Changelog

1.0.0 July 11, 2026

Tested versions: link

New Features

BREAKING CHANGE: Restructure interface schema by replacing flat per-interface keys with nested interface_ipv4, interface_ipv6, and interface_bfd includes; convert helper_addresses to a list-typed include; rename templates.template_name to templates.name and ethernets.nac to ethernets.network_access_control
BREAKING CHANGE: Rename ethernet interface key name to id and replace ethernets.channel_group_number/channel_group_mode with port_channel_id/port_channel_mode
BREAKING CHANGE: Tighten prefix_lists.name validation to regex('^[^\s]*$') (no whitespace allowed)
BREAKING CHANGE: Tighten route_maps.name validation to regex('^[^\s]*$') and pluralize route-map set attributes (ip_next_hop_addresses, ip_global_next_hop_addresses, ip_default_next_hop_addresses, ipv6_addresses, ipv6_next_hop_addresses)
BREAKING CHANGE: Rename route-map match/set keys from ip_* to ipv4_* (e.g., route_maps_entries_match.ip_address_prefix_lists → ipv4_address_prefix_lists)
BREAKING CHANGE: Tighten whitespace validation on system.hostname, system.ip_domain_name, multicast_routing_vrfs.vrf, and several system_http fields (active_session_modules, secure_active_session_modules, secure_trustpoint) from str() to regex('^[^\s]*$')
BREAKING CHANGE: Rename system_http.authentication_aaa_command_authorization to authentication_aaa_command_authorizations (now plural)
BREAKING CHANGE: Replace templates_switchport.mode_trunk/mode_access with mode, and tighten validation for templates.dot1x_pae, access_session_port_control, access_session_host_mode
BREAKING CHANGE: Replace switchport.trunk_allowed_vlans with trunk_allowed_vlans_v2 (options all, none, vlans, except, remove); legacy form remains as trunk_allowed_vlans_legacy
BREAKING CHANGE: Change line_vtys.escape_character and line_vtys_access_classes.access_list to accept integer values
BREAKING CHANGE: Restrict line_vtys.transport_input to ssh or telnet
BREAKING CHANGE: Rename prefix_lists_seqs.ip to prefix_lists_seqs.prefix
BREAKING CHANGE: Rename VTY range keys line_vtys.first/last to number_from/number_to and remove line_consoles.first
BREAKING CHANGE: Rename snmp_server.packetsize to packet_size
BREAKING CHANGE: Rename snmp_server.ipmulticast to ip_multicast
BREAKING CHANGE: Replace snmp_server_views.include/exclude flags with scope enum (included or excluded)
BREAKING CHANGE: Rename SNMP trap attribute lsa_enable to ospf_lsa_enable in snmp_server_traps
BREAKING CHANGE: Rename snmp_server.trap_source_hundred_gig_e to trap_source_hundred_gig_ethernet
BREAKING CHANGE: Rename snmp_server_groups.v3_security to v3_securities (and underlying snmp_server_group_v3_security schema to snmp_server_group_v3_securities)
BREAKING CHANGE: Split snmp_server_hosts.community_or_user into separate community and user fields
BREAKING CHANGE: Rename snmp_server_users.username to name
BREAKING CHANGE: Replace flat snmp_server_users.v3_auth_* fields with nested v3_authentication block (algorithm, password, access, privacy)
BREAKING CHANGE: Add nested snmp_server_users_privacy_aes, _des, and _des3 privacy schemas under v3_authentication.privacy
BREAKING CHANGE: Replace vtp mode booleans (e.g., mode_client_vlan, mode_server_mst, mode_transparent_unknown) with mode and mode_instance enum attributes
BREAKING CHANGE: Replace vtp.interface with interface_type and interface_id
BREAKING CHANGE: Rename static route next-hop key next_hop to ip under routing_static_routes_next_hops
BREAKING CHANGE: Rename static-route next-hop metric to distance and add track_id
BREAKING CHANGE: Add routing.static_routes.next_hops.interface_type and interface_id to support an interface as the next hop
BREAKING CHANGE: Rename DHCP snooping_enabled to snooping and remove snooping_vlans (re-added later as a feature)
