Release Notes for Cisco 8000 Series Routers, IOS XR Release 26.2.1

BGP

Software Reliability

BGP RPKI-based origin validation on inbound iBGP prefixes

You can now enhance internal routing security by validating iBGP-learned routes against RPKI origin-AS data. The feature accepts only routes with valid or not-found ROA status and drops invalid ones, preventing propagation of unauthorized prefixes within your network.

Software Reliability

BGP RPKI-based origin validation for outbound eBGP prefixes

You can now prevent propagation of unauthorized routes, reduce manual filtering errors, and strengthens routing security. by validating prefix origin-AS against the local RPKI ROA database before advertising routes to external BGP peers. You apply a route-policy with the drop-post-policy-if-RPKI-invalid keyword to automatically drop prefixes with invalid ROA status.

IP Addresses and Services

Software Reliability

Slice-aware Prefix Programming for Egress-Object-Group ACLs

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200,P100], 8700 [ASIC: P100, K100],8010 [ASIC: A100]); Centralized Systems (8600 [ASIC:Q200]) ;Modular Systems (8800 [LC ASIC:Q200, P100])

This feature enhances hardware efficiency by programming Egress Object-Group ACL (OG-ACL) prefixes only on the active slices where an ACL is applied, rather than replicating them across all slices. Previously, prefixes were duplicated on every slice, leading to higher TCAM and HCAM usage and reduced performance. The software now automatically identifies, and programs prefixes only for relevant slices, dynamically replicating them when new interfaces or bundle members are added. This optimization increases scalability for other hardware-based applications, supports both IPv4 and IPv6 OG-ACLs, and requires no additional configuration.

Ease of setup

Extend support for ACLs on BVI to A100-based ASICs

Introduced in this release on: Fixed Systems (8010 [ASIC: A100]) (select variants only*)

You can now apply ACLs on Bridged Virtual Interfaces (BVIs) on A100-based ASICs. This feature allows the router to block malicious traffic that targets the router. You can apply ACLs in both ingress and egress directions on a BVI.

*This feature support is now extended to:

Software Reliability

TCP MSS adjustment

Introduced in this release on: Fixed Systems (8200, 8700, 8010) (select variants only*), Modular Systems (8800 [LC ASIC: P100]) (select variants only*)

You can now prevent packet fragmentation and ensure TCP segments remain within the interface MTU by using TCP MSS adjustment. This feature modifies the Maximum Segment Size on transit IPv4 and IPv6 TCP SYN and TCP SYN-ACK packets. This helps ensure optimal traffic flow during session establishment.

*This feature is now supported on:
Line cards:

 Fixed systems:

Software Reliability

24 bit bincode support for egress object-group ACLs

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100]), 8010 [ASIC: A100]; Modular Systems (8800 [LC ASIC: P100])

You can now improve network policy granularity and control by supporting 24-bit bincode sizes for egress object-group ACLs. This enhancement improves the efficiency of handling extended network object-groups and supports the inclusion of larger, more detailed prefix lists.

Software Reliability

Configurable trap policers

Introduced in this release on: Fixed Systems (8200, 8700); Centralized Systems (8600); Modular Systems (8800 [LC ASIC: Q200, P100])

Configurable trap policers give you precise control over control-plane traffic by allowing per-trap rate limiting and average packet size tuning. This flexibility helps prevent unnecessary packet drops, improves traffic handling, and enables efficient scaling across diverse deployment scenarios.

Interface and Hardware Component

Software Reliability

DWDM-SFP10G-E-I tunable optics for Cisco 8711-48Z-M router

Introduced in this release on: Fixed Systems (8700 [ASIC: K100])

This feature enables full DWDM channel tuning capability for the DWDM-SFP10G-E-I optics on Cisco 8711-48Z-M, allowing operation up to 196.3 THz and ensuring proper integration with your optical transport infrastructure.

Software Reliability

Network Virtualization Generic Routing Encapsulation (NVGRE) hash field selections

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200]; Centralized Systems (8600 [ASIC: Q200]; Modular Systems (8800 [LC ASIC: Q200, Q100])

You can now improve load balancing for Network Virtualization using Generic Routing Encapsulation (NVGRE) traffic by excluding the NVGRE payload from the hash calculation. This feature optimizes traffic distribution across multiple paths, preventing uneven load caused by hashing on the NVGRE payload.

