Juniper JUNOS OS 10.4 - S REV 5 Instruction Manual

Junos®OS 10.4 Release Notes
Release 10.4R2
11 February 2011
Revision 6
These release notes accompany Release 10.4R2 of the Junos operating system (Junos
OS). They describe device documentation and known problems with the software. Junos
OS runs on all Juniper Networks M Series, MX Series, and T Series routing platforms, SRX
Series Services Gateways, J Series Services Routers, and EX Series Ethernet Switches.
You can also find these release notes on the Juniper Networks Junos OS Documentation
Web page, which is located at http://www.juniper.net/techpubs/software/junos.
Contents Junos OS Release Notes for Juniper Networks M Series Multiservice Edge Routers,
MX Series Ethernet Service Routers, and T Series Core Routers . . . . . . . . . . . . 6
New Features in Junos OS Release 10.4 for M Series, MX Series, and T Series
Routers.....................................................6
ClassofService..............................................6
InterfacesandChassis.........................................9
JunosOSXMLAPIandScripting................................15
Layer2EthernetServices......................................18
MPLSApplications...........................................19
Multicast...................................................19
MXSeries..................................................19
Routing Policy and Firewall Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
RoutingProtocols............................................21
ServicesApplications.........................................23
SubscriberAccessManagement................................28
SystemLogging.............................................39
VPNs .....................................................40
Changes in Default Behavior and Syntax in Junos OS Release 10.4 for M
Series, MX Series, and T Series Routers . . . . . . . . . . . . . . . . . . . . . . . . . . 42
ClassofService.............................................42
ForwardingandSampling.....................................43
InterfacesandChassis........................................43
JunosOSXMLAPIandScripting................................45
MPLSApplication...........................................46
PlatformandInfrastructure....................................47
RoutingProtocols............................................47
1Copyright © 2011, Juniper Networks, Inc.

Services Applications ........................................49
SubscriberAccessManagement................................51
User Interface and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
VPNs .....................................................54
Issues in Junos OS Release 10.4 for M Series, MX Series, and T Series
Routers....................................................55
CurrentSoftwareRelease.....................................55
Previous Releases ...........................................67
Errata and Changes in Documentation for Junos OS Release 10.4 for M
Series, MX Series, and T Series Routers . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Changes to the Junos OS Documentation Set . . . . . . . . . . . . . . . . . . . . . 77
Errata .....................................................79
Upgrade and Downgrade Instructions for Junos OS Release 10.4 for M Series,
MXSeries,andTSeriesRouters................................83
Basic Procedure for Upgrading to Release 10.4 . . . . . . . . . . . . . . . . . . . . 83
Upgrading a Router with Redundant Routing Engines . . . . . . . . . . . . . . 86
Upgrading Juniper Network Routers Running Draft-Rosen Multicast
VPNtoJunosOSRelease10.1..............................86
Upgrading the Software for a Routing Matrix . . . . . . . . . . . . . . . . . . . . . . 88
UpgradingUsingISSU........................................89
Upgrading from Junos OS Release 9.2 or Earlier on a Router Enabled
forBothPIMandNSR....................................89
Upgrade Policy for Junos OS Extended End-Of-Life Releases . . . . . . . . 90
DowngradefromRelease10.4..................................91
Junos OS Release Notes for Juniper Networks SRX Series Services Gateways
andJSeriesServicesRouters......................................92
New Features in Junos OS Release 10.4 for SRX Series Services Gateways
andJSeriesServicesRouters..................................92
SoftwareFeatures...........................................93
Hardware Features—SRX210, SRX220, and SRX240 Services
Gateways ..............................................115
Hardware Features—SRX220 Services Gateway with Power Over
Ethernet ...............................................116
Hardware Features—SRX1400 Services Gateway . . . . . . . . . . . . . . . . . . 119
Hardware Features—SRX3400 and SRX3600 Services Gateways . . . . 122
Advertising Bandwidth for Neighbors on a Broadcast Link Support . . . . . . . 123
Group VPN Interoperability with Cisco’s GET VPN . . . . . . . . . . . . . . . . . . . . . 123
Changes in Default Behavior and Syntax in Junos OS Release 10.4 for SRX
Series Services Gateways and J Series Services Routers . . . . . . . . . . . . 124
ApplicationIdentification.....................................125
Application Layer Gateways (ALGs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
AppSecure ................................................126
ChassisCluster.............................................126
Command-LineInterface(CLI)................................127
Configuration ..............................................129
DynamicVPN..............................................130
FlowandProcessing........................................130
Installation ................................................132
Integrated Convergence Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Copyright © 2011, Juniper Networks, Inc.2
JUNOS OS 10.4 Release Notes