BREAKING CHANGE: Restructure crypto schema by replacing top-level ikev2_profiles/ikev2_keyrings/ikev2_policies/ikev2_proposals with a nested ikev2 block (including nat_keepalive, dpd_interval, dpd_query) and add ipsec_transform_sets
BREAKING CHANGE: Change crypto.ikev2.policies.proposals from a list of objects to list(str())
BREAKING CHANGE: Replace vni_range with vni_from and vni_to in nves_vni_vrfs and nves_vnis
BREAKING CHANGE: Change class_maps.match_dscp from int() to list(int())
BREAKING CHANGE: Refactor class_maps matching into a nested match object (e.g., match_dscp → match.dscp)
BREAKING CHANGE: Convert class_maps_match criteria to lists: authorizing_method_priority_greater_than becomes list(int), access_group becomes access_groups, and dscp/ip_dscp/ip_precedence become lists (with dscp accepting names like ef/cs5 or integers)
BREAKING CHANGE: Rename BGP IPv6 unicast network key prefix to network in bgp_address_family_ipv6_unicast_networks and bgp_address_family_ipv6_unicast_vrfs_networks
BREAKING CHANGE: Rename routing_bgp.address_families to address_family (now singular)
BREAKING CHANGE: Replace BGP neighbor update_source_loopback with update_source_interface_type and update_source_interface_id
BREAKING CHANGE: Replace pim.bsr_candidate_loopback with bsr_candidate_interface_type and bsr_candidate_interface_id (same change under pim_vrfs)
BREAKING CHANGE: Remove aaa_radius_attributes.access_request_include — RADIUS attribute configuration is now standardized on send_attributes (e.g., include-in-access-req)
BREAKING CHANGE: Replace aaa.tacacs_servers with aaa.tacacs.servers (TACACS server entries now nested under aaa.tacacs)
BREAKING CHANGE: Rename aaa.local_auth_max_fail_attempts to local_authentication_max_fail_attempts, remove aaa.vrf, and add aaa_tacacs_groups.vrf
BREAKING CHANGE: Remove the default attribute from aaa_accounting_connections — use name: "default" instead
BREAKING CHANGE: Rename aaa.accounting.*.start_stop_group* keys to start_stop_groups (now plural list)
BREAKING CHANGE: Add device-level managed attribute (default defaults.iosxe.devices.managed: true) to control whether NaC manages a given device
BREAKING CHANGE: Rename bfd.maps to bfd.ipv4_maps and bfd.ipv6_maps
BREAKING CHANGE: Rename BFD template attributes dampening_half_life to dampening_half_time, dampening_max_suppress_time to dampening_max_suppressing_time, and authentication_meticulous_sha_1_keychain to authentication_meticulous_sha1_keychain
BREAKING CHANGE: Add devices.host and make devices.url optional — session creation now uses https:// + device.host (falling back to device.url)
BREAKING CHANGE: Replace devices.cli with structured devices.cli_templates objects (name, content)
BREAKING CHANGE: Move configuration_templates to file-based references via global.configuration_templates and devices.configuration_templates (now list(str()))
BREAKING CHANGE: Change port_security_aging_type from boolean to enum('absolute','inactivity') and remove port_security_aging_type_inactivity
BREAKING CHANGE: Remove ntp.delete_mode
BREAKING CHANGE: Replace ntp.trap_source with trap_source_interface_type and trap_source_interface_id
BREAKING CHANGE: Refactor ntp_authentication_keys to use mode and key fields
BREAKING CHANGE: Replace ntp_servers.source with source_interface_type and source_interface_id
BREAKING CHANGE: Remove interface_auto_qos.voip — use voip_cisco_phone, voip_cisco_softphone, or voip_trust instead
BREAKING CHANGE: Refactor flow_records by replacing flat match_*/collect_* booleans with nested flow_records.match and flow_records.collect objects (e.g., match_ipv4_source_address → match.ipv4_source_address)
