Tag :: EOS 4.36.2F

ACL-based policing

Ingress policing provides the ability to monitor the data rates for a particular class of traffic and perform action when traffic exceeds user-configured values. This allows users to control ingress bandwidth based on packet classification.  Ingress policing is done by a policing meter which marks incoming traffic and performs actions based on the results of policing meters. We support single rate two color mode and two rate three color marker (TrTCM) (supported on 4.23.1F) for the policer configuration.

BGP Monitoring Protocol (BMP) allows a monitoring station to collect information about a router’s BGP sessions, such as BGP announcements received from peers (Adj-RIB-In),  monitoring the Loc-Rib (as defined by RFC9069), and BGP announcements advertised from the router (Adj-RIB-Out). The announcements are sent to the station in the form of BMP Route Monitoring messages generated from the router’s BGP internal tables.

RPKI serves as a security mechanism to mitigate specific instances of inadvertent route leaking and deliberate route hijacking.

Cable Length Measurement (CLM) is a feature that approximates path delays in cables and derives cable lengths from path delays. It is primarily used for features where knowing the path delay is important, such as hyperports. Upon full implementation of the protocol, EOS CLM would be capable of performing CLM message exchange with connected devices running EOS or other systems that support the CLM protocol.

This is an ecosystem of CLI commands that allow the user to create and apply override profiles for the various CDB capabilities and related EOS software controls of CMIS-compliant transceivers. A profile consists of a set of parameters which, when configured, replace the default parameters provided by the transceiver or by EOS.

Configuration sessions allow the user to issue configuration CLIs that do not take effect immediately. Instead, they are saved in a session with the given name. The session can be entered, modified and exited at any time without affecting the running configuration of the system. When the session is committed, the configuration that was modified in the session is copied into the running configuration. The session can also be aborted or removed to remove the session completely and free up memory used by the session.

The Configurable CPU queue resources feature allows for the customization of the default CPU queue thresholds (Tail-drop and FADT) to meet specific operational requirements. This enables the users to customize control-plane queues to reflect their specific traffic patterns, such as allocating more queuing resources to heavily utilized queues like BGP or Ospf.

This feature allows the user to define a custom DSCP-To-TC map and apply it to an interface. The custom DSCP-To-TC map would only be applicable when the interface is in DSCP trust mode. This feature allows the user to classify packets based on DSCP bits of the IP header. The exact mapping can be specified using a custom DSCP-To-TC map.

This feature allows defining custom TC-To-CoS mapping profiles that can be attached to the interfaces. An attached profile on an egress interface allows mapping internal ( TC and DP ) to outgoing packet’s header QoS fields ( COS and DEI ). Refer below table for the meaning of each field.

This is an addendum to the “IP in IP decapsulation” document.The Decap Group counters feature allows the device to count packets and octets that are decapsulated at the termination of the Decap Group.

Support for DHCPv4 (RFC 2131) and DHCPv6 Server (RFC 8415) was added to EOS-4.22.1 and EOS-4.23.0 respectively. EOS DHCP server leverages ISC Kea as backend. The router with DHCP Server enabled acts as a server that allocates and delivers network addresses with desired configuration parameters to its hosts.

Virtual Router Redundancy Protocol (VRRP) provides high availability for the default gateway within a broadcast domain. Previously, in VRRP-based deployments with DHCP Relay, each participating router forwarded DHCP requests using its interface IP address, which resulted in duplicate relay requests, duplicate DHCP server ACKs, and increased control-plane noise. This feature solves these issues by making DHCP relay processing VRRP state-aware.

EOS adds support for egress IPv4/IPv6 RACL. By default, these are enabled on the default profile. Egress ACL has to be configured the same way as ingress ACL and is applied to an interface by using token “out” instead of “in”

This feature enables support for applying egress QoS policy-maps on L3 Ethernet subinterfaces for outbound traffic. Policy-maps consist of class-maps defining match criteria and associated actions such as policing, dropping, or setting DSCP on matching traffic. Egress QoS Policy-map can be applied on L3 Ethernet subinterfaces for outbound traffic.

EVPN Integrated Routing and Bridging (IRB) is a component of BGP EVPN that allows EVPN tunnel endpoints to advertise host routes. IP mobility further extends this capability by providing a means to resolve conflicts in the event that a host IP address moves between physical MAC addresses. IP duplicate detection determines when a host is rapidly moving between two or more MAC addresses and signals the event with a log message, optionally preventing the misbehaving host IP address from being advertised by EVPN.

EOS-4.20.0F introduces expanded VRRP, VARP and MLAG Peer Gateway virtual MAC capabilities on the 7500R*/7280R*/7020R series because of improved hardware capabilities. Simultaneous support for VRRP, VARP and MLAG Peer Gateway. VARP and MLAG Peer Gateway take priority over VRRP.

This feature introduces a per-VRF table "FIB route count" for hardware FIB tables, and associated actions to. The "FIB route count" for a VRF table includes FIB routes from most protocol sources (e.g., BGP, IGP, static) in each VRF and address-family (IPv4 and IPv6). Once a VRF table's FIB route count reaches a configured limit, routes can be suppressed or evicted based on the configured action.

