ ports: o SFP+: The Small Form-factor Pluggable (SFP+) is an enhanced version of the SFP interface, supporting 1Gbps and 10Gbps data rates. o Data rates: These ports can operate at 1Gbps and 10Gbps, providing versatility for different network tasks. ● 4 X CSFP ports: o CSFP: The compact small form-factor Pluggable (CSFP) is an enhanced version of the SFP interface, supporting 1Gbps data rate. o Data rates: These ports can operate at 1Gbps, providing versatility for different network tasks. ● 4 X 1G SFP ports o SFP: The small form-factor Pluggable (SFP) supporting 1Gbps data rate. o Data rates: These ports can operate at 1Gbps, providing versatility for different network tasks. ● 4 X 1G Copper GE ports o Copper GE ports: The copper GE ports supporting 1Gbps data rate. o Data rates: These ports can operate at 1Gbps, providing versatility for different network tasks. |
This section provides a brief description of the behavior changes introduced in this release.
● Removal of Model-driven CLI Commands:
Starting from Cisco IOS-XR software release 26.2.1, the Model-driven CLI specifically the show YANG operational data commands have been removed.
● SNMP Traps Dropped in the Buffer Queue:
Starting with IOS-XR software release 24.1.2, SNMP traps will be dropped from the trap queue during the first five minutes after configuring a new NMS server or after a device reload.
o This issue is observed on all current releases of the Cisco IOS XR routers running IOS XR Release 24.1.2.
o The defect applies only to NMS servers that are located behind a firewall or within a security network where ICMP packets are blocked.
● Updated Command Syntax and Usage Guidelines
As an enhancement to the show cef commands, the internal, brief, and hardware keywords have been removed from these commands:
o show cef unresolved
o show cef ipv6 linklocal unresolved
The internal and brief keywords have been removed from these commands:
o show cef mpls unresolved
o show cef mpls local-label
Exceptions
This command retains support for the internal and brief keywords when a specific prefix is provided: show cef unresolved <prefix>
Usage Constraints for show cef mpls: When executing any command beginning with show cef mpls, you may use only one of these keywords at a time: brief, detail, or internal
Note: The exception mentioned above applies: if the command includes unresolved or local-label, the internal and brief keywords are explicitly blocked.
● Change in forwarding information base manager identifier reporting:
Previously, all forwarding information base manager (fib_mgr) instances across different locations—such as the Route Processor (RP) and Line Cards (LCs)—shared the same identifier, fib_mgr. Consequently, the show command output displayed only a single entry for application fib_mgr.
With this update, each fib_mgr instance is assigned a unique identifier corresponding to its specific location. As a result, the show route afi-all summary command now lists all instances individually. For example, the output will display fib_mgr for the RP and FIB node0_3_CPU0 for the LC located at node0_3_CPU0.
● Manual Remediation of Forward-Referenced SRLG Interfaces:
The existing Shared Risk Link Groups (SRLG) feature allows configuring SRLG values on interfaces that do not yet exist (forward-reference interfaces). These configurations appear in the output of the show srlg command. To avoid inconsistencies, manually remove all SRLG configurations related to non-existent or forward-referenced interfaces. This manual cleanup is essential to maintain system consistency and prevent misleading information in the SRLG display.
● Enhanced MPLS interface activation for IS-IS address-family lifecycle events:
Starting with Cisco IOS XR Release 26.2.1, IS-IS enables or disables MPLS on an interface when the first or last MPLS-enabled address family is created or deleted, instead of waiting for operational UP or DOWN state transitions. Previously, MPLS state changes occurred only during interface shutdown or link-down events. With this enhancement, MPLS state updates now also occur when the interface configuration is removed at the root level or when the last IPv4 or IPv6 address associated with an MPLS-enabled address family is removed from the interface.
● MPLS-TE tunnel event history for insufficient bandwidth events:
Starting with Cisco IOS XR Release 26.2.1, MPLS-TE tunnel events for insufficient bandwidth conditions are recorded in the tunnel event history. Previously, when a tunnel failed to reoptimize because the requested bandwidth was unavailable, the router generated syslog messages, but the event was not shown in the show mpls traffic-eng event-history tunnels output. This update adds a tunnel event for insufficient bandwidth so that you can review historical bandwidth-demand failures for debugging and capacity planning.
● Mandatory LDAP TLS Validation:
LDAP server certificate validation for TLS connections is now enabled by default. Unlike previous versions that skipped validation when no trustpoint was defined, the current implementation mandates the use of a configured ldaps trustpoint to establish a secure connection. If this trustpoint is absent, the connection is automatically rejected, ensuring that all LDAP traffic is strictly authenticated and verified.
These behaviors apply based on the configuration of the ldaps trustpoint:
o No trustpoint configured: The TLS connection to the LDAP server is rejected by the router.
o CA certificate only: The router uses the configured CA certificate to validate the LDAP server's certificate; the connection is established only upon successful validation.
o CA and client certificate configured: The router uses the CA certificate to validate the server's certificate while presenting the client certificate to satisfy mTLS requirements; the connection is established only if both validation checks pass.
● MACsec Licensing Tier Update:
Effective with Cisco IOS XR Software Release 26.2.1, MACsec on Cisco IOS XR routers utilizing the FCM 2.0 Access licensing model now requires the Advantage tier instead of the Premier tier. When MACsec is enabled on a physical interface, the interface bandwidth triggers Right-to-Use (RTU) consumption for the Access Advantage tier, calculated in 10G increments. This license consumption is reclaimed once the MACsec configuration is removed or the interface is shut down.
● Deprecated Security Algorithms:
Starting Cisco IOS XR Release 26.2.1, the 3DES-CBC cipher and Diffie-Hellman Group 1 SHA1 key exchange are insecure and deprecated. You will see syslog warning messages for deprecated commands.
● Change in show media CLI output:
The directory path previously shown as /var/lib/docker now appears as apphost in the show media CLI output. This change enhances clarity for users managing third-party applications and Docker containers. It also accurately reflects the directory’s role within the Cisco IOS XR application hosting architecture.
● A deprecation notice is shown when you run the show tech-support netconf command.
● Starting Cisco IOS XR Release 26.2.1, you can set the ipv6 nd ns-interval value to less than 60 seconds on these virtual interfaces:
o Bundle Ethernet interfaces
o BVI interfaces
o Pseudowire Ethernet interfaces
● NACM show command visibility improvements:
Starting from Release 26.2.1, you get better visibility of NACM rules and groups in show nacm command outputs when dynamic NACM is used. This enhancement improves how information is displayed without changing existing functionality, ensuring NACM rules continue to operate as before.
● Enhanced syslog reporting for discard-extra-paths limits:
Starting in Release 26.2.1, syslog notifications for the discard-extra-paths limit have been enhanced to provide per-neighbor and per-address-family reporting. This replaces the previous global notification behavior, which applied a 5-minute rate limit across the entire BGP process. The updated notifications are rate-limited to 30 seconds and reset automatically if the neighbor session flaps.
● LOS Alarm Based on Total Power Support: Starting with IOS-XR software release 26.1.1, a new Loss of Signal (LOS) alarm based on total received power has been introduced.
Alarm Behavior
o The existing payload-based LOS alarm has been renamed to LOS-P to accurately reflect its function.
o Automation scripts and operational procedures that previously relied on the old LOS alarm may misinterpret alarms if not updated.
● Carrier Delay Support for 100G LOL/LOS Switchover:
When both carrier-delay down and the new serdes-holdoff-time are configured on router interfaces, the link remains in the "up" state during transient 50ms DWDM switchovers (LOS flaps). This behavior prevents unnecessary link flaps and improves network stability during optical layer protection switching.
To enable this functionality, use the following interface configuration command:
serdes-holdoff-time msec
● RPM Installation through remote repository configuration is deprecated when using CLI and YANG. We recommend that you perform these workflows to install RPM:
1. Install a GISO (can be on a remote server) with all RPMs included
2. Install from a tarball (can be on a remote server) with all RPMs included
3. Copy desired RPMs onto the router and then configure a local repository
This is applicable for Cisco NCS 540 Series Routers with XR7 OS.
Table 3. Open issues for Cisco NCS 540 Series Routers, Release 26.2.1
| Description |
|
| The process restart of ifmgr results in route flapping and traffic loss. |
|
| The CFMD process may restart intermittently. |
There are no known issues in this release.
