OVN 26.09 was initially released on 18 September, 2026. This version of OVN is currently supported for all bug fixes. Support for this version will end on 18 September, 2027.
v26.09.0 was released on 18 September, 2026.
Release Notes:
OVN v26.09.0 - Sep 18 2026
--------------------------
- Logical_Router_Port: Added a new "options:dhcpv4_primary_ip" key
that selects which of the port's IPv4 addresses ovn-northd uses as
the relay agent address (giaddr) in relayed DHCP packets. When
unset, ovn-northd picks the same address it picked before
(whichever CIDR in "networks" sorts first as a string), so
existing deployments are unaffected; deployments that need a
specific address on a multi-IP port can pin it via the new
option.
- OVN Interconnection now supports advertising Address_Sets to remote
availability zones. Set options:ic-adv=true on an NB Address_Set to
have ovn-ic publish it to the IC-SB database and import it into the
Northbound databases of other availability zones.
- Load balancer health checks now "fail closed" for newly added backends:
ovn-northd initializes a newly created Service_Monitor row to the
"offline" state, so traffic is not forwarded to a backend until its first
health check probe succeeds. Previously, such backends were treated as
available until the first probe completed.
- Added Transit Switch port support with new ovn-ic-nbctl 'tsp-add',
'tsp-del' and 'tsp-set-addr' commands.
- Added ability to set any "ipsec_*" NB_Global option to configure the
IPsec backend.
- Added nb_cfg_timestamp to SB_Global, written atomically with each
nb_cfg update by ovn-northd. ovn-controller propagates this value
to the local OVS bridge external_ids as "ovn-nb-cfg-sb-ts". In
large deployments where options:enable_chassis_nb_cfg_update is
false, this enables per-chassis propagation latency tracking without
any southbound database writes.
- Documented missing ovn-nbctl commands: "mirror-rule-add",
"mirror-rule-del", "lr-nat-update-ext-ip",
"ha-chassis-group-set-chassis-prio", "lsp-add-router-port",
and "lsp-add-localnet-port". Also documented missing options for
"lb-add", "meter-add", "lr-policy-add", and "lr-policy-del", and
fixed the "nfg-list" signature.
- Dynamic Routing:
* Allow multiple routers to read the same VRF table.
* Add support for hub-and-spoke propagation via the "hub-spoke" option
in dynamic-routing-redistribute settings.
* Add ECMP/multi-homing support for EVPN FDB entries. FDB entries
backed by a kernel nexthop group are load-balanced via OpenFlow
select groups with weighted buckets.
* Add EVPN ARP/ND suppression for logical switches. When a
broadcast ARP request or multicast ND solicitation targets
an IP address that was learned via EVPN, ovn-northd now
generates proxy-reply flows using a dedicated side table
and the new chk_evpn_arp() action, preventing unnecessary
flooding to remote VTEPs.
* Allow learning routes from the main (254) and default (253) routing
tables.
* EVPN: distributed dnat_and_snat NAT entries (e.g. floating IPs)
are now populated in the SB Advertised_MAC_Binding table on the
provider logical switch that carries the distributed gateway
port, so that they can be advertised as EVPN Type-2 routes. This
is gated on a new "nat" token of the Logical_Switch
"dynamic-routing-redistribute" option, independent of "ip".
* ovn-controller now automatically discovers the veth peer interface
of a Logical Switch Port referenced by the "routing-protocol-redirect"
option, when that port is bound locally and connected through a veth
pair. This removes the need to manually configure
"dynamic-routing-port-name" and/or the Open_vSwitch
"external_ids:dynamic-routing-port-mapping" for veth-based routing
daemon integrations. This feature is Linux-only and requires
OVS version >= 4.0.
* Remove the "other_config:dynamic-routing-arp-prefer-local"
option from Logical Switches. EVPN-learned MAC bindings are
now written to the SB MAC_Binding table and consumed at the
same priority as dynamic entries, making the preference option
obsolete.
- Added "override-connected" option to Logical Router Static Routes to mark
static routes as higher-priority than connected routes, which in turn led
to changes in administrative distance for specific route types. Please see
the "Route Administrative Distance" section of the ovn-northd manpage.
- Windows support was broken since the split from OVS repository.
Remaining bits of the build system and the documentation are now removed.
- Removed deprecated "port-up-notif", "ct-no-masked-label" and
"ovn-ct-lb-related" feature flags. At the same time mark
"mac-binding-timestamp", "fdb-timestamp" and "ls-dpg-column" feature
flags as deprecated.
- Removed the deprecated "ct_lb" action.
- Added a new "icmp4.inner_ip4.src" action that rewrites the source
IPv4 address embedded in an ICMPv4 error's inner packet. ovn-northd
uses it for stateless "dnat_and_snat" rules, controlled by the new
"options:stateless_icmp_helper" NAT option (default true), so that
inbound ICMPv4 errors that quote the original datagram - Destination
Unreachable (type 3, including "fragmentation needed"), Time Exceeded
(type 11) and Parameter Problem (type 12) - generated by an external
router are un-NATed correctly. This makes Path MTU discovery and
traceroute work through stateless NAT.
- Added the "ic-route-ipv4-next-hop-ipv6" option to Logical_Router (and,
as an override, to Logical_Router_Port) to advertise a router's IPv4
routes through ovn-ic using the interconnect port's IPv6 address as next
hop ("IPv4 over IPv6").
- Add vtap mode support for Network Function. In vtap mode, traffic matching
ACLs is mirrored to the network function while continuing to flow to the
original destination. This enables passive monitoring use cases where
network functions can observe traffic without being inline in
the data path.
- Added a new "ovn-debug lflow-pipeline-oftable-start-list" command that
prints the starting OpenFlow table number of the logical ingress and
egress pipelines.
- The support for co-hosting multiple controller instances is now
considered stable. Its "experimental" tag has been removed.
- Added the "ic-route-learn-tag-rules" option to Logical_Router_Port to
filter the routes learned through the port by route tag. This supersedes
"ic-route-filter-tag", which is now deprecated and is ignored when
"ic-route-learn-tag-rules" is set.
- Mark tunnel ports as transient (other_config:transient=true) when the
local chassis is a member of an HA chassis group.
Systems which invoke ovs-ctl --delete-transient-ports during OVS startup
(e.g. via the ovs-delete-transient-ports.service on RHEL/Fedora) will
automatically remove stale tunnel ports on reboot, preventing them from
interfering with BFD and HA failover after a gateway chassis reboot.