BREAKING CHANGE: Update MSDP modeling — rename msdp_passwords.addr/msdp_peers.addr to host, replace connect_source_loopback with connect_source_interface_type/connect_source_interface_id, and add msdp.vrfs
BREAKING CHANGE: Replace interface_ipv4.dhcp_relay_source_interface with dhcp_relay_source_interface_type and dhcp_relay_source_interface_id
BREAKING CHANGE: Replace logging.source_interface with source_interface_type and source_interface_id, and rename logging_source_interfaces_vrf.interface_name to interface_type
BREAKING CHANGE: Replace system_http.client_source_interface with client_source_interface_type and client_source_interface_id
BREAKING CHANGE: Replace as_path_access_list.name with as_path_access_list.number
BREAKING CHANGE: Replace community_lists_standard.deny_entries/permit_entries with a single entries list using action and communities
BREAKING CHANGE: Rename recovery_cause to errdisable_recovery_cause
BREAKING CHANGE: Replace EVPN replication booleans (replication_type_ingress, _static, _p2mp, _mp2mp) with a single replication_type enum under both evpn and evpn_instance_vlan_based
BREAKING CHANGE: Replace evpn_instance_vlan_based.route_target_* strings with route_target_imports and route_target_exports list-typed fields
BREAKING CHANGE: Restructure service timestamps — replace flat service.timestamps_* keys with a nested service.timestamps.* object (e.g., timestamps.enabled, timestamps.debug_datetime_msec)
BREAKING CHANGE: Rename port-channel logging_event_link_status_enable to logging_event_link_status, and expand interface_group_configuration with media_type, bandwidth, and mtu
BREAKING CHANGE: Rename MDT subscription fields — mdt_subscriptions.source_address → source_ip, mdt_subscriptions_receivers.address → ip
BREAKING CHANGE: Rename lines object paths to line
BREAKING CHANGE: Rename VLAN access-map match key match_ip_addresses to match_ipv4_addresses
BREAKING CHANGE: Set minimum supported Python version to >= 3.10
BREAKING CHANGE: Consolidate license.accept_agreement, license.accept_end, and license.accept_user into a single license.accept_eula attribute
BREAKING CHANGE: Remove unsupported license.feature_name, license.feature_port_bulk, license.feature_port_onegig, license.feature_port_b_6xonegig, and license.feature_port_tengig attributes (no backing CLI on any supported platform)
BREAKING CHANGE: Rename AAA policy-map event actions authenticate_using_aaa_authc_list/authenticate_using_aaa_authz_list to ..._legacy, and add authenticate_using_authc_list, authenticate_using_authz_list, and authenticate_using_aaa_config
Add schema support for interface_group_configuration, port_channel_subinterfaces, and tunnels (including ikev2_profiles and ipsec_profiles) plus new interface fields interface_groups and encapsulation_dot1q_vlan_id
Add VRF route-target list attributes ipv4_route_target_imports, ipv4_route_target_exports, ipv6_route_target_imports, ipv6_route_target_exports, and add tunnel interface OSPF blocks ospf and ospfv3
Add system_http attributes active_session_modules, secure_active_session_modules, and max_connections
Update device_configuration.prefix_lists to list(include('prefix_lists')) so multiple prefix lists can be defined
Add loopback-specific schema models loopback_interface_ipv4 and loopback_interface_ipv6 with address, address_mask, proxy_arp, access_group_in, access_group_out, redirects, unreachables, enable, addresses, link_local_addresses, and mtu
Add vlan_interface_ipv4 schema for VLAN SVI IPv4 settings, including proxy_arp, arp_inspection_trust, and dhcp_relay_source_interface
Add NTP schema support for delete_mode and authentication_keys.trusted with documented examples for authenticate, logging, and access_group_*_acl
Add AAA schema support for aaa_tacacs_servers.encryption and tighten typing for aaa_radius_groups.source_interface_id, aaa_radius_attributes.number, and aaa_radius_servers.pac_key_encryption