InterfacesandRouting.......................................132
Intrusion Detection and Prevention (IDP) . . . . . . . . . . . . . . . . . . . . . . . . 133
J-Web ....................................................134
Management and Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Multilink...................................................137
PoweroverEthernet(PoE)...................................138
Security...................................................138
VirtualLANs(VLANs).......................................138
WirelessLAN(WLAN).......................................139
UnsupportedCLI...............................................139
Accounting-Options Hierarchy ................................139
AX411AccessPointHierarchy.................................139
ChassisHierarchy...........................................139
Class-of-Service Hierarchy ...................................140
Ethernet-SwitchingHierarchy.................................140
FirewallHierarchy...........................................140
InterfacesCLIHierarchy......................................140
Protocols Hierarchy.........................................144
RoutingHierarchy...........................................145
Services Hierarchy ..........................................145
SNMPHierarchy............................................145
SystemHierarchy...........................................146
IPv6andMVPNCLI.........................................146
Known Limitations in Junos OS Release 10.4 for SRX Series Services
Gateways and J Series Services Routers . . . . . . . . . . . . . . . . . . . . . . . . . 148
AppSecure ................................................148
ChassisCluster.............................................148
Command-LineInterface(CLI)................................149
DOCSISMini-PIM...........................................150
Dynamic Host Configuration Protocol (DHCP) . . . . . . . . . . . . . . . . . . . . 150
DynamicVPN..............................................150
FlowandProcessing........................................150
Hardware..................................................151
InterfacesandRouting.......................................152
Intrusion Detection and Prevention (IDP) . . . . . . . . . . . . . . . . . . . . . . . . 154
IPv6support...............................................154
J-Web ....................................................154
NetScreen-Remote .........................................155
Network Address Translation (NAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Point-to-Point Protocol over Ethernet (PPPoE) . . . . . . . . . . . . . . . . . . . 156
Security...................................................156
SNMP ....................................................156
Switching .................................................156
Unified Threat Management (UTM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
VPNs .....................................................157
WirelessLAN(WLAN).......................................157
3Copyright © 2011, Juniper Networks, Inc.

Issues in Junos OS Release 10.4 for SRX Series Services Gateways and J
SeriesServicesRouters......................................158
Outstanding Issues In Junos OS Release 10.4 for SRX Series Services
Gateways and J Series Services Routers . . . . . . . . . . . . . . . . . . . . . 158
Resolved Issues in Junos OS Release 10.4 for SRX Series Services
Gateways and J Series Services Routers . . . . . . . . . . . . . . . . . . . . . . 175
Errata and Changes in Documentation for Junos OS Release 10.4 for SRX
Series Services Gateways and J Series Services Routers . . . . . . . . . . . . 178
Changes to the Junos OS Documentation Set . . . . . . . . . . . . . . . . . . . . 178
Errata for the Junos OS Documentation . . . . . . . . . . . . . . . . . . . . . . . . . 179
Errata for the Junos OS Hardware Documentation . . . . . . . . . . . . . . . . 186
Hardware Requirements for Junos OS Release 10.4 for SRX Series Services
Gateways and J Series Services Routers . . . . . . . . . . . . . . . . . . . . . . . . . 189
Transceiver Compatibility for SRX Series and J Series Devices . . . . . . . 189
Power and Heat Dissipation Requirements for J Series PIMs . . . . . . . . . 189
Supported Third-Party Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
J Series CompactFlash and Memory Requirements . . . . . . . . . . . . . . . . 190
MaximizingALGSessions.........................................191
Integrated Convergence Services Not Supported . . . . . . . . . . . . . . . . . . . . . 192
Upgrade and Downgrade Instructions for Junos OS Release 10.4 for SRX
Series Services Gateways and J Series Services Routers . . . . . . . . . . . . 192
Upgrade Policy for Junos OS Extended End-Of-Life Releases . . . . . . . . 192
Junos OS Release Notes for EX Series Switches . . . . . . . . . . . . . . . . . . . . . . . . . . 194
New Features in Junos OS Release 10.4 for EX Series Switches . . . . . . . . . . 194
Hardware .................................................194
Bridging, VLANs, and Spanning Trees . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
ClassofService(CoS).......................................195
FibreChanneloverEthernet..................................195
HighAvailability............................................195
Infrastructure ..............................................195
ManagementandRMON.....................................195
Packet Filters..............................................196
VirtualChassis.............................................196
Changes in Default Behavior and Syntax in Junos OS Release 10.4 for EX
Series Switches ............................................196
Bridging, VLANs, and Spanning Trees . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
ClassofService............................................196
Limitations in Junos OS Release 10.4 for EX Series Switches . . . . . . . . . . . . 197
Access Control and Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Bridging, VLANs, and Spanning Trees . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
ClassofService............................................198
EthernetSwitching..........................................198
Firewall Filters .............................................198
Hardware .................................................198
HighAvailability............................................199
Infrastructure ..............................................199
Interfaces.................................................200
J-Web Interface ............................................201
Layer2andLayer3Protocols.................................201
Copyright © 2011, Juniper Networks, Inc.4
JUNOS OS 10.4 Release Notes

