EOS 4.36.1F TOI

A mechanism to verify the authenticity and integrity of EOS Virtual Machine (VM) images is provided for supported virtual platforms. While EOS hardware images (EOS.swi) contain embedded signatures verified by Aboot during secure boot, VM platforms use bundled file formats. To ensure these images are genuine Arista product releases, a detached Cryptographic Message Syntax (CMS) signature is published alongside the VM image files.

The EOS-4.36.1 release introduces SSU support for SRv6 uN. This allows for SSU with SRv6 uN configuration, with negligible impact on active traffic flows.

Static NAT allows a switch to modify the source or destination IP address, and optionally the Layer 4 port, of packets traversing it. Each static NAT rule is explicitly defined by the user and specifies a one-to-one mapping between an original IP address and a translated IP address.

A traffic storm is a flood of packets entering a network, resulting in excessive traffic and degraded performance. Storm control prevents network disruptions by limiting traffic beyond specified thresholds on individual physical LAN interfaces. Storm control monitors inbound traffic levels over one-second intervals and compares the traffic level with a specified benchmark. The storm-control command configures and enables storm control on the configuration mode physical interface.

This feature adds support to configure the following decap group OpenConfig models via gNMI. GRE decap group for incoming traffic with IPv4 or IPv6 inner packets , UDP decap group for incoming traffic with IPv4 or IPv6 inner packets , UDP decap group for incoming traffic with MPLS inner packets

Dynamic Twice NAT is a variant of the dynamic NAT feature where both the source and destination IP can be modified while forwarding a packet. One of the IP addresses will be dynamically assigned, while the other will be statically assigned.

In order to support PIM/IPv4 multicast routing on EOS switches with Broadcom Tomahawk5 ASICs, multicast support using ALPM tables is required. This works in both 3-level Algorithmic Longest Prefix Match (ALPM) capabilities and 2-level ALPM.

In order to support PIM/IPv4 multicast routing on EOS switches with Broadcom Tomahawk4 ASICs, multicast support using ALPM is required. This works in both 3-level Algorithmic Longest Prefix Match (ALPM) capabilities and 2-level ALPM.

Private VLAN is a feature that segregates a regular VLAN broadcast domain while maintaining all ports in the same IP subnet. There are three types of VLAN within a private VLAN

SRv6 is the segment routing using IP v6 Data plane. The segment ID is encoded as an IPv6 address. The Micro-Segment extension to SRv6 has representation of SIDs to enable compressing multiple of them into a single IPv6 address.

Access Control Lists (ACL) use packet classification to mark certain packets going through the packet processor pipeline and then take configured action against them. Rules are defined based on various fields of packets and usually TCAM is used to match packets to rules. For example, there can be a rule to match the packet source IP address against a list of IP addresses, and drop the packet if there is a match. This will be expressed in TCAM with multiple entries matching the list of IP addresses. The number of entries is reduced by masking off bits, if possible. TCAM is a limited resource, so with classifiers having a large number of rules and a big field list, TCAM runs out of resources.

This document describes the availability of VLAN interface ingress and egress counters on R Series platforms. VLAN interface counters provide the ability to count packets and bytes ingressing or egressing a VLAN interface.

This feature allows the export of IP FIB (Forwarding Information Base) through the OpenConfig AFT YANG models.

This feature adds TLS support to TACACS+. With the new CLI commands, users can set an SSL profile and enable using TLS to communicate with TACACS+ servers. Once configured, all TACACS+ traffic is transmitted over TLS 1.3 connections with mutual certificate authentication, providing confidentiality, data integrity, and authenticity for AAA communications.

This article describes the Tap Aggregation MPLS Pop feature. The purpose of this feature is to support tools that do not parse MPLS labels and therefore need the switch to remove (pop) the MPLS header. This feature supports both IPv4 and IPv6 over MPLS.

The Timing Regeneration Filter (TRF) is a part of the Clock and Data Recovery component of the CRT50216 external PHY from Credo. It has a parameter, known as the bandwidth, which adjusts how the CRT50216 adjusts to frequency changes in the incoming signal from the peer.   This TOI documents the addition of a command to allow the user to manually adjust the TRF bandwidth per Ethernet lane.

The tone generation feature enables switches to produce tones for fiber optic identification. This can produce 270Hz tones that standard fiber optic identifier devices can detect. The feature generates tones using SFP transceivers by toggling transceiver transmit disable at a configurable frequency. When enabled, this feature will disrupt the link and traffic on the interface.

VLAN tagged MACsec refers to frames that have a VLAN tag between the MAC source address and the MACsec ethertype. This VLAN tag is unencrypted (in the clear) so that intermediate devices between the MACsec endpoints can forward the MACsec frames based on this unencrypted VLAN tag.

With a static configured import and export route-target for a given vlan-aware-bundle, all its VLAN members share the same route-target value. For example, EVPN uses the same route-target in the Type 2 EVPN route advertisements for hosts residing in two different VLAN of the same bundle.