The feature works by modifying the Cisco Express Forwarding (CEF) load-balancing hash algorithm to exclude the NVGRE payload field. This adjustment ensures that the hash calculation uses only relevant header fields, leading to better traffic distribution and network performance.

Software Reliability

Support for DP04QSDD-LLH-A1 optical module

This release introduces support for the Cisco 400G QSFP-DD Ultra Long-Haul (ULH) L-band coherent optical module on these line cards and routers:

Ease of Use

Generic UDP Encapsulation for IPv6 Traffic

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200])

This release introduces support for Generic UDP Encapsulation (GUE) tunnels operating over IPv6 underlays (GUEv6). With this feature, you can enable the highly efficient, scalable, and secure deployment of Generic UDP Encapsulation variant 1 (GUEv1) static tunnels to carry IPv4 and IPv6 traffic over IPv6 networks.

Software Reliability

Extend support for BVI and IRB infrastructure to A100-based ASICs.

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])

We have enabled support for Bridge-Group Virtual Interface (BVI) and Integrated Routing and Bridging (IRB) infrastructure on A100-based routers.
This functionality is now available on these routers:

Software Reliability

Link flap err-disables

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]);Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: K100)]

You can achieve reliable network performance and a stable system state by isolating unstable interfaces that flap excessively, preventing routing protocol disruptions and ensuring effective workload failover. With this feature, the system monitors link transitions and automatically moves physical, breakout, or bundle member interfaces into an error-disabled state if a defined flap-count threshold is breached within a specific time window. This automated mechanism guarantees traffic redirection to stable paths while providing the flexibility of manual restoration or a timer-based automatic recovery once the link stabilizes.

Hardware Reliability

QDD OLS support

Introduced in this release on: Fixed Systems (8010 ASIC: A100

The QDD Optical Line System (OLS) pluggable optical amplifier is now supported on these ports.

*This feature is supported on:

Software Reliability

Support for DP04QSDD-ULH-A1 optical module

Introduced in this release on: Modular Systems (8800 [LC ASIC: Q200])

This release introduces support for the Cisco 400G QSFP-DD Ultra Long-Haul (ULH) coherent optical module on these line cards:

The 400G QSFP-DD ULH optics are supported on even-numbered ports only. The supported port numbers are: 0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30, 32, 34.

Software Reliability

Support for DP04QSDD-ULH-A1 optical module

This release introduces support for the Cisco 400G QSFP-DD Ultra Long-Haul (ULH) C-band coherent optical module on these line cards and routers:

L3VPN

Ease of setup

Extend support for BVI in L3VPN over SRv6

Introduced in this release on: Fixed Systems (8010 [ASIC: A100]) (select variants only*)

*This feature support is supported on:

Licensing

Licensing process

Support for Smart Licensing Using Policy

Introduced in this release on: Modular Systems (8800 [LC ASIC: K100]) (select variants only*)

Cisco Smart Licensing Using Policy streamlines the licensing process for Cisco IOS XR products. You no longer need to register your device during installation, and there is no evaluation license state or period.

*Support for Smart Licensing Using Policy is now extended to 88-LC1-48Y8H-EM.

MPLS

API experience

Regular expressions in MPLS-TE tunnel names

Introduced in this release on: Fixed Systems(8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100])(select variants only*); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])(select variants only*)

This feature enhances operational scalability and usability by allowing regex-based tunnel name filtering for MPLS‑TE show and execution commands, without changing configuration models, architecture, or security posture.

This feature supports regular expression in all MPLS-TE show and execution commands using tunnel names.

Multicast

Ease of Use

Global table multicast

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC:Q200], 8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

Global Table Multicast (GTM) simplifies multicast deployments by allowing Next-Generation Multicast VPN (NG-mVPN) profiles to operate directly within the global routing table with the default VRF on PE routers. Service providers can now transport multicast traffic in a global context without creating dedicated VRFs, while still using NG-mVPN for signaling and transport.

Previously, NG-mVPN required deployment within a VRF, which added configuration overhead for multicast services.

Netflow

Software Reliability

sFlow support for policy-based routing (PBR) IP-in-IP tunnel traffic

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]);Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: K100)]

sFlow now supports policy-based routing (PBR) IP-in-IP tunnel traffic, providing enhanced visibility into tunneled and decapsulated flows. The feature enables sampling, export, and reporting of both inner and outer packet headers while preserving platform and forwarding context, allowing more accurate flow records and improved traffic monitoring and load-balancing decisions.