Add dot1x example covering auth_fail_eapol, critical_eapol_config_block, critical_recovery_delay, test_timeout, logging_verbose, supplicant_controlled_transient, supplicant_force_multicast, system_auth_control, plus credentials fields (profile_name, password_type, pki_trustpoint)
Add documentation examples for msdp and evpn configuration including originator_id, passwords, peers, replication_type_static, logging_peer_state, and instances
Allow access_lists_extended_entries_source.port and access_lists_extended_entries_destination.port to accept str() in addition to int()
Add device_sensor configuration model with filter_lists_dhcp, filter_lists_lldp, and notify_all_changes
Add device_sensor.cdp_filter_lists for CDP TLV filter-list modeling
Add device_sensor_lldp_filter_lists.tlv_name_system_capabilities
Add Flow exporter attributes export_protocol, option_application_attributes_timeout, option_application_table_timeout, option_interface_table_timeout, option_sampler_table, and option_vrf_table_timeout
Add flow attributes source_gigabit_ethernet, source_ten_gigabit_ethernet, source_vlan, datalink_mac_source_address_input, datalink_vlan, and ipv4_ttl
Add routing_vrf_input, vxlan_vnid, vxlan_vtep_input, and vxlan_vtep_output to flow_records_match for VXLAN-aware NetFlow record matching
Add flow_exporters.ttl with int(min=0, max=255) validation
Extend clock_recurring.start_week/end_week to accept enum('first','last') in addition to int(min=1, max=4) for recurring summer-time configuration
Add clock timezone configuration via clock.timezone, timezone_offset_hours, and timezone_offset_minutes
Add vlans.mac_address to the VLAN SVI schema with dotted-notation validation
Add BGP direct IP router-ID support via router_id in routing_bgp and bgp_address_family_ipv4_unicast_vrfs
Add BGP peer-session template support via routing_bgp.peer_session_templates with template_name, remote_as, and inherit_peer_session
Add BGP peer-policy template support via routing_bgp.template_peer_policies with name, send_community, route_reflector_client, allowas_in_as_number, as_override_split_horizon, and route_maps (using direction/route_map_name)
Add BGP process attributes graceful_restart and update_delay to routing_bgp
Add maximum_paths_ebgp and maximum_paths_ibgp to bgp_address_family_ipv4_unicast and bgp_address_family_ipv4_unicast_vrfs
Add BGP vpnv4_unicast and vpnv6_unicast address-family support via bgp_address_family_vpnv4_unicast.enable and bgp_address_family_vpnv6_unicast.enable
Add BGP IPv4 MVPN address-family via bgp_address_family.ipv4_mvpn, bgp_address_family_ipv4_mvpn.neighbors, and neighbor activate/send_community
Add BGP L2VPN EVPN advanced attributes rewrite_evpn_rt_asn and bgp_nexthop_trigger_delay to bgp_address_family_l2vpn_evpn
Add BGP L2VPN EVPN neighbor attributes import_path_selection_all, summary_only, and route_maps (with in_out and name)
Add BGP IPv4 unicast admin-distance knobs admin_distances, distance_bgp_external, distance_bgp_internal, and distance_bgp_local (including VRF variants)
Add bgp_address_family_ipv4_unicast_vrfs_neighbors_route_maps schema with direction and name
Add bgp_neighbors.fall_over_bfd
Add advanced OSPF schema attributes log_adjacency_changes, nsf_cisco, max_metric_router_lsa, fast_reroute_per_prefix_enable_prefix_priority, redistribute (with connected/static), and interface multi_area_ids
Add OSPF passive-interface entries model routing_ospf_passive_interfaces with interface_type and interface_id
Add register_source_interface_type and register_source_interface_id to pim and pim_vrfs for PIM register-source interfaces
Add pim_vrfs.cache_rpf_oif
