What is NETCONF and how does it work?
Show the answer
Say this first
NETCONF (RFC 6241) is a protocol for installing, changing and reading device configuration. It runs as an
SSH subsystem on TCP port 830 (RFC 6242), encodes everything in XML, and uses RPCs such as get,
get-config, edit-config, lock, commit and close-session. Both sides open with a hello that
lists capabilities. Its big advantages over CLI are structured data, validation against YANG and
transactions with a candidate datastore.
Go deeper
The layers
| Layer | Examples |
|---|---|
| Content | YANG-modeled config and state data |
| Operations | get, get-config, edit-config, copy-config, delete-config, lock, unlock, commit, discard-changes, validate, close-session, kill-session |
| Messages | <rpc>, <rpc-reply>, <notification> |
| Transport | SSH (mandatory to implement), TLS (RFC 7589) |
get vs get-config
get-config returns config only, from the datastore you name (running, candidate, startup). get
returns config plus state data from the running system. Both accept a subtree or XPath filter.
A get-config with a subtree filter
<rpc message-id="101" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<get-config>
<source><running/></source>
<filter type="subtree">
<interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
<interface><name>GigabitEthernet1</name></interface>
</interfaces>
</filter>
</get-config>
</rpc>The reply carries the same message-id and the data inside <data>.
Framing
With base:1.0, each message ends with ]]>]]>. When both sides announce base:1.1, they switch to chunked
framing, which cannot be broken by that string appearing inside data.
Turning it on
R1(config)# netconf-yangset system services netconf sshQuick test from a shell: ssh -p 830 netops@10.0.0.1 -s netconf prints the server hello.
They will ask next
Why is NETCONF better than pushing CLI over SSH?
The device validates the whole change against the model and either accepts or rejects it with a structured error. With a candidate datastore the change is a transaction: all of it or none. And the data you read back is structured, so no screen scraping.
What does message-id do?
The client sets it on each
<rpc>and the server copies it to the<rpc-reply>, so the client can match replies to requests.
Traps
- Saying NETCONF runs on port 22. The standard port is 830; some platforms also allow the SSH subsystem on 22.
- Saying NETCONF is the data model. YANG is the model; NETCONF is the protocol.