NETCONF Protocol

Restrictions for the NETCONF Protocol

The NETCONF feature is not supported on a device running dual IOSd configuration or software redundancy.

Information About the NETCONF Protocol

Introduction to Data Models - Programmatic and Standards-Based Configuration

The traditional way of managing network devices is by using Command Line Interfaces (CLIs) for configurational (configuration commands) and operational data (show commands). For network management, Simple Network Management Protocol (SNMP) is widely used, especially for exchanging management information between various network devices. Although CLIs and SNMP are heavily used, they have several restrictions. CLIs are highly proprietary, and human intervention is required to understand and interpret their text-based specification. SNMP does not distinguish between configurational and operational data.

The solution lies in adopting a programmatic and standards-based way of writing configurations to any network device, replacing the process of manual configuration. Network devices running on Cisco IOS XE support the automation of configuration for multiple devices across the network using data models. Data models are developed in a standard, industry-defined language, that can define configuration and state information of a network.

Cisco IOS XE supports the Yet Another Next Generation (YANG) data modeling language. YANG can be used with the Network Configuration Protocol (NETCONF) to provide the desired solution of automated and programmable network operations. NETCONF (RFC 6241) is an XML-based protocol that client applications use to request information from and make configuration changes to the device. YANG is primarily used to model the configuration and state data used by NETCONF operations.

In Cisco IOS XE, model-based interfaces interoperate with existing device CLI, Syslog, and SNMP interfaces. These interfaces are optionally exposed northbound from network devices. YANG is used to model each protocol based on RFC 6020.


Note

To access Cisco YANG models in a developer-friendly way, clone the GitHub repository, and navigate to the vendor/cisco subdirectory. Models for various releases of IOS-XE, IOS-XR, and NX-OS platforms are available here.

NETCONF

NETCONF provides a simpler mechanism to install, manipulate, and delete the configuration of network devices.

It uses an Extensible Markup Language (XML)-based data encoding for the configuration data as well as the protocol messages.

NETCONF uses a simple Remote Procedure Call (RPC) based mechanism to facilitate communication between a client and a server. The client can be a script or application running as part of a network manager. The server is typically a network device (switch or router). It uses Secure Shell (SSH) as the transport layer across network devices. It uses SSH port number 830 as the default port. The port number is a configurable option.

NETCONF also supports capability discovery and model downloads. Supported models are discovered using the ietf-netconf-monitoring model. Revision dates for each model are shown in the capabilities response. Data models are available for optional download from a device using the get-schema RPC. You can use these YANG models to understand or export the data model.

For more details, refer RFC 6241.

How to Configure the NETCONF Protocol

NETCONF-YANG uses the primary trustpoint of a device. If a trustpoint does not exist, when NETCONF-YANG is configured, it creates a self-signed trustpoint. For more information, see the Public Key Infrastructure Configuration Guide, Cisco IOS XE Gibraltar 16.10.x.

Providing Privilege Access to Use NETCONF

To start working with NETCONF APIs, you must be a user with privilege level 15. To provide this, perform the following task:

Procedure

  Command or Action Purpose
Step 1

enable

Example:

Device# enable

Enables privileged EXEC mode.

Enter your password if prompted.
Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.
Step 3

username name privilege level password password

Example:

Device(config)# username example-name privilege 15 password example_password

Establishes a user name-based authentication system. Configure the following keywords:

  • privilege level —Sets the privilege level for the user. For the programmability feature, it must be 15.

  • password password —Sets a password to access the CLI view.

Step 4

aaa authentication login default local and aaa authorization exec default local

Example:

Device (config)# aaa authentication login default local
Device (config)# aaa authorization exec default local

[Optional] If aaa new-model is configured, AAA authentication and authorization is required. For a remote AAA server, replace local with your AAA server.

Step 5

end

Example:

Device (config)# end

Exits global configuration mode.

Configuring NETCONF-YANG

If the legacy NETCONF protocol is enabled on your device, the RFC-compliant NETCONF protocol does not work. Disable the legacy NETCONF protocol by using the no netconf legacy command.

Procedure

  Command or Action Purpose
Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

netconf-yang

Example:

Device (config)# netconf-yang

Enables the NETCONF interface on your network device.

Note 

After the initial enablement through the CLI, network devices can be managed subsequently through a model based interface. The complete activation of model-based interface processes may require up to 90 seconds.

Step 4

netconf-yang feature candidate-datastore

Example:

Device(config)# netconf-yang feature candidate-datastore

Enables candidate datastore.
Step 5

exit

Example:

Device (config)# exit

Exits global configuration mode.