Add VRF-aware IPv6 PIM via ipv6_pim/ipv6_pim_vrfs (with rp_address, rp_address_access_list, rp_address_bidir) and per-interface IPv6 PIM via interface_ipv6_pim (with pim, bfd, bsr_border, dr_priority)
Add multicast configuration with multipath, multipath_s_g_hash, and VRF list vrfs
Add system.ipv6_multicast_routing
Add EVPN multicast_advertise support via evpn.multicast_advertise and evpn_instance_vlan_based.multicast_advertise
Add evpn.flooding_suppression_address_resolution_disable for flooding-suppression address-resolution disable
Add evpn.anycast_gateway_mac_auto
Add VLAN EVPN attributes evpn_instance_protected, evpn_instance_profile, and evpn_instance_profile_protected
Add evpn_profile.profiles with name, evi_base, and l2vni_base for L2VPN EVPN profile configuration
Add l2_vfi configuration with name, mode, vpn_id, and neighbors (with ip_address, encapsulation)
Add VRF VNID/EVPN configuration to vrfs via vnid, vnid_value, evpn_instance_vni, vni_num, and optional core_vlan
Add nves_vnis.local_routing
Add import_map and export_map to vrfs_address_family_ipv4 and vrfs_address_family_ipv6 for route-map import/export filtering
Add mdt block to vrfs_address_family_ipv4 with new MDT schema models (default_address, auto_discovery_vxlan, overlay_use_bgp, data_multicast, data_threshold)
Add route_replicate to vrfs_address_family_ipv4 with name and optional route_map
Add vrfs.rd_auto for automatic route-distinguisher assignment
Add mpls device configuration with label_protocol, label_mode_all_vrfs_all_afs_per_vrf, label_mode_all_vrfs_all_afs_per_prefix, label_mode_all_vrfs_bgp_vpnv4_per_vrf, and label_mode_all_vrfs_bgp_vpnv6_per_prefix
Add CTS role_based_enforcement and SXP attributes sxp, sxp_connection_peers_ipv4, sxp_default_password, sxp_listener_hold_max_time, and role_based_enforcement_vlans
Add crypto.engine.compliance_shield_disable
Add crypto.pki with crypto_pki.trustpoints and attributes enrollment_pkcs12, revocation_check, and hash (e.g., sha256, sha512)
Add crypto_ikev2.http_url_certificate_lookup
Add route-map set-action support for ipv4_next_hop_unchanged and communities
Add interface_spanning_tree.portfast, portfast_disable, portfast_edge, bpduguard, and bpduguard_disable for per-interface portfast and BPDU-guard
Add spanning_tree.logging and per-VLAN STP via spanning_tree.vlans.id/priority
Add spanning_tree.disabled.vlans (with ids/ranges) to render no spanning-tree vlan X
Add DHCP snooping information option attributes snooping_information_option, snooping_information_option_allow_untrusted, and snooping_information_option_format_remote_id_string
Re-add DHCP snooping VLAN selection via dhcp.snooping_vlans
Add dhcp_relay_information_option_vpn_id to interface_ipv4 and vlan_interface_ipv4 for ip dhcp relay information option vpn-id
Add system_ssh.bulk_mode and bulk_mode_window_size for ip ssh bulk-mode and ip ssh bulk-mode window-size
Add system.ip_default_gateway, device_classifier, and table_maps (with system_table_maps.default and system_table_maps_mappings.from/to)
Add system.ip_sla with system_ip_sla_entries and system_ip_sla_schedules (icmp_echo_destination, icmp_echo_source_ip, life, start_time_now)
Add system.ip_hosts and additional system knobs subscriber_templating, call_home_contact_email, call_home_cisco_tac_1_profile_active, call_home_cisco_tac_1_destination_transport_method, ip_ftp_passive, tftp_source_interface_type, tftp_source_interface_id, multilink_ppp_bundle_name
Add system attributes archive, boot_system_bootfiles, enable_secret, and ip_domain_lookup_source_interface_type/ip_domain_lookup_source_interface_id
Add system.track_objects and knobs ip_nbar_classification_dns_classify_by_domain, ip_multicast_route_limit, ip_domain_list_names, ethernet_cfm_alarm_config_delay, ethernet_cfm_alarm_config_reset, standby_redirects, security_passwords_min_length
