Netgate Releases TNSR Software Version 26.10

Today Netgate® released TNSR® software version 26.10. This scheduled release adds new features and includes more than 120 fixes, enhancements, and changes. Full details are in the Release Notes.

About TNSR Software

TNSR software is a high-performance router and VPN concentrator built for enterprises, service providers, and government organizations. It reaches forwarding rates usually reserved for ASIC-based hardware routers at a fraction of the cost, giving you scalable, advanced routing and VPN services without a six-figure price tag.

TNSR software is built on the FD.io Vector Packet Processor (VPP), a fast, scalable layer 2-7 network stack. FRR handles routing and strongSwan handles IKE, while NETCONF and RESTCONF APIs and an intuitive CLI cover configuration and monitoring.

This combination delivers high-performance routing and forwarding for mission-critical site-to-site, edge-to-cloud, data center, and remote access VPN deployments. Behind it stands the Netgate Technical Assistance Center, available 24x365 to support your business every day of the year.

TNSR software runs on Netgate systems and in the cloud on AWS and Azure.

What’s New in 26.10

IKEv1 Deprecation

IKEv1 is now deprecated, and the next release will remove it. IKEv1 offers weaker security and fewer capabilities than IKEv2, and nearly every maintained IPsec implementation supports IKEv2. For background, see the IETF document deprecating IKEv1.

IKEv1 still works in 26.10, but TNSR software now shows deprecation warnings for any tunnel using it. When the next release arrives, any IKEv1 tunnels remaining in the configuration will automatically change to IKEv2, so migrate them now and test them on your own schedule. To find tunnels still using IKEv1, run:

tnsr# show run ipsec | match version

Any tunnel showing version 1 needs to move to IKEv2.

Simpler LLDP Configuration

LLDP received a substantial overhaul. TNSR software now derives several LLDP values from the system configuration and sets sensible default timers, so there are fewer parameters to configure. A new lldp command enables LLDP on an interface, changing per-interface LLDP settings no longer requires a dataplane restart, and the new show lldp status command reports LLDP state. This release also fixes several long-standing LLDP issues, including an incorrect management address being advertised.

BGP4-MIB in SNMP

The SNMP service now supports the BGP4-MIB, giving operators complete visibility into BGP state from their existing monitoring systems. For enterprises and service providers who rely on active monitoring to keep their networks stable, this closes a real gap.

VPF Filter and NAT Improvements

VPF gets the largest set of changes in this release. Earlier releases always evaluated VPF filter rules before NAT, and you can now choose, per ruleset, whether evaluation happens before or after NAT. Other additions include stateful block rules, a nat-port-mapping option for forwarding a continuous range of ports, default IP hashing options, and per-rule counters in show vpf connection verbose output.

On the fix side, VPF NAT now translates every fragment of a fragmented TCP packet, not only the first; NPTv6 modifies the correct hextet for prefixes longer than /64; and HA state sync no longer corrupts packets under load.

HTTP Static Server

TNSR software now includes a built-in HTTP static server for serving files directly from the router.

Additional Enhancements

• BGP neighbors can now be configured as members of a peer group, with improved peer group and neighbor validation
• New control over the number of RX and TX queues for linux-cp interfaces
• Optional write-combining with the igb_uio driver
• A polling timeout parameter for tuning how TNSR software polls Snort for processed packets
• SNMP services are no longer enabled by default

Updated Components and Fixes

This release moves VPP to stable/2602, DPDK to 25.11, and Clixon to 7.8.0. It also includes nearly 100 bug fixes, more than 30 of them in dynamic routing (BGP, OSPF, OSPF6, and RIP). See the Release Notes for the complete list, including known issues.

Upgrading to TNSR Software 26.10

The Upgrade Guide has step-by-step instructions. On some systems, tnsr-upgrade can’t update itself and needs a manual update first. See Manually Updating tnsr-upgrade for details.

Starting with this release, the system reboots automatically once tnsr-upgrade completes successfully, so plan your upgrade for a maintenance window.

Before any significant change or upgrade, save a backup of your configuration. The Backup and Recovery guide explains how.

Support and Sales

TNSR software 26.10 is ready for production. If you run into an issue, post on the Netgate Forum or contact the Netgate Technical Assistance Center (TAC).

To talk through your requirements and find the right solution for your business, contact an authorized Netgate partner or the Netgate sales team.