7.2.3-r2 release documentation by Chr1st0ph3rTurn3r · Pull Request #1131 · 128technology/docs

Chr1st0ph3rTurn3r · 2026-09-01T15:05:55Z

Currently only beta release documentation for swift.

MichaelBaj · 2026-09-01T18:10:34Z

+
+### New Features
+
+- **I95-62790 ML-DSA for SVR Certificates:** ML-DSA has been added as a new algorithm option to the existing customer-facing certificate lifecycle. ML-DSA support applies exclusively to SVR peering certificates managed by the customer through the REST API. For more information, see [ML-DSA](sec_enhanced_key_mgmt.md#ml-dsa).


remove "customer-facing" (not sure why that was added).

MichaelBaj · 2026-09-01T18:14:14Z

+------
+- **I95-63985 VRRP Non-revertive Active/Active Recovery:** Added support for VRRP to automatically revert from an active/active state back to active/standby when the underlying Layer 2 connectivity is restored, without requiring manual intervention such as priority changes or interface flaps.
+------
+- **I95-63281 Configurable serial console baud rate:** Added the ability to configure the serial baud rate to either 9600, 38400 or 115200 (default). This can be done from the command line `config authority router <router> node <node> serial-console-baud-rate`, or the web interface at `Router -> Node -> Serial Console Baud Rate` using the dropdown.


Is this restricted to a specific set of platforms or all platforms? Either way, it should be called out.

MichaelBaj · 2026-09-01T18:29:14Z

+
+### Resolved Issues
+
+- **I95-62536 ESKM Peer Path Teardown on Certificate Validation Failure:** Resolved an issue where an ESKM router continued to accept traffic from a peer even when peer paths back to it were down, or when certificate validation was set to `fail-hard` mode. Stale peer metadata keys are now removed upon validation failure or certificate expiration to terminate invalid traffic.


I find the wording a bit confusing. Recommended alternative:

ESKM Peer Path Teardown on Certificate Validation Failure:** Resolved an issue where an ESKM router continued to accept traffic from a peer even its peer path is down, or when certificate validation was set to fail-hard mode.

MichaelBaj · 2026-09-01T19:20:29Z

+
+#### Prerequisites
+
+In order to configure an ML-DSA certificate on a router, you must first enable post-quantum cryptography on each peer. After modifying this setting, the 128T service must be restarted for the change to take effect. Once the service has been restarted, you will be able to provision ML-DSA certificates.


What happens if you don't do this? What is the purpose of this configuration setting? Why isn't the certificate sufficient?

If you don't do this, when you try to provision ML-DSA certificates, validation will fail and they will be rejected.

The reason for this configuration setting is FIPS-related. Since like 10 years ago, our C++ apps run with openssl set to FIPS-enabled, even if the system is not in FIPS mode at the OS level. As I understand it, this was in place as a guardrail. The openssl fips provider we use does not support ML-DSA, so in order to use ML-DSA certificates, we have to disable that guardrail.

It was decided that it would be undesirable to universally remove the guardrail for all systems, even if they aren't using PQC, so this configuration setting disables it only for customers that are actually using ML-DSA. (Also worth noting that if the OS is in FIPS mode, that takes precedence over this config setting, so it does not break FIPS compliance for customers who actually need it)

plessard128 · 2026-09-22T14:40:56Z

+
+##### Ingest the Certificate
+
+When the signed certificate is returned, instruct the SSR to ingest the certificate. The certificate must be associated with the name used in the two earlier API calls. Create the following json file:


This makes a reference to When the signed certificate is returned and two earlier API calls, which I think comes from the procedure to ingest client certificates, but there is nothing returning a signed certificate or earlier API calls for the workflow to ingest a trusted CA certificate. You just take the CA's certificate and you ingest it.

plessard128 · 2026-09-22T14:41:44Z

+```
+POST /api/v1/router/{router_name}/node/{node_name}/trusted-ca-certificate
+{
+    "name": "my_peering_cert",


The examples here all name the certificate my_peering_cert, which might be a bit confusing since this is supposed to be a CA cert, not a peering cert. Maybe my_ca_cert?