Upgrade

Flow monitoring on egress interface

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature requires Egress Feature Capability (EFC) on supported platforms. Use the hw-module profile edge-mode CLI command to enable the EFC feature.

The feature introduces these changes:
CLI:

*This feature is now supported on:

Software Reliability

Increased sampling interval support for NetFlow and sFlow

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]);Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: K100)]

You can now significantly reduce analytics and collector load by setting much higher NetFlow or sFlow sampling intervals by up to 8 million packets. Just configure your desired interval, and we automatically combine hardware sampling and software filtering to achieve this rate, ensuring accurate exports and minimal resource usage while keeping setup simple.

Programmability

Software Reliability

AFT state-synced flag in OpenConfig

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]);Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: K100)]

You can now monitor forwarding state convergence with the AFT state-synced flag in OpenConfig, which provides per-VRF visibility into when FIB entries have fully synchronized with INSIGHT. The flag is set to TRUE once synchronization completes for a VRF and remains TRUE until a new synchronization event occurs or the VRF is removed, enabling automated monitoring and validation through OpenConfig telemetry or CLI.

QoS

Upgrade

Configurable burst values for QoS policers

Introduced in this release on: Fixed Systems (8200 [ASIC: P100, A100], 8700 [ASIC: P100, K100]); Centralized Systems (8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: P100])
You can now configure conform and exceed burst values for 1R2C and 2R3C QoS policers instead of relying on platform-calculated default burst values. This capability provides finer control over burst tolerance and traffic policing behavior enabling granular control of traffic differentiation.

Upgrade

Egress queuing on L2 subinterfaces

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100]); Centralized Systems (8400 [ASIC: K100])(select variants only*)

You can now apply egress queuing policies on Layer 2 subinterfaces to allocate dedicated VOQs for subinterface traffic. This enhancement enables independent traffic management for Layer 2 and Layer 3 services that share the same physical or bundle interface.

This capability provides more granular bandwidth control for multi-customer services, such as such as cloud, content-provider, VPWS, and so on.

This release also adds child-level shaping support for Layer 2 subinterface queuing.


*This feature is supported on 8404-SYS-D.

Upgrade

Multicast traffic scheduling on egress queues

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature requires Egress Feature Capability (EFC) on supported platforms. Use the hw-module profile edge-mode CLI command to enable the EFC feature.

The feature introduces these changes:
CLI:

*This feature is now supported on:

Upgrade

QoS on PWHE

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature requires Egress Feature Capability (EFC) on supported platforms. Use the hw-module profile edge-mode CLI command to enable the EFC feature.

The feature introduces these changes:
CLI:

*This feature is now supported on:

Upgrade

Increased class-map scale for egress QoS policies

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC:Q200], 8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: Q200, P100])


Now you can configure up to 16 class maps per egress QoS policy instead of the earlier limit of 8, giving you more granular control over outbound traffic classification and marking.

Ease of Use

VOQ CGM profile prefitting

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100]; Modular Systems (8800 [LC ASIC: P100])


Now you can use a unified VOQ CGM profile allocation model improving interoperability between K100 and P100 line cards for QL, DQL, and RED configurations. This feature introduces the prefit model for P100 line cards, maps QL configurations to reserved prefit profiles, and provides 12 dedicated custom profiles for DQL and RED.

Upgrade

Egress feature capability

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

You can now enable Egress Feature Capability (EFC) on supported platforms to expand support for egress traffic management features. EFC uses an egress processing path to enable capabilities such as egress queuing, egress policing, and multicast QoS scheduling.

The feature introduces these changes:
CLI:

*This feature is now supported on:

Upgrade

Bridged Virtual Interface two-pass QoS

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100]; Modular Systems (8800 [LC ASIC: P100])
You can now apply ingress policing and egress QoS policies on BVI interfaces. The feature extends QoS processing beyond ingress classification and marking and preserves QoS metadata across BVI recycle operations for consistent traffic treatment throughout the forwarding pipeline.

Routing

Software Reliability

VRF-specific BFD multipath location assignment

This feature allows you to pin BFD MP sessions to specific LCs by associating a destination IP and VRF with a physical location. When configured, the system automatically migrates matching sessions to the designated LC. This prevents collateral service disruption for unrelated tenants by ensuring that an LC reload only impacts sessions pinned to that specific hardware.

Software Reliability

BGP RPKI-based origin validation on inbound iBGP prefixes

You can now enhance internal routing security by validating iBGP-learned routes against RPKI origin-AS data. The feature accepts only routes with valid or not-found ROA status and drops invalid ones, preventing propagation of unauthorized prefixes within your network.

Upgrade

BFD over pseudowire headend

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature requires Egress Feature Capability (EFC) on supported platforms. Use the hw-module profile edge-mode CLI command to enable the EFC feature.

The feature introduces these changes:
CLI:

*This feature is now supported on:

Software Reliability

BGP RPKI-based origin validation for outbound eBGP prefixes

You can now prevent propagation of unauthorized routes, reduces manual filtering errors, and strengthens routing security. by validating prefix origin-AS against the local RPKI ROA database before advertising routes to external BGP peers. You apply a route-policy with the drop-post-policy-if-RPKI-invalid keyword to automatically drop prefixes with invalid ROA status.

Software Reliability

BGP hardware-acknowledged route advertisement

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100,Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]);Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: K100)]

This feature delays BGP route advertisement until routes are confirmed programmed in hardware, preventing traffic loss from premature advertising. It uses synchronization markers and hardware acknowledgments to ensure routes are only advertised after hardware installation, enhancing network stability and performance with minimal manual intervention.

Ease of Use

Fast Reroute recirculation avoidance

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200])
You can now eliminate packet recirculation during Fast Reroute (FRR) events in PE routers. The feature ensures that traffic switches to backup paths without requiring recycle operations during both first and subsequent FRR events.
Previously, traffic switched to backup paths during FRR events that required one or more recycle passes, increasing bandwidth and reducing efficiency.

Ease of Use

PBR asynchronous HW-ACK over SL-API

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200, P100])

This feature improves the reliability of PBR readiness signaling over SL-API. The router now returns a fast Sync-Ack for request acceptance and a separate asynchronous HW-ACK after it programs the NHG in hardware. This change helps the controller send traffic only after the NHG is ready.

The enhancement allows PBR policies to be programmed in the background without blocking the controller.

Ease of setup

Extend support for bidirectional forwarding detection on BVI to A100-based ASICs

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])

You can now extend the advantage of BFD low-overhead and short-duration path failure detection to an IRB deployment by configuring BFD on multi-path single-hop sessions using a BVI.

Segment Routing

Software Reliability

One-Way IP measurement with 3L monitoring and hardware offload

Introduced in this release on: Fixed Systems (8200 [ASIC:  Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200, P100])

The one-way IP Measurement probe utilizes hardware offload to provide high-performance ECMP path monitoring while eliminating return path exposure. It integrates automated path discovery with 3L monitoring, delivering 20ns latency accuracy, alternate marking for loss, and 2ms liveness detection. The primary advantage is the ability to achieve granular, real-time visibility across large-scale environments without the complexity of bidirectional traffic. This enhancement ensures superior network reliability and faster troubleshooting by accurately measuring performance across all discovered ECMP paths.

Ease of Use

SRv6 Flow Label entropy via source address

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8400 [ASIC: K100]); Modular Systems (8800 [LC ASIC: P100])

You can now improve SRv6 load balancing by encoding entropy from the IPv6 Flow Label into the IPv6 source address during SRv6 encapsulation. The ingress node generates a flow-aware source address. This allows downstream devices to use standard IP-based hashing for consistent ECMP load balancing.

With this feature, devices use the modified source address for hashing so effective end-to-end load balancing occurs, even when the flow label is not considered.

Previously, SRv6 relied on Flow Label–based entropy for load balancing. Some backbone nodes, especially in cloud environments ignore the Flow Label. This caused traffic polarization and inefficient bandwidth utilization.

Setup and Upgrade

API experience

BootstrapStream RPC for Bootz Process

Introduced in this release on: Centralized Systems (8400 [ASIC: K100])(select variants only*)

BootstrapStream RPC enhances the security, flexibility, and future‑readiness of Bootz process by enabling TLS 1.3-based device bootstrapping in Cisco IOS XR regardless of the hardware limitations in SUDI certificate.

With the BootstrapStream RPC, backward compatibility with the existing Bootz infrastructure is preserved.

Upgrade

Traffic mirroring on PWHE

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature requires Egress Feature Capability (EFC) on supported platforms. Use the hw-module profile edge-mode CLI command to enable the EFC feature.

