Alert Type

SRN - Software Release Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Product Affected

EX4100

Alert Description

Junos Software Service Release version 25.4R1-S1 is now available for download from the Junos software download site

Download Junos Software Service Release:

  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

NOTE: Starting on August 30th, 2024, we include PR's severity with each entry. See KB86335 [juniper.net] for the definition of PR's Severity

 

Junos Selective Update (JSU) feasible

Not applicable

Call to Action

For your review

Solution

Junos Software service Release version 25.4R1-S1 is now available.

25.4R1-S1 - List of Fixed issues

PR NumberSynopsisCategory: EX2300/3400 PFE
1922040
Major		On EX2300 and EX3400 devices, Network Processing Unit telemetry counters can be incorrect after device or PFE bring up
Product-Group=junos
Severity=Major		On Junos EX2300 and EX3400 switches, after the device or the Packet Forwarding Engine (PFE) starts, some hardware telemetry or statistics related to Network Processing Unit can appear incorrect or fail to report as expected; network traffic is not affected.
PR NumberSynopsisCategory: "agentd" software daemon
1902691
Major		The JSD server fails to start the local SSL certificate for the SSL-based telemetry services in the FIP mode
Product-Group=junos
Severity=Major		On all Junos and Junos OS Evolved platforms, when FIPS is enabled, the JSD server fails to start if a local SSL certificate is configured on telemetry; as a result, telemetry services using SSL certificates are unavailable.
1919448
Major		Heavy traffic flow causing SWAN agent to disconnect from the clients
Product-Group=junos
Severity=Major		In all Junos and EVO platforms, gRPC (Google Remote Procedure Call) connection between the SWAN (Software Wide Area Network) agent and the device is being closed unexpectedly. While SWAN client/JET(Juniper Extension Toolkit) client is connecting and sending data close to 3K(3000) routes at 8KB Per RPC (Remote Procedure Call) over the connection, they can hit rare race condition which can cause the clients to disconnect.
PR NumberSynopsisCategory: Border Gateway Protocol
1915893
Major		The rpd process crash triggered by LLGR stale timer expiry and late reconnection of unconfigured BGP peer on helper node
Product-Group=junos
Severity=Major		On all Junos OS and Junos OS Evolved, when Long-Lived Graceful Restart (LLGR) is configured and a Border Gateway Protocol (BGP) neighbor goes down and reconnects after the LLGR stale timer expires, the Routing Protocol Daemon (rpd) process crashes leading to service disruption.
PR NumberSynopsisCategory: VPWS, L2 CKT, EVPN-VPWS
1911023
Major		Redundant PFE label swap during MHL2circuit failover leading to traffic loss
Product-Group=junos
Severity=Major		On all ACX5448 platform, during a CCC(circuit cross-connect)-to-MPLS primary and protect path next-hop swap event, the in-labels are also being swapped. However, these labels were already swapped during earlier MPLS-to-CCC events. This additional, unintended swap by the PFE leads to traffic disruption.
PR NumberSynopsisCategory: Dynamic rendering infrastructure
1915225
Major		cli-pfe does not terminate immediately when user issues Ctrl-C
Product-Group=junos
Severity=Major		A cli-pfe show command may continue to gather data in the background after the user issues a Ctrl-C. Eventually the background command will complete. However, the CPU usage for the cli-pfe process will continue to be high while it is still running.
PR NumberSynopsisCategory: mgd, ddl, odl infra issues
1906880
Major		Committing a scaled config may take time which can make other sessions appear hung.
Product-Group=junos
Severity=Major		When using ?load override?, committing a scaled configuration (on top of an already committed scaled config) may take longer to complete. During this time, other sessions cannot enter configure mode, which can make those sessions appear hung. It is advised to use 'load update' instead of 'load override' to load the configuration before committing.
PR NumberSynopsisCategory: EVPN control plane issues
1916656
Major		Incorrect CCC state displayed when IFL or interface status is absent
Product-Group=junos
Severity=Major		On all Junos OS and Junos OS Evolved platforms, When the logical interface (IFL) is not present, the system incorrectly reports the Circuit Cross-Connect (CCC) state as CCC Up. Similarly, when the interface status itself is not available, the pseudowire state is shown as CCC_Up or CCC_Down. The pseudowire state should instead be reported as Not Applicable, since the underlying interface or IFL required to determine a valid CCC state does not exist. Displaying CCC Up/Down incorrectly in the absence of interface.
PR NumberSynopsisCategory: EVPN Layer-2 Forwarding
1926818
Major		ARP resolution failure for /32 static host routes via IRB in EVPN virtual-switch routing instances
Product-Group=junos
Severity=Major		On all Junos and Junos Evolved platforms that support EVPN (Ethernet VPN) virtual-switch routing instances, ARP (Address Resolution Protocol) resolution fails for static host routes configured with a /32 mask when the next-hop interface is an IRB (Integrated Routing and Bridging) interface and the destination host resides in a different subnet. As a result, ARP entries are not installed, MAC (Media Access Control) addresses of destination hosts are not learned, and traffic destined to those hosts becomes unreachable, causing service impact.
PR NumberSynopsisCategory: EX interfaces issues
1915222
Minor		Interfaces down after Virtual Chassis reboot
Product-Group=junos
Severity=Minor		On all Junos EX Series platforms, following a Virtual Chassis (VC) reboot, random interface links GE(Gigabit) and XE(10 Gigabit) intermittently appear in a down state at the Interface Descriptor (IFD) level, even though the physical link remains operational.
PR NumberSynopsisCategory: jdhcpd daemon
1911001
Major		On Junos devices supporting subscriber services acting as DHCPv6 relay randomly deletes IA_NA or IA_PD binding/route
Product-Group=junos
Severity=Major		On all Junos devices supporting subscriber services, in case of dual stack DHCP (Dynamic Host Configuration Protocol) subscribers with IA_NA (Identity Association for Non-temporary Address) and IA_PD (Identity Association for Prefix Delegation) bindings with lease times (For the assignment of IPv6 address to a client device), when a client initiates separate renew exchanges for the IA_NA and IA_PD, and once client and DHCP server are in sync with these timers, there can be a race condition at Junos device which is DHCPv6 relay, has not refreshed lease timer and can go out of sync. This can result in deleting IA_NA/IA_PD binding and route to get deleted for that subscriber only. This causes one of the leg for IA_PD or IA_NA to go down for that subscriber, which can result in traffic impact for that leg.
PR NumberSynopsisCategory: Port-based link layer security services and protocols that a
1914499
Major		MACsec session not coming up after multiple reboot of VC member or VC link flaps
Product-Group=junos
Severity=Major		On Junos OS EX series Virtual Chassis platforms, the MACsec interface fails to re-establish sessions after multiple reboots of a particular Virtual Chassis (VC) member or when a VC link flaps. This issue is observed between 4/5 reboots of the VC member. In these case, the MACsec daemon is not notified that the license is installed on the member, resulting in MACsec encryption being unavailable on that interface.
1922797
Major		When Macsec is enabled on 1G interface, Auto-neg needs to be disabled for MX301.
Product-Group=junos
Severity=Major		When Macsec is enabled on 1G interface, Auto-neg needs to be disabled for MX301. Config to disable auto-negotiation: set interfaces <1g-intf-name> gigether-options no-auto-negotiation
PR NumberSynopsisCategory: JUNOS Network App Infrastructure (for ping, traceroute, etc)
1924159
Major		Fetch command output format changed and completion percentage not displayed
Product-Group=junos
Severity=Major		On Junos and Junos OS Evolved platforms, the output format of the fetch command changed after upgrading to a newer upstream version of the utility. The earlier format displayed an explicit completion indicator (for example, 100%). The upgraded version removed this indicator.

 

 

25.4R1-S1 - List of Known issues

PR NumberSynopsisCategory: "agentd" software daemon
1651519
Critical		Junos OS and Junos OS Evolved: Multiple vulnerabilities have been resolved in MQTT
Product-Group=junos		Multiple vulnerabilities have been resolved in MQTT (Message Queuing Telemetry Transport) included with Junos by fixing vulnerabilities found during external security research. Please refer to https://supportportal.juniper.net/JSA71655 [juniper.net] for more information.

Resolved In: evo:20.4R3-S7-EVO evo:21.4R3-S4-EVO evo:22.1R3-EVO evo:22.2R3-EVO evo:22.3R2-EVO evo:22.3X80-D43-EVO evo:22.3X80-D45-EVO evo:22.4R1-EVO junos:19.1R3-S10 junos:19.2R3-S7 junos:19.3R3-S8 junos:19.4R3-S11 junos:20.2R3-S7 junos:20.2X42 junos:20.3R3-S6 junos:20.3X75-D36 junos:20.3X75-D43 junos:20.3X75-D52 junos:20.4R3-S7 junos:21.1R3-S4 junos:21.2R3-S5 junos:21.3R3-S4 junos:21.4R3-S4 junos:22.1R3 junos:22.2R3 junos:22.3R2 junos:22.4R1 junos:23.3R2 junos:23.4R1
1913260
Major		Discrepancy noticed in the interfaces when there is a reset in Linecard or PFE
Product-Group=junos		On all Junos and Junos Evolved platforms, with an established telemetry session with multiple collectors, there will be interface statistics discrepancy when there is a linecard OIR event or PFE offline/online sequence.

Resolved In: evo:22.3X80-D47-EVO evo:22.3X80-D49-EVO evo:26.1R1-EVO junos:24.2R2-S5 junos:24.4R2-S4 junos:25.4R2 junos:26.1R1 junos:26.2R1
PR NumberSynopsisCategory: Border Gateway Protocol
1909265
Major		JDI-RCT:M/Mx: : NGMVPN multicast traffic gets dropped post Change route-distinguisher/route-target on L3VPN instances.
Product-Group=junos		Not consistent issue and happens when RD and RT change is done in all routing instances while the traffic is running. Also sometimes issue seen only in certain instances. When issue happens there will be traffic drop for inclusive tunnel and affecting all flows on inclusive tunnel and it may not recover unless some external events like route change occurs.

Resolved In: evo:25.2R2-EVO evo:25.2R2-S1-EVO evo:25.4R2-EVO evo:26.1R1-EVO evo:26.2R1-EVO junos:25.2R2 junos:25.4R2 junos:26.1R1 junos:26.2R1
1922759
Major		On MX301 rpd may core when logical-systems configuration is used to create EVPN-VPWS
Product-Group=junos		On MX301 rpd may core when logical-systems configuration is used to create EVPN-VPWS

Resolved In:
PR NumberSynopsisCategory: EVPN ELAN/E-TREE
1901224
Major		Traffic drop seen in EVPN VPWS FXC stream post clear bfd session all.
Product-Group=junos		Traffic drop seen in EVPN VPWS FXC stream post "clear bfd session all" command.

Resolved In: junos:25.4R2 junos:26.2R1
PR NumberSynopsisCategory: EVPN control plane issues
1879311
Major		Transient Traffic Duplication During EVPN Multihomed Spine Reboot in Collapsed EVPN-VXLAN Deployments
Product-Group=junos		On all Junos and Junos OS Evolved platforms with EVPN-VxLAN Multihoming scenario, in EVPN multihomed (ESI) deployments without core isolation, a temporary traffic duplication could occur during a spine reboot or any event that forces forwarding re-convergence.

Resolved In: evo:23.4X100-D40-EVO
PR NumberSynopsisCategory: EX4100 PFE
1926180
Major		Inline-monitoring will not work simultaneously
Product-Group=junos		On Junos EX4100 and EX4400 platforms, inline-monitoring for layer 2 and layer 3 will face issue due to hardware limitation. There needs to be separate FTFP groups in hardware Layer 2 and Layer 3 inline monitoring. It will not work simultaneously for L2 and L3 inline-monitoring. Only one group will remain active and monitoring will work for the first group.

Resolved In: junos:25.4R2 junos:26.1R1 junos:26.2R1
PR NumberSynopsisCategory: EX interfaces issues
1870962
Major		The CPU high utilization is observed after PIC offline/online
Product-Group=junos		On EX4400 platforms with 4x25G or 1x100G ULM (Universal Link Module), the CPU hogs by CMQFX thread for as much as 3.7 secs when Firmware download occurs during PIC offline/online and PFE restart time / Device reboot. To speed up the firmware download operation, the MDIO clock (MDC) frequency is increased from 2.6 MHz to 9 MHz which reduced firmware download time from ~3.8 s to ~2.2 s. This is an enhancement PR.

Resolved In: junos:26.2R1
PR NumberSynopsisCategory: EX4400 PFE software
1908971
Major		DHCP Snooping drops due to misrouted server packets causing intermittent issues.
Product-Group=junos		Intermittent performance issues observed across sites due to anomalous DHCP behavior, where DHCP server packets are incorrectly received on downstream switch interfaces, triggering snooping drops.

Resolved In: junos:23.2R2-S7 junos:23.4R2-S8 junos:24.4R2-S4 junos:25.2R2 junos:26.1R1 junos:26.2R1
PR NumberSynopsisCategory: EX optics issues
1899248
Major		EX4400-48F: When we have SFP-SX optics plugged in EX4400-48F device in the ports 0 to 35 and it is rebooted, the activity LED remains on
Product-Group=junos		EX4400-48F: When we have SFP-SX optics plugged in EX4400-48F device in the ports 0 to 35 and it is rebooted, the activity LED remains on.

Resolved In:
1913274
Major		25.4 INDRI RLI : EX4300-48mp : 4x10 ULM, Pic0 , Pic1 are going for Hogging while doing 10G -SFP-T optics JIJO
Product-Group=junos		Jack Out and Jack In need 10 second interval. This hits only when I2C error is seen.

Resolved In:
PR NumberSynopsisCategory: Multiprotocol Label Switching
1901973
Major		On MX301, rpd core may be seen after deactivate/activate protocol isis trigger
Product-Group=junos		On MX301, rpd core may be seen after deactivate/activate protocol isis trigger

Resolved In:
1923867
Minor		The rpd process crash is observed after a graceful restart in the RSVP-TE scenario
Product-Group=junos		On Junos OS and Junos OS Evolved platforms with Graceful Restart and RSVP-TE (Resource Reservation Protocol - Traffic Engineering) configured, an rpd crash is observed, leading to traffic impact after a Graceful Restart if a PVC (Permanent Virtual Circuit) fails to allocate correctly during this recovery process, leaving it in an incomplete or unallocated state, and the system attempts to clean up or remove this unallocated PVC.

Resolved In: evo:24.4R2-S4-EVO evo:25.2R2-EVO evo:25.4R2-EVO evo:26.1R1-EVO evo:26.2R1-EVO junos:23.2R2-S7 junos:23.4R2-S8 junos:24.2R2-S4 junos:24.4R2-S1-J8 junos:24.4R2-S3 junos:25.2R2 junos:25.4R2 junos:26.1R1 junos:26.2R1
1925599
Major		JDI-RCT:M/Mx: during ISSU , may observe some traffic drops for L3VPN streams during FRU upgrade stage (HW resync phase).
Product-Group=junos		On MX platforms, during ISSU, some traffic drop may occur in HW sync phase for few L3VPN flows. The traffic recovers post HW sync phase. This issue is not specific to 25.4R1.

Resolved In:
PR NumberSynopsisCategory: Multicast for L3VPNs
1908581
Major		Significant multicast traffic loss observed during ISSU in Next-Generation Multicast VPN (NGMVPN) deployments
Product-Group=junos		On all Junos platforms that support both InService Software Upgrade (ISSU) and NextGeneration Multicast VPN (NGMVPN), multicast traffic loss can occur during an ISSU operation when NGMVPN deployments use both the Inclusive Provider Multicast Service Interface (IPMSI) and the Selective Provider Multicast Service Interface (SPMSI) with a nonzero threshold. During the ISSU process, Flexible PIC Concentrators (FPCs) upgrade and synchronize, and multicast statistics may briefly report zero. This event causes withdrawal of the SPMSI and a fallback to the IPMSI. If the IPMSI next hops are not fully programmed at that moment, a temporary interruption of SPMSI flows occurs, while IPMSI flows continue forwarding normally. The traffic loss duration is short and typically limited to a few seconds to a few minutes during FPC upgrade cycles, not exceeding the expected ISSU convergence window. Both IPv4 and IPv6 multicast traffic are affected.

Resolved In: evo:26.2R1-EVO junos:26.2R1
PR NumberSynopsisCategory: Protocol Independant Multicast
1918590
Major		On MX301, IGMP may not get enabled by default when PIM is enabled
Product-Group=junos		On MX301, IGMP may not get enabled by default when PIM is enabled. Use "set protocols igmp interface" to explicitly enable IGMP

Resolved In:
PR NumberSynopsisCategory: Issues related to YANG Data Models
1781023
Minor		Few yang package are occuring multiple place On Box
Product-Group=junos		Few yang package are occuring multiple place On Box

Resolved In:
PR NumberSynopsisCategory: Junos Fusion Aggregation Device Infra
1913169
Major		The smdp process crash is observed on MX Aggregation Device during Junos upgrade in a Junos Fusion Deployment
Product-Group=junos		In all Junos MX platforms acting as the AD (Aggregation Device) in a Junos Fusion deployment, a Junos software upgrade causes the smdp (Satellite Platform and Management Daemon) process to crash impacting forwarding plane services. This issue is observed when AD nodes are moved to a higher Junos version while the SD (Satellite nodes) are still running a lower version.

Resolved In: junos:22.4R3-S7-J7 junos:22.4R3-S9 junos:23.2R2-S6