… for waypoints and static route state.

MichaelBaj · 2026-09-23T19:52:29Z

+- **I95-63281 Configurable serial console baud rate:** Added the ability to configure the serial baud rate on the SSR devices to either 9600, 38400, or 115200 (default). This can be done from the command line `config authority router <router> node <node> serial-console-baud-rate`, or the web interface at `Router -> Node -> Serial Console Baud Rate` using the dropdown.

+  :::note
+  Since the baud rate change happens at the kernel level, output such as bios or grub remains at 115200bps. If the serial console client is set to a value other than 115200, the output will be displayed as garbage. If one of those garbage characters happens to be `xon`, the client will stop the display. To prevent the display issue, it is recommended to turn off software flow control (`xon/xoff`).


replace "garbage" with "garbled text"

MichaelBaj · 2026-09-23T19:54:31Z

 - **I95-64184 Static Route State Tracking:** Added the monitoring of service path reachability state to prevent traffic from being forwarded to an unreachable destination if an intermediate network fails even when the next hop or destination remains operational. ICMP probes monitor network connectivity; when a failure is detected and exceeds the configured threshold, the system now automatically removes the kernel route from the RIB. When the ICMP probes recover and the destination is reachable again, the kernel routes are automatically added back to the RIB. For more information about reachability profiles, see [Configuring a Reachability Detection Profile](config_service_health.md#creating-a-reachability-detection-profile).  
 ------
- **I95-63985 VRRP Non-revertive Active/Active Recovery:** Added support for VRRP to automatically revert from an active/active state back to active/standby when the underlying Layer 2 connectivity is restored, without requiring manual intervention such as priority changes or interface flaps.
+- **I95-64692 Improved L7-Security Packet Interface:** The internal packet interface used for L7-Security function chaining, such as IDP, has moved from the deprecated KNI (Kernel NIC Interface) technology to virtio-user. This improves throughput headroom for IDP-enabled deployments and removes a dependency that upstream DPDK is phasing out.


Great explanation, just not one that I would frame for customers in this way.

I95-64692 Improved L7-Security Packet Performance: The internal packet interface used for L7-Security function chaining, such as IDP, has changed affording more throughput headroom for IDP-enabled deployments.

MichaelBaj · 2026-09-23T19:57:36Z

+------
+- **The following issues have been addressed and delivered to increase the overall security posture of the SSR:** I95-62091, I95-65017, I95-65018, I95-65021, I95-65025, I95-65026, I95-65027, I95-65028, I95-65030, I95-65033, I95-65034, I95-65038, I95-65039, I95-65044, I95-65054, I95-65055, I95-65205, I95-65206, I95-65208, I95-65210, I95-65211, I95-65217, I95-65219, I95-65221, I95-65224, I95-65226, I95-65228, I95-65235, I95-65238, I95-65239, I95-65247, I95-65249, I95-65250, I95-65252, I95-65254, I95-65297.
+------
+- **I95-58472 SSR4x0 Platform Provisioning Reboot Loop:** Resolved an issue where CN102 SSR4x0 platforms could enter an infinite reboot loop during initial provisioning.


I95-58472 SSR4x0 Platform Provisioning Reboot Loop: Resolved an issue where SSR4x0 platforms could enter an infinite reboot loop during initial provisioning.

MichaelBaj · 2026-09-23T20:02:03Z

+------
+- **I95-63811 IPv6 Service with ICMP Transport Not Routed:** Resolved an issue where PINGv6 sessions were not routed when an IPv6 service was configured with ICMP as the transport protocol. The system now correctly remaps ICMP to ICMPv6 for IPv6 service prefixes.
+------
+- **I95-63876 Route Flapping and Inaccessibility:** Resolved an issue where routes would flap or become inaccessible in hub-and-spoke topologies with inter-hub steering preferences configured, causing intermittent connectivity failures.