SpanningTreeProtocols.....................................201
VirtualChassis.............................................201
Outstanding Issues in Junos OS Release 10.4 for EX Series Switches . . . . . 202
Access Control and Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Bridging, VLANs, and Spanning Trees . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Ethernet Switching .........................................202
FirewallFilters.............................................203
Hardware.................................................203
Infrastructure..............................................203
J-WebInterface............................................204
Layer2andLayer3Protocols.................................205
ManagementandRMON....................................206
VirtualChassis.............................................206
Resolved Issues in Junos OS Release 10.4 for EX Series Switches . . . . . . . . 206
Access Control and Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Ethernet Switching .........................................207
Hardware .................................................207
Infrastructure ..............................................207
Interfaces.................................................208
J-WebInterface............................................209
Layer2andLayer3Protocols.................................210
ManagementandRMON.....................................210
VirtualChassis.............................................210
Errata in Documentation for Junos OS Release 10.4 for EX Series
Switches..................................................210
J-Web Interface ............................................210
VirtualChassis..............................................211
Upgrade and Downgrade Instructions for Junos OS Release 10.4 for EX
SeriesSwitches.............................................211
Upgrading Software .........................................211
Upgrade Policy for Junos OS Extended End-Of-Life Releases . . . . . . . . 212
Upgrading or Downgrading from Junos OS Release 9.4R1 for EX Series
Switches ..............................................213
Upgrading from Junos OS Release 9.3R1 to Release 10.4 for EX Series
Switches ..............................................213
Junos OS Documentation and Release Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Documentation Feedback...........................................214
RequestingTechnicalSupport........................................214
RevisionHistory....................................................216
5Copyright © 2011, Juniper Networks, Inc.

Junos OS Release Notes for Juniper Networks M Series Multiservice Edge Routers, MX
Series Ethernet Service Routers, and T Series Core Routers
•New Features in Junos OS Release 10.4 for M Series, MX Series, and T Series
Routers on page 6
•Changes in Default Behavior and Syntax in Junos OS Release 10.4 for M Series, MX
Series, and T Series Routers on page 42
•Issues in Junos OS Release 10.4 for M Series, MX Series, and T Series Routers on page 55
•Errata and Changes in Documentation for Junos OS Release 10.4 for M Series, MX
Series, and T Series Routers on page 77
•Upgrade and Downgrade Instructions for Junos OS Release 10.4 for M Series, MX Series,
and T Series Routers on page 83
New Features in Junos OS Release 10.4 for M Series, MX Series, and T Series Routers
The following features have been added to Junos OS Release 10.4. Following the
description is the title of the manual or manuals to consult for further information.
Class of Service
•Hierarchical policer functionality extended to Modular Interface Cards (MICs) (MX
Series routers)—Provides hierarchical policer feature parity with Enhanced Intelligent
Queuing (IQE) PICs. This is useful in provider edge applications using aggregate policing
for general traffic and when applying a separate policer for premium traffic on a logical
or physical interface.
Hierarchical policing on MICs supports the following features:
•Ingress traffic is first classified into premium and non-premium traffic before a policer
is applied.
•The hierarchical policer contains two policers: premium and aggregate.
Premium traffic is policed by both the premium policer and the aggregate policer. While
the premium policer rate-limits premium traffic, the aggregate policer only decrements
the credits but does not drop packets. Non-premium traffic is rate-limited by the
aggregate policer only, resulting in the following behavior:
•Premium traffic is assured to have the bandwidth configured for the premium policer.
•Non-premium traffic is policed to the specified rate limit.
For a list of supported MICs, refer to:
http://www.juniper.net/techpubs/en_US/release-independent/junos/topics/reference/
general/mic-mx-series-supported.html.
The logical-interface-policer and physical-interface-policer statements provide additional
hierarchical policer parameters beyond those of the IQE PICs.
You can apply the policer at the inet, inet6, or mpls family level, as follows:
[edit interfaces ge-0/1/0 unit 0 family (inet | inet6 | mpls)]
input-hierarchical-policer Test-HP;
Copyright © 2011, Juniper Networks, Inc.6
JUNOS OS 10.4 Release Notes

By making a hierarchical policer a logical-interface-policer, you can achieve aggregation
within a logical interface. A hierarchical policer configured as a physical-interface-policer
supports aggregation within a physical interface. Please note that you still apply the
hierarchical policer at the interface and traffic of the families that do not have the
hierarchical policer will be policer. This is different from IQE PICs, where you apply a
hierarchical policer at the logical or physical interface.
For hierarchical policing of all traffic through a logical interface, a hierarchical policer
can be made a logical-interface-policer and applied to all families in the logical interface.
Similarly, you can achieve aggregation at the physical interface level.
[Network Interfaces,Class of Service,Policy]
•DSCP classification for VPLS at the ingress PE (M320 with Enhanced Type III FPC
and M120)—Enables you to configure DSCP classification for VPLS at an ingress PE
for encapsulation types vlan-vpls (IQ2 or IQ2E PICs) or ATM II IQ PIC. To configure,
define the DSCP classifier at the [edit class-of-service classifiers dscp dscp-name]
hierarchy level and apply the DSCP classifier at the [edit interfaces at-fpc-pic-port
unit-logical-unit-number classifiers] hierarchy level. The ATM interface must be included
in the routing instance.
[Class of Service]
•Traffic Control Profile (TCP) support at the FRF.16 physical interface level—FRF.16
bundle interfaces support multiple data-link connection identifiers (DLCIs). The
bandwidth of each of these DLCIs was previously limited to one of the following:
•An aggregate value based on the number of DLCIs under the FRF.16 interface
•A specific percentage through a traffic control profile (TCP) configuration applied
at the logical interface level
When there is a small proportion of traffic or no traffic on an individual DLCI, the
respective member link interface bandwidth is underutilized. Support for TCP features
on the FRF.16 bundle (physical) interface level in Junos OS Release 10.4R2 addresses
this limitation. The supported features include:
•Peak Information Rate (PIR)
•scheduler-map
•delay-buffer
To enable traffic control profiles to be applied at FRF.16 bundle (physical) interface
level, disable the per-unit scheduler, which is enabled by default, by including the
no-per-unit-scheduler statement at the [edit interfaces interface-name]hierarchy level.
To specify traffic control profile features applicable to FRF.16 bundle physical interfaces,
include the shaping-rate,delay-buffer-rate, and scheduler-map statements at the [edit
class-of-service traffic-control-profiles profile-name]hierarchy level. The shaping-rate
and delay-buffer-rate must be specified as a percentage.
To apply the TCP configuration to an FRF.16 bundle (physical) interface, include the
output-traffic-control-profile statement at the [edit class-of-service interfaces
interface-name]hierarchy level.
7Copyright © 2011, Juniper Networks, Inc.
New Features in Junos OS Release 10.4 for M Series, MX Series, and T Series Routers

To view the TCP configuration for an FRF.16 bundle, enter the show class-of-service
traffic-control-profile command.
user@host> show class-of-service traffic-control-profile
Traffic control profile: lsq-2/1/0:0, Index: 35757
Shaping rate: 30 percent
Scheduler map: sched_0
Delay Buffer rate: 30 percent
The following is a complete configuration example:
interfaces {
lsq-0/2/0:0 {
no-per-unit-scheduler;
encapsulation multilink-frame-relay-uni-nni;
unit 0 {
dlci 100;
family inet {
address 18.18.18.2/24;
}
}
}
class-of-service {
traffic-control-profiles {
rlsq_tc {
scheduler-map rlsq;
shaping-rate percent 60;
delay-buffer-rate percent 10;
}
}
interfaces {
lsq-0/2/0:0 {
output-traffic-control-profile rlsq_tc;
}
}
}
scheduler-maps {
rlsq {
forwarding-class best-effort scheduler rlsq_scheduler;
forwarding-class expedited-forwarding scheduler rlsq_scheduler1;
}
}
schedulers {
rlsq_scheduler {
transmit-rate percent 20;
priority low;
}
rlsq_scheduler1 {
transmit-rate percent 40;
priority high;
}
}
Copyright © 2011, Juniper Networks, Inc.8
JUNOS OS 10.4 Release Notes

[Class of Service]
Interfaces and Chassis
•Extend support for 64-bit Junos OS to include RE-1800 Series Routing Engines
(M120, M320, MX960, MX480, and MX240 routers)—Supported Routing Engines
include:
•RE-1800x2-A—Supports 64-bit Junos OS on M120 and M320 routers.
•RE-1800x2-S—Supports 64-bit Junos OS on MX240, MX480, and MX960 routers.
•RE-1800x4-S—Supports 64-bit Junos OS on MX240, MX480, and MX960 routers.
[System Basics]
•Ethernet encapsulation for ATM scheduler (M7i, M10i, M120, and M320 [with
Enhanced III FPC] routers)—Enables support for the configuration of an ATM scheduler
map on an Ethernet VPLS over a bridged ATM interface.
[Network Interfaces]
•Synchronous Ethernet (SyncE) on MX80 routers and MX Series routers with
MPCs—Supports the Ethernet synchronization messaging channel (ESMC), G.8264-like
clock selection mechanism, and external clocking on MX80 routers and MX Series
routers with MPCs. Wireless backhaul and wireline transport services are the primary
applications for these features.
The following features are supported:
•On MX80 routers and MX Series routers, MPCs based on G.8261 and G.8262. This
feature does not work on the fixed configuration version of the MX80 routers.
•All Ethernet type ports are supported on MX80 routers and MX Series routers with
MPCs
•ESMC support as per G.8264
•CLI command selection of clock sources
•Monitoring clock sources (maximum of two clock sources can be monitored
simultaneously)
•Revertive and nonrevertive modes
To configure SyncE, include the synchronization statement and its substatements at
the [edit chassis] hierarchy level.
[Network Interfaces,Interfaces Command Reference]
•Enhanced container interface allows ATM children for containers—M Series and T
Series routers with ATM2 PICs automatically copy the parent container interface
configuration to the children interfaces. Container interfaces do not go down during
APS switchovers, thereby shielding upper layers. This feature allows the various ATM
features to work over the container ATM for APS.
9Copyright © 2011, Juniper Networks, Inc.
New Features in Junos OS Release 10.4 for M Series, MX Series, and T Series Routers

To specify ATM children within a container interface, use the container-list cinstatement
and (primary | standby) option at the [edit interface at-fpc/pic/slot container] hierarchy
level.
To configure a container interface, including its children, use the cinstatement and its
options at the [edit interface ci-n]hierarchy level.
Container ATM APS does not support inter-chassis APS. MLPPP over ATM CI is also
not supported.
[Network Interfaces]
•Signaling neighboring routers of fabric down on T1600 and T640 routers—The
signaling of neighboring routers is supported when a T640 or T1600 router is unable
to carry traffic due to all fabric planes being taken offline for one of the following
reasons:
•CLI or offline button pressed
•Automatically taken offline by the SPMB due to high temperature.
•PIO errors and voltage errors detected by the SPMB CPU to the SIBs.
The following scenarios are not supported by this feature:
•All PFEs get destination errors on all planes to all destinations, even with the SIBs
staying online.
•Complete fabric loss caused by destination timeouts, with the SIBs still online.
When chassisd detects that all fabric planes are down, the router reboots all FPCs in
the system. When the FPCs come back up, the interfaces will not be created again,
since all fabric planes are down.
Once you diagnose and fix the cause of all fabric planes going down, you must then
bring the SIBs back online. Bringing the SIBs back online brings up the interfaces.
Fabric down signaling to neighboring routers offers the following benefits:
•FPCs reboot when the control plane connection to the Routing Engine times out.
•Extends a simple approach to reboot FPCs when the dataplane blacks out.
When the router transitions from a state where SIBs are online or spare to a state where
there are no SIBs are online, then all the FPCs in the system are rebooted. An ERRMSG
indicates if all fabric planes are down, and the FPCs will reboot if any fabric planes do
not come up in 2 minutes.
An ERRMSG indicates the reason for FPC reboot on fabric connectivity loss.
The chassisd daemon traces when an FPC comes online, but a PIC attach is not done
because no fabric plane is present.
A CLI warning that the FPCs will reboot is issued when the last fabric plane is taken
offline.
Copyright © 2011, Juniper Networks, Inc.10
JUNOS OS 10.4 Release Notes