Configuring NETCONF Options

Configuring SNMP

Enable the SNMP Server in IOS to enable NETCONF to access SNMP MIB data using YANG models generated from supported MIBs, and to enable supported SNMP traps in IOS to receive NETCONF notifications from the supported traps.

Perform the following steps:

Procedure
Step 1

Enable SNMP features in IOS.

Example:
configure terminal
logging history debugging
logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical
logging snmp-trap errors
logging snmp-trap warnings
logging snmp-trap notifications
logging snmp-trap informational
logging snmp-trap debugging
!
snmp-server community public RW
snmp-server trap link ietf
snmp-server enable traps snmp authentication linkdown linkup 
snmp-server enable traps syslog
snmp-server manager
exit
Step 2

After NETCONF-YANG starts, enable SNMP Trap support by sending the following RPC <edit-config> message to the NETCONF-YANG port.

Example:
<?xml version="1.0" encoding="utf-8"?>
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="">
  <edit-config>
    <target>
      <running/>
    </target>
    <config>
      <netconf-yang xmlns="http://cisco.com/yang/cisco-self-mgmt">
        <cisco-ia xmlns="http://cisco.com/yang/cisco-ia">
          <snmp-trap-control>
            <trap-list>
              <trap-oid>1.3.6.1.4.1.9.9.41.2.0.1</trap-oid>
            </trap-list>
            <trap-list>
              <trap-oid>1.3.6.1.6.3.1.1.5.3</trap-oid>
            </trap-list>
            <trap-list>
              <trap-oid>1.3.6.1.6.3.1.1.5.4</trap-oid>
            </trap-list>
          </snmp-trap-control>
        </cisco-ia>
      </netconf-yang>
    </config>
  </edit-config>
</rpc>
Step 3

Send the following RPC message to the NETCONF-YANG port to save the running configuration to the startup configuration.

Example:
<?xml version="1.0" encoding="utf-8"?>
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="">
  <cisco-ia:save-config xmlns:cisco-ia="http://cisco.com/yang/cisco-ia"/>
</rpc>

Verifying the NETCONF Protocol Configuration

Use the following commands to verify your NETCONF configuration.

Procedure

Step 1

show netconf-yang datastores

Displays information about NETCONF-YANG datastores.

Example:

Device# show netconf-yang datastores

Device# show netconf-yang datastores
Datastore Name : running
Globally Locked By Session : 42
Globally Locked Time : 2018-01-15T14:25:14-05:00
Step 2

show netconf-yang sessions

Displays information about NETCONF-YANG sessions.

Example:

Device# show netconf-yang sessions

R: Global-lock on running datastore
C: Global-lock on candidate datastore
S: Global-lock on startup datastore
Number of sessions : 10
session-id transport username source-host global-lock
-------------------------------------------------------------------------------
40 netconf-ssh admin 10.85.70.224 None
42 netconf-ssh admin 10.85.70.224 None
44 netconf-ssh admin 10.85.70.224 None
46 netconf-ssh admin 10.85.70.224 None
48 netconf-ssh admin 10.85.70.224 None
50 netconf-ssh admin 10.85.70.224 None
52 netconf-ssh admin 10.85.70.224 None
54 netconf-ssh admin 10.85.70.224 None
56 netconf-ssh admin 10.85.70.224 None
58 netconf-ssh admin 10.85.70.224 None
Step 3

show netconf-yang sessions detail

Displays detailed information about NETCONF-YANG sessions.

Example:

Device# show netconf-yang sessions detail
  
R: Global-lock on running datastore
C: Global-lock on candidate datastore
S: Global-lock on startup datastore
 
Number of sessions     : 1
 
session-id             : 19
transport              : netconf-ssh
username               : admin
source-host            : 2001:db8::1
login-time             : 2018-10-26T12:37:22+00:00
in-rpcs                : 0
in-bad-rpcs            : 0
out-rpc-errors         : 0
out-notifications      : 0
global-lock            : None
Step 4

show netconf-yang statistics

Displays information about NETCONF-YANG statistics.

Example:

Device# show netconf-yang statistics

netconf-start-time : 2018-01-15T12:51:14-05:00
in-rpcs : 0
in-bad-rpcs : 0
out-rpc-errors : 0
out-notifications : 0
in-sessions : 10
dropped-sessions : 0
in-bad-hellos : 0
Step 5

show platform software yang-management process

Displays the status of the software processes required to support NETCONF-YANG.