Compatibility Matrix for EPNM and Crosswork with Cisco IOS XR Software
The compatibility matrix lists the version of EPNM and Crosswork that are supported with Cisco IOS XR Release in this release.
Table 4. Compatibility Matrix for Cisco NCS 540 Series Routers, Release 26.2.1
| Crosswork |
EPNM |
|
| Release 26.2.1 |
System requirements
Use the show hw-module fpd command in EXEC and Admin mode to view the hardware components with their current FPD version and status. The status of the hardware must be CURRENT; Running and Programmed version must be the same. You can also use the show fpd package command in Admin mode to check the fpd versions.
Software Version
To verify the software version running on the router, use show version command in the EXEC mode.
Router# show version
Tue Jun 9 17:47:14.464 IST
Cisco IOS XR Software, Version 26.2.1
Copyright (c) 2013-2026 by Cisco Systems, Inc.
Build Information:
Built By : swtools
Built On : Mon Jun 8 07:27:44 PDT 2026
Built Host : iox-lnx-041
Workspace : /auto/srcarchive13/prod/26.2.1/ncs540/ws
Version : 26.2.1
Location : /opt/cisco/XR/packages/
Label : 26.2.1-iso
cisco NCS-540 () processor
System uptime is 8 minutes
The following tables list the supported base images and optional packages and their corresponding file names.
Visit the Cisco Software Download page to download the Cisco IOS XR software images.
Table 5. Release 26.2.1 software for N540-24Z8Q2C-SYS, N540-ACC-SYS, and N540X-ACC-SYS
| Package |
Filename |
Description |
| Base image |
||
| IOS XR Base Image |
ncs540-mini-x-26.2.1.iso |
IOS XR mandatory base image. |
| USB Boot Package |
ncs540-usb_boot-26.2.1.zip |
Package required to perform USB Boot. Includes the same packages as the base image. |
| Optional packages not included in the base image |
||
| IOS XR Manageability |
ncs540-mgbl-1.0.0.0-r2621.x86_64.rpm |
Supports Extensible Markup Language (XML) Parser, Telemetry, Netconf, gRPC and HTTP server |
| IOS XR MPLS |
ncs540-mpls-1.0.0.0-r2621.x86_64.rpm ncs540-mpls-te-rsvp-1.0.0.0-r2621.x86_64.rpm |
Supports MPLS and MPLS Traffic Engineering (MPLS-TE) |
| IOS XR Security |
ncs540-k9sec-1.0.0.0-r2621.x86_64.rpm |
Supports MACsec and 802.1X |
| IOS XR ISIS |
ncs540-isis-1.0.0.0-r2621.x86_64.rpm |
Supports ISIS |
| IOS XR OSPF |
ncs540-ospf-1.0.0.0-r2621.x86_64.rpm |
Supports OSPF |
| IOS XR Lawful Intercept |
ncs540-li-1.0.0.0-r2621.x86_64.rpm |
Supports Lawful Intercept (LI) |
| IOS XR Multicast |
ncs540-mcast-1.0.0.0-r2621.x86_64.rpm |
Supports Multicast |
| IOS XR EIGRP |
ncs540-eigrp-1.0.0.0-r2621.x86_64.rpm |
Supports EIGRP |
| IOS XR LI-CTRL |
ncs540-lictrl-1.0.0.0-r2621.x86_64.rpm |
Supports LI-CTRL |
Table 6. Release 26.2.1 Software for N540-24Q8L2DD-SYS, N540-24Q2C2DD-SYS, N540X-16Z4G8Q2C-A/D, N540-28Z4C-SYS-A/D, N540X-12Z16G-SYS-A/D, N540-12Z20G-SYS-A/D, N540-FH-CSR-SYS, N540X-16Z8Q2C-D, and N540-FH-AGG-SYS
| Package |
Filename |
Description |
| Base Image |
||
| IOS XR Base Image |
ncs540l-x64-26.2.1.iso |
IOS XR base image with mandatory packages. The base ISO image also includes the following optional packages: xr-bgp xr-cdp xr-eigrp xr-ipsla xr-is-is xr-k9sec xr-lictrl xr-lldp xr-mcast xr-mpls-oam xr-netflow xr-ospf xr-perf-meas xr-perfmgmt xr-rip xr-telnet xr-track These optional packages are also included in NCS540l-iosxr-26.2.1.tar. |
| USB Boot Package |
ncs540l-usb_boot-26.2.1.zip |
Package required to perform USB Boot. Includes the same packages as the base image. |
| Optional packages not included in the base image |
||
| IOS XR Telnet (xr-telnet) |
NCS540l-iosxr-26.2.1.tar |
Supports Telnet |
| IOS XR EIGRP (xr-eigrp) |
NCS540l-iosxr-26.2.1.tar |
Supports EIGRP |
| IOS XR CDP (xr-cdp) |
NCS540l-iosxr-26.2.1.tar |
Supports CDP |
| IOS XR k9sec (xr-k9sec) |
NCS540l-k9sec-rpms.26.2.1.tar |
Supports 802.1X |
| IOS XR RIP (xr-rip) |
NCS540l-iosxr-26.2.1.tar |
Supports RIP |
Table 7. Release 26.2.1 Software for N540X-4Z14G2Q-A/D, N540X-8Z16G-SYS-A/D, N540-6Z14S-SYS-D, N540-6Z18G-SYS-A/D, N540X-6Z18G-SYS-A/D, and N540X-6Z6G-SYS
| Package |
Filename |
Description |
| Base image |
||
| IOS XR Base Image |
ncs540l-aarch64-26.2.1.iso |
IOS XR base image with mandatory packages. The ISO image also includes the following optional packages: xr-bgp xr-cdp xr-eigrp xr-ipsla xr-is-is xr-k9sec xr-lictrl xr-lldp xr-mcast xr-mpls-oam xr-ncs540l-mcast xr-ncs540l-netflow xr-netflow xr-ospf xr-perf-meas xr-perfmgmt xr-rip xr-telnet xr-track These optional packages are also included in NCS540l aarch64 iosxr optional rpms-26.2.1.tar. |
| USB Boot Package |
ncs540l-aarch64-usb_boot-26.2.1.zip |
Package required to perform USB Boot. Includes the same packages as the base image. |
| Optional packages not included in the base image |
||
| Package |
Filename |
Description |
| IOS XR Telnet (xr-telnet) |
NCS540l-aarch64-iosxr-optional-rpms-26.2.1.tar |
Supports Telnet |
| IOS XR EIGRP (xr-eigrp) |
NCS540l-aarch64-iosxr-optional-rpms-26.2.1.tar |
Supports EIGRP |
| IOS XR CDP (xr-cdp) |
NCS540l-aarch64-iosxr-optional-rpms-26.2.1.tar |
Supports CDP |
| IOS XR k9sec (xr-k9sec) |
NCS540l-aarch64-k9sec-rpms.26.2.1.tar |
Supports 802.1X |
| IOS XR RIP (xr-rip) |
NCS540l-aarch64-iosxr-optional-rpms-26.2.1.tar |
Supports RIP |
Table 8. Related resources
| Document |
Description |
| Provides access to Cisco product documentation for checking feature support details. |
|
| An interactive tool that assists in locating features introduced across Cisco IOS XR releases and platforms. |
|
| Search by release number, error strings, or compare release numbers to view a detailed repository of error messages and descriptions. |
|
| Select the MIB of your choice from a drop-down to explore an extensive repository of MIB information. |
|
| CCO Documentation for Cisco NCS 540 Series Routers |
|
| Outlines the features currently supported by each operating system. |
|
| Provides a list of insecure features and protocols that are scheduled for systematic deprecation and eventual removal from specified Cisco products. |
|
| Details the reasons why certain features or protocols are deemed insecure and offers secure alternatives when available. |
|
| Information about Smart Licensing Using Policy solutions and their deployment on IOS XR Routers. |
|
| Search by product family, product ID, data rate, reach, cable type, or form factor to determine the transceivers that Cisco hardware device supports. |
|
| A user-friendly reference designed to easily explore and understand the various data models supported in Cisco IOS XR platforms and releases. |
|
| Repository containing the folders with yang data models introduced and enhanced in every IOS XR release. |
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2026 Cisco Systems, Inc. All rights reserved.