Add system.ip_domain_lookup_nsap, ip_domain_lookup_recursive, and ip_domain_lookup_vrfs (with vrf, source_interface_type, source_interface_id)
Document logging attributes count, persistent_url, persistent_size, persistent_filesize, rate_limit_all, buffered_size_legacy, buffered_severity_legacy
Add logging.console
Extend snmp_server_traps with bgp, cbgp2, aaa_server, adslline, dlsw, ether_oam; add snmp_server_hosts.vrf and snmp_server_hosts.security_level
Extend aaa_authorization with commands, config_commands, config_lists, and allow aaa_authorization_execs.methods to include none
Add aaa_authentication.enable_defaults for AAA enable default authentication
Add AAA attributes vrf, local_authentication_type, local_authorization, local_auth_max_fail_attempts
Add aaa_accounting.dot1x, aaa_radius_servers.automate_tester_idle_time, and aaa_tacacs_servers.port
Add aaa_accounting.commands and aaa_accounting.connections
Add templates_network_access_control attributes dot1x_timeout_quiet_period, supp_timeout, ratelimit_period, server_timeout
Add dot1x attributes critical_eapol, critical_eapol_block, guest_vlan_supplicant
Add templates_switchport.enable and interface_switchport.enable
Add nat_inside/nat_outside to loopback_interface_ipv4, vlan_interface_ipv4, and interface_ipv4
Add vlan_interface_ipv4.local_proxy_arp
Add per-interface IGMP via interface_igmp with version (1-3) on ethernets, loopbacks, vlans, port_channels, port_channel_subinterfaces, and tunnels
Add eem to device_configuration with environment_variables, session_cli_username, session_cli_username_privilege, history_size_events, history_size_traps, directory_user_policy, detector_routing_bootup_delay
Add lldp configuration with run, holdtime, and timer
Add license configuration with boot_level
Add license attributes accept_agreement, accept_end, accept_user, udi_pid, udi_sn, feature_name, feature_port_bulk, feature_port_onegig, feature_port_b_6xonegig, feature_port_tengig
Add service.dhcp_config
Add iosxe.configuration_templates with name and configuration
Add extensions.cli_snippets and include extensions under device_configuration
Introduce CLI template ordering via iosxe.templates.order and per-template order, expanding the allowed range from 0–4 to 0–9
Add iosxe.devices.protocol (enum restconf/netconf) for selecting device management transport
Add iosxe.devices.managed to control whether a device is continuously managed by NaC
Add optional version attribute to iosxe.global, iosxe.devices, and iosxe.device_groups
Extend ethernets with mtu, device_tracking, device_tracking_attached_policies, encapsulation_dot1q_vlan_id, nbar_protocol_discovery, carrier_delay_msec, hold_queue_in, hold_queue_out
Add interface attributes cdp, cdp_tlv_app, cdp_tlv_location, cdp_tlv_server_location, and port_channels.negotiation_auto
Add vlans.autostate
Add mrp_miscabling and oam_remote_failure to errdisable_recovery_cause
Add policy-map policing knobs police_target_bitrate, police_target_bitrate_conform_transmit, police_target_bitrate_exceed_transmit, police_target_bitrate_conform_burst_byte, police_target_bitrate_excess_burst_byte
Document policy-map action attributes police_cir, police_bc, police_pir, police_pir_be, police_rate_percent, queue_buffers_ratio, set_dscp, shape_average_percent; note policy_maps.type supports ngsw-qos
Extend class_maps.prematch to allow match-any and match-none in addition to match-all
Extend class_maps_match with access_group, ip_dscp, and ip_precedence match criteria
Extend access_lists with role_based; update access_lists_extended_entries.protocol to accept numeric values (int(min=0, max=255)) and additional enums
Add extended ACL attributes icmp_message_type, icmp_message_code, and destination additional_equal_ports