Example:

Device# show platform software yang-management process 

confd            : Running 
nesd             : Running 
syncfd           : Running 
ncsshd           : Running 
dmiauthd         : Running 
vtyserverutild   : Running 
opdatamgrd       : Running 
nginx            : Running 
ndbmand          : Running
Note 

The process nginx runs if ip http secure-server or ip http server is configured on the device. This process is not required to be in the running state for NETCONF to function properly. However, the nginx process is required for RESTCONF.

Table 1. show platform software yang-management process Field Descriptions

Field

Description

confd

Configuration daemon

nesd

Network element synchronizer daemon

syncfd

Sync from daemon

ncsshd

NETCONF Secure Shell (SSH) daemon

dmiauthd

 Device management inteface (DMI) authentication daemon

vtyserverutild

VTY server util daemon

opdatamgrd

Operational Data Manager daemon

nginx

NGINX web server
ndbmand

NETCONF database manager

Additional References for Data Models

Related Documents

Related Topic Document Title

YANG data models for various release of IOS-XE, IOS-XR, and NX-OS platforms

To access Cisco YANG models in a developer-friendly way, please clone the GitHub repository, and navigate to the vendor/cisco subdirectory. Models for various releases of IOS-XE, IOS-XR, and NX-OS platforms are available here.

Standards and RFCs

Standard/RFC Title

RFC 6020

YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)

RFC 6241

Network Configuration Protocol (NETCONF)

Technical Assistance

Description Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/support

Feature Information for NETCONF Protocol

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 2. Feature Information for NETCONF Protocol

Feature Name

Release

Feature Information

Candidate Config Support

Cisco IOS XE Fuji 16.9.1

The Candidate Config Support feature enables support for candidate capability by implementing RFC 6241 with a simple commit option.

This feature was implemented on the following platforms:

  • Cisco ASR 1000 Series Aggregated Services Routers

  • Cisco ASR 900 Series Aggregated Services Routers

  • Cisco Catalyst 3650 Series Switches

  • Cisco Catalyst 3850 Series Switches

  • Cisco Catalyst 9300 Series Switches

  • Cisco Catalyst 9400 Series Switches

  • Cisco Catalyst 9500 Series Switches

  • Cisco CBR-8 Series Routers

  • Cisco Cloud Services Router 1000V Series

  • Cisco ISR 4000 Series Integrated Services Routers

The following command was introduced: netconf-yang feature candidate-datastore .

NETCONF Protocol

Cisco IOS XE Denali 16.3.1

The NETCONF Protocol feature facilitates a programmatic and standards-based way of writing configurations and reading operational data from network devices.

The following command was introduced: netconf-yang.

Cisco IOS XE Everest 16.5.1a

This feature was implemented on Cisco Catalyst 9300 Series Switches and Cisco Catalyst 9500 Series Switches.

Cisco IOS XE Everest 16.6.2

This feature was implemented on Cisco Catalyst 9400 Series Switches.

Cisco IOS XE Fuji 16.7.1

This feature was implemented on the following platforms:

  • Cisco ASR 900 Series Aggregated Services Routers

  • Cisco ASR 920 Series Aggregated Services Routers

  • Cisco Network Convergence System 4200 Series

Cisco IOS XE Fuji 16.8.1a

This feature was implemented on Cisco Catalyst 9500-High Performance Series Switches.

NETCONF and RESTCONF IPv6 Support

Cisco IOS XE Fuji 16.8.1a

This feature was implemented on the following platforms:

  • Cisco ASR 1000 Series Aggregated Services Routers

  • Cisco ASR 900 Series Aggregated Services Routers

  • Cisco Catalyst 3650 Series Switches

  • Cisco Catalyst 3850 Series Switches

  • Cisco Catalyst 9300 Series Switches

  • Cisco Catalyst 9400 Series Switches

  • Cisco Catalyst 9500 Series Switches

  • Cisco CBR-8 Series Routers

  • Cisco CSR 1000v Switches

  • Cisco ISR 1100 Series Integrated Services Routers

  • Cisco ISR 4000 Series Integrated Services Routers

NETCONF Global Lock and Kill Session

Cisco IOS XE Fuji 16.8.1a

This feature was implemented on the following platforms:

  • Cisco ASR 1000 Series Aggregated Services Routers

  • Cisco ASR 900 Series Aggregated Services Routers

  • Cisco Catalyst 3650 Series Switches

  • Cisco Catalyst 3850 Series Switches

  • Cisco Catalyst 9300 Series Switches

  • Cisco Catalyst 9400 Series Switches

  • Cisco Catalyst 9500 Series Switches

  • Cisco CBR-8 Series Routers

  • Cisco CSR 1000v Switches

  • Cisco ISR 1100 Series Integrated Services Routers

  • Cisco ISR 4000 Series Integrated Services Routers