EOS supports the ability to match on a single VLAN tag (example: encapsulation dot1q vlan 10) or a VLAN tag pair (example: encapsulation dot1q vlan 10 inner 20) to map matching packets to an interface. In this case, the encapsulation string is considered consumed by the mapped interface before forwarding, which means that the tags are effectively removed from the incoming packet for the purposes of any downstream forwarding.

To address these challenges, AristaAppForSplunk is integrated directly into EOS. The application now ships with the SWI image and will automatically enable once the Splunk Universal Forwarder is installed on the switch. Not only does it reduce potential compatibility breakages to a large extent, but also eliminate the installation step of the AristaAppForSplunk extension.

Protocol Independent Multicast (PIM) distributes multicast data using routes gathered by other protocols. PIM Sparse Mode (PIM-SM), defined in RFC 4601, is a multicast routing protocol intended for networks where multicast group recipients are sparsely distributed, including wide-area and inter-domain networks.

IS-IS multi-topology (MT) allows separate topologies for IPv4 and IPv6, enabling independent shortest path (SPF) computations for each address family. While MT provides flexibility, some deployments may seek to migrate from multi-topology to single-topology mode to reduce resource consumption from redundant SPF computations.

L1 error injection enables EOS users to inject a chosen L1 error type from the set of supported error types onto a healthy link and deliver that error to the link partner.

Pseudowires can be used to connect geographically separated L2 networks by emulating an L2 point-to-point connection over a MPLS backbone. While each pseudowire can be configured manually, a L2VPN solution can be used to perform auto-discovery and signaling of the desired pseudowires. VPWS (Virtual Private Wire Service) can be used for auto-discovery and signaling of point-to-point pseudowires. The pseudowires in each VPWS instance can be signaled by LDP or BGP. When signaled using BGP, there are two VPWS sub-types:

Large Burst Mode extends the maximum policer burst size from 4 MB to 256 MB. This capability applies to all policer types programmed through the policer infrastructure, including interface policers (dedicated and group) and QoS policy-map policers. When a configured burst size exceeds 4 MB, the hardware automatically enables large bucket resolution (BUCKET_LEVEL_RESOLUTION=1), which changes token granularity from 1 byte to 64 bytes.

This Cli command places the forwarding ASIC into a reduced clock-frequency ( low-power ) operating mode to allow energy savings in exchange of reduced throughput in supported platforms.

Currently, EOS supports only a global configurable EAPoL destination MAC address under mac security mode. This feature extends the support to allow EAPoL packets to the physical MAC address of the port which is also referred to as burned in address with the standard EtherType for ingress direction and a configurable destination MAC address for egress direction.

Media Access Control Security (MACsec) is an industry standard encryption mechanism that protects all traffic flowing on the Ethernet links. MACsec is based on IEEE 802.1X and IEEE 802.1AE standards. By default, if MACsec configuration is applied on the interface, then it encrypts and decrypts all the other protocols PDU and other data packets. This document talks about a feature which allows LLDP protocol packets to bypass encryption and decryption. Additionally, from release 4.26.0F, there is a way to allow LLDP packets to be sent/received from the port even when the port is not authorized i.e. even when MKA session is yet to become successful.

The MACsec scheduler compensation feature is used to automatically make adjustments to the packet size seen by the scheduler for MACsec encrypted traffic, based on MACsec configuration.

The maintenance mode feature allows network administrators to perform switch servicing with minimal traffic disruption. When an interface enters maintenance, the rate monitoring stage waits for traffic to drain below a configured threshold before transitioning the interface into maintenance. However, if traffic does not drain — for example, due to insufficient network redundancy or routing constraints — the interface may remain in the "Entering Maintenance" state indefinitely, potentially blocking scheduled maintenance operations.

Container-based deployments make creating cloud portable applications extremely easy. An application can be written on normal build infrastructure, that in turn can be run on a EOS switch or any Linux device that runs docker runtime engine. So the same applications that are run on a server for microservices can be run on a switch with Arista EOS. Since Arista extensible operating system is simply linux (AlmaLinux 9.7 at this time – 2026) we are able to integrate a container runtime engine into the operating system.

Media Access Control Security (MACsec) is an industry standard encryption mechanism to protect all traffic flowing on Ethernet links. MACsec is described in IEEE 802.1X and IEEE 802.1AE standards.

MetaWatch is an FPGA-based feature available for Arista 7130 Series platforms. It provides precise timestamping of packets, aggregation and deep buffering for Ethernet links. Timestamp information and other metadata such as device and port identifiers are appended to the end of the packet as a trailer.

Arista switches provide several mirroring features. Filtered mirroring to CPU adds a special destination to the mirroring features that allows the mirrored traffic to be sent to the switch supervisor. The traffic can then be monitored and analyzed locally without the need of a remote port analyzer. Use case of this feature is for debugging and troubleshooting purposes.

