NETCONF and RESTCONF

What it is

NETCONF and RESTCONF are two standard protocols for reading and changing device configuration using YANG models.

NETCONF is the older one. It uses SSH and XML, and it offers rich operations such as locking and commit. RESTCONF gives a similar view of the same models through HTTPS and the usual HTTP methods.

How it works

Both protocols read and write data defined by YANG, and they differ in transport and style.

NETCONF

NETCONF runs over SSH, normally on TCP port 830. The client and the server start by exchanging a hello message that lists their capabilities.

Each request is an RPC message that carries an operation, and the reply says whether it worked. The messages are written in XML.

The main operations are:

NETCONF works with datastores. The running datastore holds the active configuration. A device may also offer a candidate datastore, where you build a change and then commit it, and a startup datastore.

An edit can merge, replace, create, delete or remove data. Because it works with a lock and a commit, NETCONF suits changes that must be all or nothing.

Enabling NETCONF

On IOS XE, one command starts the service. The device also needs AAA and a user with the right privilege level.

Router(config)# netconf-yang
Router# show netconf-yang status
Router# show netconf-yang sessions

On IOS XR, NETCONF is enabled with the SSH server and the NETCONF agent.

RP/0/RP0/CPU0:R1(config)# ssh server v2
RP/0/RP0/CPU0:R1(config)# ssh server netconf vrf default
RP/0/RP0/CPU0:R1(config)# netconf-yang agent ssh

You can check that the session opens by asking SSH for the netconf subsystem on port 830.

ssh -l admin -p 830 192.0.2.1 -s netconf

The device replies with its hello message, which lists its capabilities. The same can be done from Python with the ncclient library.

from ncclient import manager

with manager.connect(
    host="192.0.2.1",
    port=830,
    username="admin",
    password="PASSWORD",
    hostkey_verify=False,
) as session:
    for capability in session.server_capabilities:
        print(capability)

RESTCONF

RESTCONF runs over HTTPS and maps the YANG data to resources with URIs. The root is /restconf. Configuration and state data sit under /restconf/data, and operations sit under /restconf/operations.

The data can be sent as JSON or XML. The media types are application/yang-data+json and application/yang-data+xml.

RESTCONF has no lock and no candidate datastore. Every change is applied to the running configuration as a single request.

On IOS XE, RESTCONF is enabled with two commands, and the HTTP server also needs a way to authenticate users.

Router(config)# restconf
Router(config)# ip http secure-server

A read request looks like this:

GET /restconf/data/ietf-interfaces:interfaces HTTP/1.1
Host: HOST
Accept: application/yang-data+json

The path names the module, ietf-interfaces, then the container, interfaces. A 200 status code with a JSON body means success. A 401 means authentication failed, and a 404 means the resource does not exist.

Comparing the two