The feature introduces these changes:
CLI:

*This feature is now supported on:

Upgrade

Deprecated insecure protocols in optional RPMs

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

This feature improves platform security and reduces the threat surface of the Cisco Networking products by restricting insecure protocols such as Telnet, FTP, TFTP, and RCP (which were deprecated in Cisco IOS XR Release 25.4.1) from Cisco IOS XR base package.

In this release, Telnet is added to the optional RPM, {{Telnet.rpm}}, and FTP, TFTP, and RCP are added to the optional RPM, {{IP-Insecure-Apps.rpm }}.

We recommend you to migrate to secure alternatives such as SSH, SCP, SFTP as Telnet, FTP, TFTP, and RCP protocols will not be supported anymore starting from an upcoming Cisco IOS XR release.

System Security

Ease of Use

FIDO2 authentication for SSH

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100, Q200, P100], 8700[ASIC: P100, K100], 8010 [ASIC: A100])(select variants only*); Centralized Systems(8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

FIDO2 support for SSH enables secure, passwordless logins by using hardware security keys to store private keys. This feature requires physical user presence to authenticate sessions and protects against phishing by verifying a signature from the security device during the login process.

Software Reliability

Post-Quantum Cryptography key exchange support for Cisco SSH

Introduced in this release on: Fixed Systems (8200 [ASIC:  Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100])(select variants only*); Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: Q100, Q200, P100])(select variants only*)

CiscoSSH mitigates quantum threats to ensure long term confidentiality and integrity of remote access and data transfer by introducing PQC (Post-Quantum Cryptography) hybrid key exchange algorithms.

Supported algorithms include ML-KEM and NTRU Prime hybrids:

* mlkem768x25519-sha256

* sntrup761x25519-sha512

* sntrup761x25519-sha512@openssh.com

Upgrade

Lawful intercept

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature requires Egress Feature Capability (EFC) on supported platforms. Use the hw-module profile edge-mode CLI command to enable the EFC feature.

The feature introduces these changes:
CLI:

*This feature is now supported on:

Ease of Use

MACsec state reflection on line protocol

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC:Q100, Q200, P100])

MACsec State Reflection on line protocol synchronizes the interface line protocol state with the MACsec session state. When the session is not secured and the security policy is set to must-secure, the interface is brought Down to prevent traffic blackholing. When the session is secured, the interface is restored to Up. This enables faster failure detection and traffic rerouting by upper-layer protocols such as LACP and BGP.

Previously, MACsec session failures did not affect the interface's line protocol status, often resulting in silent traffic drops and delayed network convergence.

Software Reliability

URPF source validation using VRF table

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200]) Modular Systems (8000 [ASIC: Q200]) (select variants only*)

This feature provides secure traffic validation by supporting high prefix scales and high-speed updates that exceed the capabilities of standard Access Control Lists. It implements a new loose mode Unicast Reverse Path Forwarding (URPF) by using a dedicated URPF Virtual Routing and Forwarding (VRF) table for source lookups.

This process enables efficient source validation within existing platform routing limits.

*This feature is supported on:

Ease of Use

ECC P-256 integration

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200], (select variants only*)

ECC256 enablement enhances device security by migrating identity and attestation workflows to ECCp256-based SUDI via the Trust Anchor Module (TAM). This transition enables the adoption of TLS 1.3 for critical services such as BootZ, secure Zero-Touch Provisioning (sZTP), and EMSD. Operational continuity is ensured through a resilient fallback to legacy RSA-based keys if needed. ECC p256 is automatically enabled when certificates are present; no additional configuration steps are required.
*This feature is applicable on:

System Monitoring

Software Reliability

Deprecation of legacy uni-dimensional healthcheck metrics

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC:Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

Effective Cisco IOS XR Software Release 26.2.1, the legacy uni-dimensional infrastructure health check metrics are deprecated, and hence the support for the show healthcheck metric

 command syntax is removed and will no longer be supported in future releases. This change simplifies command-line operations and eliminates redundant workflows.

We recommend you to use YANG models available from resmon, wdmon and shell-utils which provide the same data. This approach provides more granular, scalable, and standardized access to metrics data, aligning with modern network automation and telemetry practices.

