Compare NETCONF, RESTCONF and gNMI. When would you pick each?
Show the answer
Say this first
All three carry YANG-modeled data. NETCONF uses SSH on port 830 and XML, and has the strongest transactions: candidate datastore, lock, validate and confirmed commit. RESTCONF uses HTTPS with JSON or XML and REST methods, so it is the easiest to call from any tool, but each request is its own transaction. gNMI uses gRPC over HTTP/2 with protobuf, has an atomic Set, and its Subscribe RPC is the standard for streaming telemetry. I pick NETCONF for safe config changes, RESTCONF for quick integrations, gNMI for telemetry.
Go deeper
Side by side
| NETCONF | RESTCONF | gNMI | |
|---|---|---|---|
| Standard | IETF, RFC 6241 | IETF, RFC 8040 | OpenConfig specification |
| Transport | SSH, TCP 830 (TLS optional) | HTTPS, usually 443 | gRPC over HTTP/2 with TLS; port varies by platform, IANA lists 9339 |
| Encoding | XML | JSON or XML | Protobuf messages; values as JSON, JSON_IETF, proto, bytes or ASCII |
| Operations | get, get-config, edit-config, lock, commit, validate | GET, POST, PUT, PATCH, DELETE | Capabilities, Get, Set, Subscribe |
| Transactions | Candidate, commit, confirmed commit, rollback-on-error | One request = one change | One SetRequest is applied all or nothing |
| Streaming | Notifications (RFC 5277), YANG-Push subscriptions | Event streams over server-sent events, rarely used | Subscribe: stream, poll, once |
| Typical models | IETF, native | IETF, native | OpenConfig mostly |
| Feels like | A config database | A web API | A telemetry and config bus |
How I choose
- Risky config changes on many devices: NETCONF with candidate and confirmed commit, where supported.
- A quick integration, a webhook, a ServiceNow action: RESTCONF, because every language and tool can do HTTPS and JSON.
- Monitoring at scale: gNMI Subscribe, often with OpenConfig paths across vendors.
- Platform reality: use what the device does well. Some platforms are strongest on one interface.
They will ask next
Can one device run all three at once?
Yes. IOS-XE, IOS XR, Junos, EOS and NX-OS can expose more than one at a time, all backed by the same configuration database. A change made through one shows up through the others and in the CLI.
Traps
- Saying RESTCONF is "NETCONF over HTTP" with the same transaction model. It has no candidate, lock or confirmed commit.
- Calling gNMI an IETF standard. It is defined by OpenConfig.