I95-63876 BGP Route Flapping and Inaccessibility: Resolved an issue where BGP routes would flap or become inaccessible in hub-and-spoke topologies with inter-hub steering preferences configured, causing intermittent connectivity failures.

MichaelBaj · 2026-09-23T20:09:25Z

+------
+- **I95-63913 Session-source incorrect in BFD pinhole:** Resolved an issue where session-source was incorrectly set to public when a BFD pinhole also happened to be a flow-move scenario.
+------
+- **I95-64054 Highway Crash with ESKM Jumbo Packets:** Resolved an issue where the highway process could crash with a null pointer dereference when processing jumbo packets with ESKM due to an uninitialized encryption context.


Please do not offer details into why the system would crash. This offers a bad actor a window into exploiting the product if they know a customer is running a prior version.

I95-64054 Highway Crash with ESKM Jumbo Packets: Resolved an issue where the highway process could crash when processing jumbo packets with ESKM due to an uninitialized encryption context.

MichaelBaj · 2026-09-23T20:57:58Z

+------
+- **I95-65488 Improved Logging for File-Based Trusted CA Certificates:** Added logging to the configuration director to make it easier to determine when a file-pointer-based trusted CA certificate is referenced in configuration but the file is not yet present on disk.
+------
+- **I95-65512 Web Server and Nginx Crash Looping:** Resolved an issue where the web server and nginx processes entered a crash loop, preventing access to the SSR Web UI.


Please work with the developer to better understand the condition triggering this crash loop.

MichaelBaj · 2026-09-23T21:00:28Z

+------
+- **I95-65548 DSCP steering support with deferred classification in hierarchical services:** Added support for DSCP steering services when classification is deferred in hierarchical service configurations, enabling correct traffic handling in Mist-managed deployments.
+------
+- **I95-65557 Highway Crash During Show Commands on HA Router:** Resolved an issue where issuing show commands on an HA router could cause a highway crash on both nodes due to FIB table contention. FIB table operations are now batched to prevent mutex lock errors.


arguably this should only be show fib commands, not all commands.

MichaelBaj · 2026-09-23T21:37:31Z

 ------
+- **I95-65617 Loss of syslog forwarding over TLS after upgrade:** Resolved an issue where syslog forwarding over TLS stopped working after upgrading, preventing log delivery to remote collectors.
+------
+- **I95-65635 Source NAT Port Exhaustion on Loopback Interface:** Resolved an issue where a large number of `SourceNatPortException` errors for the local KNI interface caused SSH connection failures to the SSR loopback IP. Host-type service routes no longer use the KNI IPv6 control interface for source NAT.


A customer won't understand how this relates to them. The loopback interface on the product is an internal detail. This needs to be translated to customer experience.

MichaelBaj · 2026-09-23T21:49:46Z

- **I95-65855 IPv6 Link-Local Resolver Nginx Failures:** Resolved an issue where Nginx failed to start or entered a crash loop when no external DNS was configured because IPv6 link-local addresses were selected as resolvers. The resolver logic now filters link-local addresses, properly formats IPv6 addresses, and prioritizes `/etc/hosts` and `dnsmasq` overrides.
+- **I95-65680 RoutingManager Not Running on HA Headend Router:** Resolved an issue where the routingManager could remain in STANDBY after a session interruption, leaving the router without an active routing process (loss of BGP/routing connectivity) until restarted.
+------
+- **I95-65691 Node disconnected after headend partial rollback:** Resolved an issue where a node could remain disconnected from the conductor after a partial rollback scenario on a headend router.


This would benefit from a better explanation for a "partial rollback"

MichaelBaj · 2026-09-23T21:54:47Z

+------
+- **I95-66071 Resolved a Highway Crash During GRE Tunnel Configuration Updates:** Resolved an issue where a failed lookup during a GRE tunnel interface modification could leave stale internal state, causing the highway process to crash on a subsequent configuration change to the same tunnel. GRE tunnel state is now cleaned up correctly when a lookup fails.
+------
+- **I95-66077 BGP Peers Down After Enabling a Second Internet Provider:** Resolved a double-free defect in BGP conditional advertisement processing that could cause all BGP peers to go down when a second BGP-connected internet provider was enabled.