L2VPN

Upgrade

Enhance network efficiency and scalability with GIL pruning for PWHE interfaces

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature requires Egress Feature Capability (EFC) on supported platforms. Use the hw-module profile edge-mode CLI command to enable the EFC feature.

The feature introduces these changes:
CLI:

*This feature is now supported on:

Upgrade

Pseudowire Headend

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only*)

This feature requires Egress Feature Capability (EFC) on supported platforms. Use the hw-module profile edge-mode CLI command to enable the EFC feature.

The feature introduces these changes:
CLI:

*This feature is now supported on:

Optics

This release introduces the following new optic on selective hardware within the product portfolio. For details, refer to the Transceiver Module Group (TMG) Compatibility Matrix.

Cisco 400G QSFP-DD Ultra Long Haul Coherent Optics

8804-FAN-V2, 8808-FAN-V2, and 8818-FAN-V2 fan trays

To maintain optimal cooling, the 8804-FAN-V2, 8808-FAN-V2, and 8818-FAN-V2 high-performance fan trays must be installed if the router is configured with:

CSCws46053

K100 pwhe: Ping does not work with 4K L3 sub-interface with triggers.

CSCwu08833

The new local SID is not updated to PD L2FIB for the down PW after removing/rolling back the SRv6 configuration.

CSCwt81929

The process restart of ifmgr results in route flapping and traffic loss.

CSCwu32085

cfmd abnormal process restart

CSCwu51305

bfd_agent mem leak at sysdb_edm_finddata_datalist_create sysdb_lib_edm_list.c:443

Release 26.2.1

Crosswork Optimization Engine 6.0

Evolved Programmable Network Manager 8.1.1

Cisco 8010 Series Routers - Chassis

8011-12G12X4Y-A

Cisco 8011 12x1G, 12x1/10G, 4X1/10/25G

Release 25.4.1

8011-12G12X4Y-D

Cisco 8011 12x1G, 12x1/10G, 4X1/10/25G

Release 25.4.1

8011-32Y8L2H2FH

Cisco 8010 32X25G SFP28, 8x50G, 2x100GQSFP28, 2x400G QSFP-DD

Release 25.4.1

8011-4G24Y4H-I

Cisco 8010 1 RU Fixed System - 4 QSFP28 100GbE, 24 SFP28 25GbE, and 4 RJ-45 100MbE

Release 25.1.1

Cisco 8010 Series Routers – Power Supply Unit (PSU)

PWR-650-AC-R

Cisco 650W AC Power Module

Release 25.4.1

PWR-930-DC-R

Cisco 930W DC Power Module

Release 25.4.1

PWR-400-AC

Cisco 400W AC Power Module

Release 25.1.1

PWR-400-DC

Cisco 400W DC Power Module

Release 25.1.1

Cisco 8200 Series Routers - Chassis

8201-32FH

Cisco 8200 1 RU Fixed System - 32 QSFP56-DD 400GbE

Release 7.3.15

8201-24H8FH

Cisco 8200 1 RU Fixed System - 8 QSFP56-DD 400GbE and 24 QSFP28 100GbE

Release 7.7.1

8202-32FH-M

Cisco 8200 2 RU Fixed System - 32 QSFP56-DD 400GbE with MACsec

Release 7.5.2

8212-48FH-M

Cisco 8200 2 RU Fixed System - 24 QSFP-DD 800G or 48 QSFP56-DD 400GbE with MACsec

Release 24.3.1

Cisco 8200 Series Routers – Power Supply Unit (PSU)

PSU1.4KW-ACPI

Cisco 1.4KW AC Power Module with Port-side Air Intake

Release 7.0.12

PSU1.4KW-ACPE

Cisco 1.4KW AC Power Module with Port-side Air Exhaust

Release 7.0.12

PSU2KW-ACPI

Cisco 2KW AC Power Module with Port-side Air Intake

Release 7.3.1

PSU2KW-ACPE

Cisco 2KW AC Power Module with Port-side Air Exhaust

Release 7.3.1

PSU3KW-HVPI

Cisco 3KW HV AC/DC Power Supply Unit

Release 7.5.3

Cisco 8400 Series Routers - Chassis

8404-SYS-D

Cisco 8404 – 4-Slot Centralized Chassis

Release 26.1.1

Cisco 8400 Series Routers - Modular Port Adapters (MPA)

84-MPA-2H12Z-M

Cisco 8404 MPA with 2x100G QSFP28 + 12x1/10/25/50G SFP56

Release 26.1.1

84-MPA-2FH/6H-M

Cisco 8404 MPA with 2x400G / 6x100G QSFP56-DD

Release 26.1.1

Cisco 8400 Series Routers - Power Entry Module (PEM)

8404-DC-PEM

Cisco 8404 DC Power Entry Module

Release 26.1.1

Cisco 8600 Series Routers - Chassis

8608

Cisco 8600 7 RU Centralized System

Release 7.10.1

Cisco 8600 Series Routers - Modular Port Adapters (MPA)

86-MPA-14H2FH-M

Cisco 8608 MPA - 2 QSFP-DD 400GbE and 14 QSFP / 16 QSFP 100GbE

Release 7.10.1

86-MPA-24Z-M

Cisco 8608 MPA - 24 SFP56 10/25/50 GbE

Release 7.10.1

86-MPA-4FH-M

Cisco 8608 MPA - 4 QSFP-DD 400GbE

Release 7.10.1

Cisco 8600 Series Routers – Power Supply Unit (PSU)

PSU3.2KW-ACPI

Cisco 3.2-kW AC Power Supply Unit

Release 7.10.1

PSU3.2KW-DCPI

Cisco 3.2-kW DC Power Supply Unit

Release 7.10.1

PSU4.3KW-HVPI

Cisco 4.3KW HV AC/DC Power Supply Unit

Release 7.10.1

Cisco 8700 Series Routers - Chassis

8711-48Z-M

Cisco 8700 1 RU Fixed System - 6 QSFP-DD, 4 QSFP56, and 48 SFP56 ports

Release 25.4.1

8711-32FH-M

Cisco 8700 1 RU Fixed System - 16 QSFP-DD800 and 16 QSFP56-DD

Release 24.3.1

8712-MOD-M

Cisco 8700 2 RU Fixed System

Release 24.4.1

Cisco 8700 Series Routers - Modular Port Adapters (MPA)

8K-MPA-4D

Cisco 8712 MPA - 4 QSFP-DD 400GbE

Release 24.4.1

8K-MPA-16H

Cisco 8712 MPA - 16 QSFP-28 100GbE

Release 24.4.1

8K-MPA-16Z2D

Cisco 8712 MPA - 2 QSFP-DD 400GbE, 2 QSFP-DD 200GbE, and 16 SFP 50GbE

Release 24.4.1

8K-MPA-18Z1D

Cisco 8712 MPA - 1 QSFP-DD 400 GbE and 18 zSFP56+ 50GbE

Release 25.1.1

Cisco 8700 Series Routers – Power Supply Unit (PSU)

PSU2KW-ACPI

Cisco 8711-32FH-M PSU – 2KW AC Power Module with Port-side Air Intake

Release 24.3.1

PSU2KW-ACPE

Cisco 8711-32FH-M PSU – 2KW AC Power Module with Port-side Air Exhaust

Release 24.3.1

PSU2KW-DCPI

Cisco 8711-32FH-M PSU – 2KW DC Power Module with Port-side Air Intake

Release 24.3.1

PSU2KW-DCPE

Cisco 8711-32FH-M PSU – 2KW DC Power Module with Port-side Air Exhaust

Release 24.3.1

PSU2KW-DCPI

Cisco 8712-MOD-M PSU – 2KW 48V DC Power Module with Port-side Air Intake

Release 24.4.1

PSU2KW-DCPE

Cisco 8712-MOD-M PSU – 2KW 48V DC Power Module with Port-side Exhaust

Release 24.4.1

PSU2KW-ACPI 

Cisco 8712-MOD-M PSU – 2KW AC Power Module with Port-side Air Intake

Release 24.4.1

PSU2KW-ACPE

Cisco 8712-MOD-M PSU – 2KW AC Power Module with Port-side Exhaust

Release 24.4.1

Cisco 8800 Series Routers - Chassis

8804-SYS

Cisco 8800 Modular System - 10 RU with 4 Line Card Slots

Release 7.3.2

8808-SYS

Cisco 8800 Modular System - 16 RU with 8 Line Card Slots

Release 7.0.12

8812-SYS

Cisco 8800 Modular System - 21 RU with 12 Line Card Slots

Release 7.0.12

8818-SYS

Cisco 8800 Modular System - 33 RU with 18 Line Card Slots

Release 7.0.14

Cisco 8800 Series Routers - Route Processors

8800-RP

Cisco 8800 Route Processor - 4 Core

Release 7.0.12

8800-RP2

Cisco 8800 Route Processor - 8 Core

Release 7.11.1

Cisco 8800 Series Routers - Fabric Modules

8808-FC

Cisco 8808 System Fabric Module - Q100-based fabric modules with 14.4T per LC slot

Release 7.0.12

8812-FC

Cisco 8812 System Fabric Module - Q100-based fabric modules with 14.4T per LC slot

Release 7.0.12

8818-FC

Cisco 8818 System Fabric Module - Q100-based fabric modules with 14.4T per LC slot

Release 7.0.14

8808-FC0

Cisco 8808 System Fabric Module - Q200-based fabric modules with 14.4T per LC slot

Release 7.3.15

8818-FC0

Cisco 8818 System Fabric Module - Q200-based fabric modules with 14.4T per LC slot

Release 7.3.16

8804-FC0

Cisco 8804 System Fabric Module - Q200-based fabric modules with 14.4T per LC slot

Release 7.3.16

8808-FC1

Cisco 8808 System Fabric Module - F100-based fabric modules with 28.8T per LC slot

Release 24.2.1

8804-FC1

Cisco 8804 System Fabric Module - F100-based fabric modules with 28.8T per LC slot

Release 25.1.1

8818-FC1

Cisco 8818 System Fabric Module - F100-based fabric modules with 76T per LC slot

Release 26.1.1

Cisco 8800 Series Routers - Line Cards

8800-LC-48H

Cisco 8800 Line Card with MACsec - Q100 ASIC based 4.8 Tbps line card

Release 7.0.12

8800-LC-36FH

Cisco 8800 Line Card - Q100 ASIC based 14.4 Tbps line card

Release 7.0.12

88-LC0-36FH

Cisco 8800 Line Card - Q200 ASIC based 14.4 Tbps line card

Release 7.3.15

88-LC0-36FH-M

Cisco 8800 Line Card with MACsec- Q200 ASIC based 14.4 Tbps line card

Release 7.3.15

88-LC0-34H14FH

Cisco 8800 Line Card - Q200 ASIC based 9 Tbps line card

Release 7.3.3
Release 7.5.1

88-LC1-36EH

Cisco 8800 Line Card - P100 ASIC based 28.8 Tbps line card

Release 24.2.11

88-LC1-12TH24FH-E

Cisco 8800 Line Card - P100 ASIC based 12 Tbps line card

Release 24.3.1

88-LC1-52Y8H-EM

Cisco 8800 Line Card - P100 ASIC based 3.7 Tbps line card

Release 24.3.1

Cisco 8800 Series Routers – Power Supply Unit (PSU)

PSU4.8KW-DC100

4.8KW 48V 100A DC Power Supply

Release 7.3.2

PSU6.3KW-HV

6.3KW AC/HVAC/HVDC Power Supply

Release 7.0.12

PSU6.3KW-20A-HV

6.3KW AC/HVAC/HVDC Power Supply-20A

Release 7.0.12

Ask AI about this product

Provides access to Cisco product documentation for checking product support details. Start by selecting the product family, then use Ask AI About This Product tab for further information.

Cisco 8000 documentation

Provides CDC documentation for Cisco 8000 series routers.

Cisco IOS XR Error messages

Allows searching by release number, error strings, or comparing release numbers to view a detailed repository of error messages and descriptions.

Cisco IOS XR MIBs

Allows selecting the MIB of your choice from a drop-down to explore an extensive repository of MIB information.

Feature deprecation and removal details

Outlines the features currently supported by each operating system.

Feature deprecation phasing out insecure capabilities

Provides a list of insecure features and protocols that are scheduled for systematic deprecation and eventual removal from specified Cisco products.

Feature removal and suggested alternatives

Details the reasons why certain features or protocols are deemed insecure and offers secure alternatives when available.

Recommended release

Provides a general guide in case of upgrading IOS XR routers or new deployments that involve IOS XR routers.

Smart licensing

Provides information about Smart Licensing Using Policy solutions and their deployment on IOS XR routers.

Transceiver Module Group (TMG) compatibility matrix

Allows searching by product family, product ID, data rate, reach, cable type, or form factor to determine the transceivers that Cisco hardware device supports.

Yang data models in GitHub

Provides yang data models introduced and enhanced in every IOS XR release.