NETCONF and RESTCONF

What it is

NETCONF and RESTCONF are standard protocols that let software configure and read a network device using YANG data models.

The command line is made for people, and scripts that parse it break easily.

These protocols give programs a structured and predictable way to work. NETCONF is the older of the two, and it uses XML over SSH. RESTCONF gives a REST style interface over HTTPS, and it uses JSON or XML.

How it works

Both protocols read and write the same data models, with different transports.

NETCONF

NETCONF is defined in RFC 6241. It runs over SSH, and the standard port is 830. The messages are XML, and the protocol is built on remote procedure calls.

A session starts with a hello exchange. Each side sends the capabilities it supports, and these include the YANG models that the device offers.

NETCONF works with named stores of configuration, called datastores.

The main operations are:

A change can be sent as a single transaction. When the client asks for rollback on error, a failed change is rejected as a whole, so the device is not left half configured.

Enabling NETCONF on IOS XE

Router(config)# username admin privilege 15 secret PASSWORD
Router(config)# aaa new-model
Router(config)# aaa authentication login default local
Router(config)# aaa authorization exec default local
Router(config)# netconf-yang
Router# show netconf-yang sessions

The command netconf-yang starts the NETCONF server on port 830. Authentication and authorisation are needed, since the session uses the device credentials. show netconf-yang sessions lists the active sessions.

A client connects with SSH to port 830 and asks for the netconf subsystem. Tools and libraries such as the Python library ncclient do this for you.

RESTCONF

RESTCONF is defined in RFC 8040. It maps NETCONF ideas onto HTTP. It uses HTTPS, and the device exposes the data under a path that starts with /restconf.

The data format is set by headers. The media types are application/yang-data+json and application/yang-data+xml. Use the Accept header to say what you want back, and Content-Type to say what you send.

GET /restconf/data/ietf-interfaces:interfaces HTTP/1.1
Host: 10.1.1.1
Accept: application/yang-data+json

The path names the YANG module, then the container. A reply looks like this:

{
  "ietf-interfaces:interfaces": {
    "interface": [
      {
        "name": "GigabitEthernet1",
        "type": "iana-if-type:ethernetCsmacd",
        "enabled": true
      }
    ]
  }
}

Enabling RESTCONF on IOS XE

Router(config)# restconf
Router(config)# ip http secure-server
Router(config)# ip http authentication local
Router# show platform software yang-management process

RESTCONF depends on the secure HTTP server, so it must be on. The user credentials are sent with HTTP basic authentication, and that is why the transport must be HTTPS. The last command shows whether the processes behind NETCONF and RESTCONF are running.

NETCONF compared with RESTCONF

Checking the setup

If a client cannot connect, work through these checks:

1. Is the feature enabled, and are the processes running?
2. Does the device accept SSH or HTTPS from the client address?
3. Do the credentials work, and does the user have privilege 15?
4. Does the data path name a YANG module that the device supports?