Add line_auxes.stopbits validation (1, 1.5, 2)
Expand tftp_source_interface_type to support Vlan, TwoGigabitEthernet, and HundredGigabitEthernet
Extend ntp source_interface_type with PortChannelSubinterface and add ntp_servers flags burst, iburst, periodic
Add FiveGigabitEthernet as a valid source_interface_type for ntp_servers and ntp_peers
Add FiftyGigabitEthernet to interface-type enums (source_interface_type, interface_type, originator_id_interface_type)
Add zone-based firewall schema support via class-map type inspect, policy-map type inspect, zone_security, and zone_pair_security
Add FQDN object-group schema support and extended ACL FQDN object-group references
Add class_maps.access_group_index
Add class_maps_match.result_type_success
Add address_dhcp to interface_ipv4
Add EVPN Ethernet Segment schema via evpn.ethernet_segments, evpn_ethernet_segments (es_value, df_election_wait_time, redundancy, identifier), and interface_evpn_ethernet_segments on ethernets and port_channels
Add CEF adaptive load-balancing algorithm support and port_channel_load_balance
Add tunnel interface ospfv3 attributes
Add tunnel interface PIM support
Add tunnel interface bandwidth, tunnel_bandwidth_transmit, tunnel_bandwidth_receive, service_policy_input, and service_policy_output
Add interfaces.ranges for bulk ethernet and port-channel range configuration
Add IPv6 prefix-list schema and route_maps to BGP IPv6 neighbors
Add SHA-2 authentication algorithms for SNMPv3 users
Add additional_equal_ports to extended ACL destination entries
Add ip_mtu/mtu to port-channel, loopback, VLAN, subinterface, and BDI schemas
Add relay_bootp_ignore to DHCP relay
Add spanning-tree VLAN range support
Add dhcp_pools schema
Add connected_route_map, connected_metric, static_route_map, and static_metric to BGP redistribute
Add IS-IS routing process and per-interface schema
Add IPsec/IKEv2 lifetime, PFS, and SA lifetime attributes
Add key_chains schema
Add OSPF interface authentication attributes
Add service_policy action to policy-maps
Add routing_ospf_processes.non_passive_interfaces
Add mac_address_table_aging_time
Add console to AAA authorization
Expand OSPF redistribute with metric, metric_type, route_map, and tag for static and connected redistribution, inter-process OSPF redistribution, distribute_list in/out, and default_information_originate metric options
Add voice_vlan to interface switchport
Add ipv6_dhcp_pools and ipv6_local_pools schema
Add password attributes to line_auxes
Add object_groups_service schema
Add BGP TCP-AO attributes
Add IPv4 Unicast RPF attributes to interfaces
Add interface_group_policy enum
Add device tracking schema
Add stackwise_virtual and stackwise_virtual_interfaces schema
Add power redundancy and automatic line-card recovery attributes
Add switch provisioning schema
Add queue-softmax-multiplier support to QoS policy-maps
Add NHRP/GRE multipoint tunnel schema
Add EIGRP named-mode routing schema
Add legacy VRRPv2 schema

Bug Fixes

BREAKING CHANGE: Fix VRF schema typo by renaming route_destinguisher to route_distinguisher
BREAKING CHANGE: Remove eem.detector_rpc_max_sessions (the underlying leaf was removed from the provider resource)
Fix route-map BGP community comparisons by normalizing the new aa:nn and legacy integer formats before comparing intent vs. device values
Constrain aaa_authorization_config_lists.groups to max=1 to prevent additional entries from being silently dropped by the provider mapping
Allow numeric interface IDs for AAA groups by changing aaa_radius_groups.source_interface_id and aaa_tacacs_groups.source_interface_id to any(str(), int(min=0))
Fix routing_ospf_processes.passive_interfaces type to list(include('routing_ospf_passive_interfaces'))
Allow encryption type 6 in password_type for dot1x_credentials, line_consoles, and line_vtys
Update OSPF object paths to routing.ospf_processes in objects/objects.yaml
Fix pim_rp_candidates.group_list schema type from ip() to str
Fix loopback_interface_ipv6.link_local_addresses schema to accept list(ip(version=6))
Remove invalid iosxe.*.configuration.interface_groups paths from the Interface Group object in objects/objects.yaml
Fix crypto IPsec profile attribute names by replacing set_isakmp_profile_ikev2_profile_* placeholders with set_ikev2_profile and set_isakmp_profile
Fix policy_maps_classes.actions to include policy_maps_classes_actions
Tighten interface_pim.dr_priority maximum from 4294967295 to 4294967294
Fix prefix_lists_seqs validation by constraining seq to max 4294967294 and requiring greater_equal/less_equal to be 1..32
Fix aaa_authorization_config_lists.groups schema type to list(include('aaa_authorization_config_lists_groups'))
Make interface_switchport.mode optional
Tighten BFD validation by constraining bfd.slow_timers to 1000..30000 and bfd_multi_hop_templates.interval_milliseconds_multiplier to 3..50
Allow variable-substituted strings for IP fields like mdt_subscriptions.source_ip, pim_rp_addresses.rp_address, and interface_ipv4.address/address_mask via any(ip(), regex("^.*[\$\%]\{.*$"))
Relax policy_maps_classes_actions.shape_average_bit_rate and shape_average_bits_per_interval_sustained minimum/maximum constraints
Make nves_vni_vrfs.vni_to and nves_vnis.vni_to optional
Allow remark-only ACL entries by making access_lists_standard_entries.action, access_lists_extended_entries.action, and access_lists_extended_entries.protocol optional
Constrain cdp.holdtime to 10..255 and cdp.timer to 5..254
Fix ARP schema types and ranges by updating arp.entry_learn to an int and constraining arp.incomplete_entries and arp.inspection_log_buffer_* ranges
Disallow 0 for flow exporter option timeouts (option_application_attributes_timeout, option_application_table_timeout, option_interface_table_timeout, option_vrf_table_timeout) — now 1..86400
Allow numeric OSPF area IDs in routing_ospf_networks.area, routing_ospf_areas.id, and interface_ospf_process_ids.areas via any(str(), int(min=0))
Allow numeric values for storm-control thresholds (storm_control_*_bps_threshold, storm_control_*_threshold) via num()
Make standard ACL entry fields prefix and prefix_mask optional
Make cts.authorization_list optional
Remove the Port Channel SubInterface object from objects/objects.yaml and add missing docs templates docs/templates/iosxe/device/crypto.md and docs/templates/iosxe/interface/tunnel.md
Change aaa.local_authentication_type from an enum to a free-form string, and aaa.local_authorization from boolean to string, to correctly reflect the underlying YANG type — configs using the old boolean value for local_authorization must migrate to a string equivalent
Narrow the IPv4 attributes accepted on tunnel interfaces to a curated subset, removing arp_inspection_trust, arp_inspection_limit_rate, dhcp_snooping_trust, and dhcp_relay_information_option_vpn_id (previously schema-permitted but silently ignored by the tunnel interface provider resource); add address_dhcp and flow_monitors to the retained tunnel IPv4 attributes
Add igmp, cdp, cdp_tlv_app, cdp_tlv_location, cdp_tlv_server_location, carrier_delay_msec, hold_queue_in, and hold_queue_out to interface groups, matching existing ethernet interface support
Widen validation on previously plain ip()/int()/enum() attributes across TACACS+, CTS SXP, L2 VFI, logging, MDT, MSDP, NTP, SNMP, DNS, IP hosts, DHCP relay, IPv6 addressing, RADIUS, IKEv2, OSPF, PIM, route-maps, PnP, IP SLA, BFD, and VXLAN to accept ${...}/%{...} template variables

0.1.0 January 15, 2026

Tested versions: link

Initial release