MPLS LFIB (Label Forwarding Information Base) counters provide per-label ingress packet and byte counters for MPLS routed packets. These counters enable operators to Monitor traffic volume per MPLS label for capacity planning and SLA verification, Troubleshoot MPLS forwarding issues by identifying labels with unexpected traffic patterns

MPLS-over-GRE encapsulation support in EOS 4.17.0 enables tunneling IPv4 packets over MPLS over GRE tunnels. This feature leverages next-hop group support in EOS. With this feature, IPv4 routes may be resolved via MPLS-over-GRE next-hop group to be able to push one MPLS label and then GRE encapsulate the resulting labelled IPv4 packet before sending out of the egress interface.

Generic UDP Encapsulation (GUE) is a general method for encapsulating packets of arbitrary IP protocols within a UDP tunnel. GUE provides an extensible header format with optional data. In this release, the ability to encapsulate MPLS over GUE packets of variant 1 header format has been added. This variant allows direct encapsulation in UDP without the GUE header. Both IPv4 and IPv6 MPLS-over-GUE tunnel destinations are supported. Additionally, IPv4 and IPv6 routes may be resolved via MPLS-over-GUE tunnels.

On Arista 7130 devices, the transmit and receive paths of front panel Ethernet interfaces are inherently independent. An interface can have a fully operational transmit path while the receive is down, yet the existing show interfaces output only displays a single combined link status. This can cause confusion when the interface state shows "down" even though the TX path is actively passing traffic.

Policy-based routing (PBR) is a feature that is applied on routable ports, to preferentially route packets. Forwarding is based on a policy that is enforced at the ingress of the applied interface and overrides normal routing decisions. In addition to matches on regular ACLs, PBR policy-maps can also include “raw match” statements that look like a single entry of an ACL as a convenience for users.

This article provides a general introduction to Precision Time Protocol (PTP) supported within EOS. PTP is aimed at distributing time with sub-microsecond accuracy. PTP support is based on the IEEE-1588 specification for version 2 of the protocol.

This feature is an extension of QoS Policy-Maps. It allows the user to configure QoS Policy-Map counters. If a class-map is configured for a policer action then the conformed and non-conformed packet and byte counters are displayed for that class-map. Otherwise the number of packets and bytes hitting the class-map are shown.

RADIUS over DTLS (Datagram Transport Layer Security) provides secure, encrypted communication between RADIUS clients and servers while maintaining the UDP transport characteristics of traditional RADIUS. This implementation follows RFC 7360 and enhances RADIUS security without requiring migration to TCP-based transports.

Routing control functions (RCF) is a language that can be used to express route filtering and attribute modification logic in a powerful and programmatic fashion. This document serves as a reference guide for: Routing protocol attributes , Operators for comparing and modifying attributes

Routing control functions (RCF) is a language that can be used to express route filtering and attribute modification logic in a powerful and programmatic fashion. This document serves as a reference guide for Bgp agent points of application:

Routing control functions (RCF) is a language that can be used to express route filtering and attribute modification logic in a powerful and programmatic fashion. This document serves as a reference guide for IpRib agent points of application Configuration of RCF

RSVP-TE, the Resource Reservation Protocol (RSVP) for Traffic Engineering (TE), is used to distribute MPLS labels for steering traffic and reserving bandwidth. The Label Edge Router (LER) feature implements the headend functionality, i.e., RSVP-TE tunnels can originate at an LER which can steer traffic into the tunnel.

RSVP-TE applies the Resource Reservation Protocol (RSVP) for Traffic Engineering (TE), i.e., to distribute MPLS labels for steering traffic and reserving bandwidth.

The send support-bundle feature adds a new CLI command which creates a ZIP file containing a useful set of logs and command outputs, and then writes it to either a local or remote destination specified by a CLI URL. When sending to a remote destination, the ZIP file will be created and streamed to the destination on-the-fly, saving local disk space.

The statuses of the transceiver low-speed pins are not easily readable. This feature provides a way to expose these statuses through a CLI command.

"Micro segment" (SRv6 uSID or uSID for short)  is an extension of SRv6 architecture, specifically designed to represent SRv6 SIDs in an extremely compact way. It addresses the overhead of using full 128-bit IPv6 SIDs for routing. Instead of using a 128-bit address for single SID, multiple uSIDs are packed into a single 128-bit address. Each 128-bit address comprises a block value representing the domain followed by multiple uSIDs, each of the same bit length. If there are bits left they are filled with trailing zeros. This allows for a complete SRv6 path to be represented by a 128-bit IPv6 address. Like a regular SID, each uSID is associated with a specific behavior on the SRv6 capable node. SRv6 uN refers to the End behavior with uSIDs.

In EVPN deployments, MAC address reachability is ascertained using both (i) MAC only routes, and (ii) MAC-IP routes. If all EVPN peers in the network are guaranteed to advertise a MAC-only route for MACs, then it is redundant to compute MAC reachability based on MAC-IP routes for the same MAC. With higher scale of the number of IPs mapped to the same MAC address, BGP best path work experiences a higher load.