I95-66077 BGP Peers Down After Enabling a Second Internet Provider: Resolved a defect in BGP conditional advertisement processing that could cause all BGP peers to go down when a second BGP-connected internet provider was enabled.

…technology/docs into 7.2.3-r2-release-documentation

Chr1st0ph3rTurn3r added 4 commits August 26, 2026 16:53

roughing out the new features for Beta.

8239430

draft version of the beta docs.

699d157

tet change

b89c699

Beta release notes for Swift

4b6742c

Chr1st0ph3rTurn3r requested a review from agrawalkaushik September 1, 2026 15:05

Chr1st0ph3rTurn3r requested a review from MichaelBaj as a code owner September 1, 2026 15:05

Chr1st0ph3rTurn3r and others added 3 commits September 1, 2026 11:24

fix typo

cf7eb6d

reorder list

3e0f531

Merge branch 'master' into 7.2.3-r2-release-documentation

eeeb62f

MichaelBaj requested changes Sep 1, 2026

View reviewed changes

Chr1st0ph3rTurn3r and others added 2 commits September 2, 2026 13:43

review comments

f251d22

Merge branch 'master' into 7.2.3-r2-release-documentation

21adf5a

plessard128 reviewed Sep 22, 2026

View reviewed changes

madamsJuniper self-requested a review September 22, 2026 14:44

Chr1st0ph3rTurn3r added 4 commits September 22, 2026 15:28

date and build. More stuff coming.

c5afb60

first draft of generated release notes - still need cleanup.

59a0d26

interim commit

8a91236

release notes generated. Full feature documentation still in progress…

9469bd5

… for waypoints and static route state.

Chr1st0ph3rTurn3r requested a review from MichaelBaj September 23, 2026 18:35

Merge branch 'master' into 7.2.3-r2-release-documentation

2afa48f

MichaelBaj requested changes Sep 23, 2026

View reviewed changes

Chr1st0ph3rTurn3r and others added 7 commits September 24, 2026 13:04

Merge branch 'master' into 7.2.3-r2-release-documentation

9cc17ad

partial commit for offline build

c3caa2e

text edit

b260c28

Merge branch 'master' into 7.2.3-r2-release-documentation

240dcb7

mergeMerge branch '7.2.3-r2-release-documentation' of github.com:128…

13a3543

…technology/docs into 7.2.3-r2-release-documentation

update show waypoints info

486e308

fixing broken link

d59b678


		### New Features

		- I95-62790 ML-DSA for SVR Certificates: ML-DSA has been added as a new algorithm option to the existing customer-facing certificate lifecycle. ML-DSA support applies exclusively to SVR peering certificates managed by the customer through the REST API. For more information, see [ML-DSA](sec_enhanced_key_mgmt.md#ml-dsa).


		### Resolved Issues

		- I95-62536 ESKM Peer Path Teardown on Certificate Validation Failure: Resolved an issue where an ESKM router continued to accept traffic from a peer even when peer paths back to it were down, or when certificate validation was set to `fail-hard` mode. Stale peer metadata keys are now removed upon validation failure or certificate expiration to terminate invalid traffic.


		#### Prerequisites

		In order to configure an ML-DSA certificate on a router, you must first enable post-quantum cryptography on each peer. After modifying this setting, the 128T service must be restarted for the change to take effect. Once the service has been restarted, you will be able to provision ML-DSA certificates.


		##### Ingest the Certificate

		When the signed certificate is returned, instruct the SSR to ingest the certificate. The certificate must be associated with the name used in the two earlier API calls. Create the following json file:

Conversation

Chr1st0ph3rTurn3r commented Sep 1, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants