LAB 4 - NETCONF + YANG Models (get/get-config/edit-config/delete-config)

! Enable NETCONF-YANG on port 830 (default)
R1(config)# netconf-yang

! Optional: Enable candidate datastore support (advanced NETCONF feature)
R1(config)# netconf-yang feature candidate-datastore

R1# show platform software yang-management process

confd            : Running
nesd             : Running
syncfd           : Running
ncsshd           : Running    <-- This is the NETCONF SSH daemon
dmiauthd         : Running
nginx            : Running
ndbmand          : Running
pubd             : Running

! Basic config (hostname, domain, user, SSH)
Switch> enable
Switch# configure terminal
Switch(config)# hostname SW1
Switch(config)# no ip domain-lookup
Switch(config)# ip domain-name lab.local
Switch(config)# username admin privilege 15 secret Cisco123!
Switch(config)# crypto key generate rsa modulus 2048
Switch(config)# ip ssh version 2

! Configure management VLAN
Switch(config)# interface vlan 1
Switch(config-if)# description Management Interface
Switch(config-if)# ip address 10.10.20.30 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

! VTY lines
Switch(config)# line vty 0 15
Switch(config-line)# transport input ssh
Switch(config-line)# login local
Switch(config-line)# exit

! Enable NETCONF
Switch(config)# netconf-yang
Switch(config)# netconf-yang feature candidate-datastore

! Save configuration
Switch(config)# end
Switch# write memory

ping -c 3 10.10.20.10  # R1
ping -c 3 10.10.20.30  # SW1

nc -zv 10.10.20.10 830  # Test if port 830 is open on R1

pip install ncclient

# test_netconf_connection.py
# Test NETCONF connectivity to router

from ncclient import manager
import sys

# Device connection parameters
device = {
    'host': '10.10.20.10',
    'port': 830,
    'username': 'admin',
    'password': 'Cisco123!',
    'hostkey_verify': False  # Disable SSH key verification for lab
}

# Connect to device via NETCONF
try:
    print(f"Connecting to {device['host']} via NETCONF...")

    # Establish NETCONF session
    with manager.connect(**device, device_params={'name': 'iosxe'}) as m:
        print("OK: NETCONF connection successful!")

        # Display NETCONF capabilities (what the device supports)
        print("\nDevice NETCONF Capabilities:")
        for capability in m.server_capabilities:
            # Print only YANG model capabilities (filter out base protocol capabilities)
            if 'module=' in capability:
                # Extract just the module name
                module_name = capability.split('module=')[1].split('&')[0]
                print(f"  - {module_name}")

        print(f"\nOK: Device supports {len(list(m.server_capabilities))} capabilities")

except Exception as e:
    print(f"ERROR: Connection failed: {e}")
    sys.exit(1)

python test_netconf_connection.py

Connecting to 10.10.20.10 via NETCONF...
OK: NETCONF connection successful!

Device NETCONF Capabilities:

  - ietf-interfaces
  - ietf-ip
  - ietf-netconf
  - Cisco-IOS-XE-native
  - Cisco-IOS-XE-vlan
  ... (many more)

OK: Device supports 150+ capabilities

R1# write memory
SW1# write memory

+---------------------+
|   Configuration     |  <-- What you want to change
|   Operations        |      (interfaces, VLANs, routing)
+---------------------+
|   RPC Operations    |  <-- <edit-config>, <get-config>, <delete-config>
+---------------------+
|   Messages Layer    |  <-- XML encoding
+---------------------+
|   Transport (SSH)   |  <-- Secure connection, port 830
+---------------------+

<rpc message-id="101" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
  <get-config>
    <source>
      <running/>
    </source>
    <filter>
      <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces"/>
    </filter>
  </get-config>
</rpc>

{
  "ietf-interfaces:interface": {
    "name": "Loopback99",
    "type": "iana-if-type:softwareLoopback",
    "enabled": true,
    "ietf-ip:ipv4": {
      "address": [
        {
          "ip": "192.0.2.99",
          "netmask": "255.255.255.0"
        }
      ]
    }
  }
}

<interface xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
  <name>Loopback99</name>
  <type xmlns:ianaift="urn:ietf:params:xml:ns:yang:iana-if-type">
    ianaift:softwareLoopback
  </type>
  <enabled>true</enabled>
  <ipv4 xmlns="urn:ietf:params:xml:ns:yang:ietf-ip">
    <address>
      <ip>192.0.2.99</ip>
      <netmask>255.255.255.0</netmask>
    </address>
  </ipv4>
</interface>

<filter>
  <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
    <interface>
      <name>GigabitEthernet0/0/1</name>
    </interface>
  </interfaces>
</filter>

<filter type="xpath" select="/interfaces/interface[name='GigabitEthernet0/0/1']"/>

<rpc-reply message-id="101">
  <rpc-error>
    <error-type>application</error-type>
    <error-tag>invalid-value</error-tag>
    <error-severity>error</error-severity>
    <error-message>Interface name already exists</error-message>
    <error-path>/interfaces/interface[name='Loopback99']</error-path>
  </rpc-error>
</rpc-reply>

# netconf_get_interfaces.py
# Retrieve all interface configurations using NETCONF get-config

from ncclient import manager
import xmltodict  # pip install xmltodict (converts XML to Python dict)
import json

# Device connection parameters
device = {
    'host': '10.10.20.10',
    'port': 830,
    'username': 'admin',
    'password': 'Cisco123!',
    'hostkey_verify': False
}

# Define the filter to retrieve interfaces (subtree filtering)
# This specifies we want data from the ietf-interfaces YANG model
filter_interfaces = '''
<filter>
  <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces"/>
</filter>
'''

# Connect to device and retrieve configuration
with manager.connect(**device, device_params={'name': 'iosxe'}) as m:
    print("Connected to device via NETCONF\n")

    # Send get-config RPC to retrieve running configuration
    # source='running' specifies the running-config datastore
    netconf_reply = m.get_config(source='running', filter=filter_interfaces)

    # The reply is an XML object, convert to string for viewing
    print("Raw XML Response:")
    print(netconf_reply)
    print("\n" + "="*80 + "\n")

    # Convert XML to Python dictionary for easier parsing
    # xmltodict.parse() converts XML to a nested dict structure
    xml_dict = xmltodict.parse(netconf_reply.xml)

    # Pretty-print the dictionary as JSON for readability
    print("Parsed as Python Dictionary (JSON format):")
    print(json.dumps(xml_dict, indent=2))

python netconf_get_interfaces.py

{
  "rpc-reply": {
    "@xmlns": "urn:ietf:params:xml:ns:netconf:base:1.0",
    "@message-id": "urn:uuid:...",
    "data": {
      "interfaces": {
        "@xmlns": "urn:ietf:params:xml:ns:yang:ietf-interfaces",
        "interface": [
          {
            "name": "GigabitEthernet0/0/0",
            "type": "iana-if-type:ethernetCsmacd",
            "enabled": "false"
          },
          {
            "name": "GigabitEthernet0/0/1",
            "type": "iana-if-type:ethernetCsmacd",
            "enabled": "true",
            "ipv4": {
              "@xmlns": "urn:ietf:params:xml:ns:yang:ietf-ip",
              "address": {
                "ip": "10.10.20.10",
                "netmask": "255.255.255.0"
              }
            }
          }
        ]
      }
    }
  }
}

# netconf_get_specific_interface.py
# Retrieve a single interface using subtree filtering

from ncclient import manager
import xmltodict
import json

device = {
    'host': '10.10.20.10',
    'port': 830,
    'username': 'admin',
    'password': 'Cisco123!',
    'hostkey_verify': False
}

# Filter for a specific interface by name
# The filter structure matches the YANG model hierarchy
filter_specific = '''
<filter>
  <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
    <interface>
      <name>GigabitEthernet0/0/1</name>
    </interface>
  </interfaces>
</filter>
'''

with manager.connect(**device, device_params={'name': 'iosxe'}) as m:
    # Get configuration with specific filter
    netconf_reply = m.get_config(source='running', filter=filter_specific)

    # Parse XML to dictionary
    xml_dict = xmltodict.parse(netconf_reply.xml)

    # Navigate to the interface data
    interface_data = xml_dict['rpc-reply']['data']['interfaces']['interface']

    print("Interface Name:", interface_data['name'])
    print("Interface Type:", interface_data['type'])
    print("Enabled:", interface_data['enabled'])

    # Check if interface has IP address
    if 'ipv4' in interface_data:
        ip_info = interface_data['ipv4']['address']
        print(f"IP Address: {ip_info['ip']}")
        print(f"Netmask: {ip_info['netmask']}")
    else:
        print("No IP address configured")

R1# show ip interface brief

Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0/0   unassigned      YES unset  administratively down down
GigabitEthernet0/0/1   10.10.20.10     YES manual up                    up

# netconf_create_interface.py
# Create a new loopback interface using NETCONF edit-config

from ncclient import manager

device = {
    'host': '10.10.20.10',
    'port': 830,
    'username': 'admin',
    'password': 'Cisco123!',
    'hostkey_verify': False
}

# XML payload to create Loopback99 with IP 192.0.2.99/24
# This uses the same YANG models as Lab 3 (ietf-interfaces, ietf-ip)
config_loopback = '''
<config>
  <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
    <interface>
      <name>Loopback99</name>
      <description>Created via NETCONF</description>
      <type xmlns:ianaift="urn:ietf:params:xml:ns:yang:iana-if-type">
        ianaift:softwareLoopback
      </type>
      <enabled>true</enabled>
      <ipv4 xmlns="urn:ietf:params:xml:ns:yang:ietf-ip">
        <address>
          <ip>192.0.2.99</ip>
          <netmask>255.255.255.0</netmask>
        </address>
      </ipv4>
    </interface>
  </interfaces>
</config>
'''

# Connect and apply configuration
with manager.connect(**device, device_params={'name': 'iosxe'}) as m:
    print("Creating Loopback99 via NETCONF...")

    # Send edit-config RPC to modify running configuration
    # target='running' means apply directly to running-config
    # operation='merge' means merge with existing config (don't replace)
    netconf_reply = m.edit_config(
        target='running',
        config=config_loopback
    )

    # Check if operation succeeded
    if "<ok/>" in netconf_reply.xml:
        print("OK: Interface created successfully!")
        print("\nYou can verify with CLI command:")
        print("  show ip interface brief | include Loopback99")
    else:
        print("ERROR: Operation failed")
        print(netconf_reply)

python netconf_create_interface.py

Creating Loopback99 via NETCONF...
OK: Interface created successfully!

You can verify with CLI command:
  show ip interface brief | include Loopback99

<config>                                                    <!-- Root element for edit-config -->
  <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">  <!-- YANG module namespace -->
    <interface>                                             <!-- Creates one interface -->
      <name>Loopback99</name>                              <!-- Interface name (key field) -->
      <description>Created via NETCONF</description>       <!-- Optional description -->
      <type xmlns:ianaift="urn:ietf:params:xml:ns:yang:iana-if-type">  <!-- Interface type namespace -->
        ianaift:softwareLoopback                          <!-- Loopback interface type -->
      </type>
      <enabled>true</enabled>                              <!-- no shutdown (up) -->
      <ipv4 xmlns="urn:ietf:params:xml:ns:yang:ietf-ip">  <!-- IPv4 config (nested, different YANG module) -->
        <address>                                          <!-- IP address list -->
          <ip>192.0.2.99</ip>                             <!-- IP address -->
          <netmask>255.255.255.0</netmask>                <!-- Subnet mask -->
        </address>
      </ipv4>
    </interface>
  </interfaces>
</config>

{
  "ietf-interfaces:interface": {
    "name": "Loopback99",
    "description": "Created via RESTCONF",
    "type": "iana-if-type:softwareLoopback",
    "enabled": true,
    "ietf-ip:ipv4": {
      "address": [
        {
          "ip": "192.0.2.99",
          "netmask": "255.255.255.0"
        }
      ]
    }
  }
}

R1# show ip interface brief | include Loopback99

Loopback99             192.0.2.99      YES manual up                    up

R1# show running-config interface Loopback99

interface Loopback99
 description Created via NETCONF
 ip address 192.0.2.99 255.255.255.0
end

R1# show ip interface Loopback99

<config>
  <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
    <interface xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" nc:operation="create">
      <name>Loopback100</name>
      <type xmlns:ianaift="urn:ietf:params:xml:ns:yang:iana-if-type">ianaift:softwareLoopback</type>
      <enabled>true</enabled>
    </interface>
  </interfaces>
</config>

# netconf_modify_interface.py
# Modify an existing interface using NETCONF edit-config with merge

from ncclient import manager

device = {
    'host': '10.10.20.10',
    'port': 830,
    'username': 'admin',
    'password': 'Cisco123!',
    'hostkey_verify': False
}

# XML payload to modify only the description
# Using operation="merge" (default) to update specific fields
config_modify = '''
<config>
  <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
    <interface>
      <name>Loopback99</name>
      <description>Modified via NETCONF - Lab 4</description>
    </interface>
  </interfaces>
</config>
'''

with manager.connect(**device, device_params={'name': 'iosxe'}) as m:
    print("Modifying Loopback99 description via NETCONF...")

    # edit-config with merge operation (default)
    # This updates only the fields specified (description)
    # Other fields (IP address, enabled) remain unchanged
    netconf_reply = m.edit_config(
        target='running',
        config=config_modify
    )

    if "<ok/>" in netconf_reply.xml:
        print("OK: Interface description updated successfully!")
        print("\nVerify with CLI:")
        print("  show running-config interface Loopback99")
    else:
        print("ERROR: Operation failed")
        print(netconf_reply)

python netconf_modify_interface.py

# netconf_add_secondary_ip.py
# Add a secondary IP address to Loopback99

from ncclient import manager

device = {
    'host': '10.10.20.10',
    'port': 830,
    'username': 'admin',
    'password': 'Cisco123!',
    'hostkey_verify': False
}

# Add secondary IP address 192.0.2.100/24
# The merge operation adds to the existing address list
config_secondary = '''
<config>
  <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
    <interface>
      <name>Loopback99</name>
      <ipv4 xmlns="urn:ietf:params:xml:ns:yang:ietf-ip">
        <address>
          <ip>192.0.2.100</ip>
          <netmask>255.255.255.0</netmask>
        </address>
      </ipv4>
    </interface>
  </interfaces>
</config>
'''

with manager.connect(**device, device_params={'name': 'iosxe'}) as m:
    print("Adding secondary IP to Loopback99...")

    netconf_reply = m.edit_config(target='running', config=config_secondary)

    if "<ok/>" in netconf_reply.xml:
        print("OK: Secondary IP added successfully!")
        print("\nVerify with CLI:")
        print("  show running-config interface Loopback99")
        print("  show ip interface Loopback99 | include Secondary")
    else:
        print("ERROR: Operation failed")
        print(netconf_reply)

R1# show running-config interface Loopback99

interface Loopback99
 description Modified via NETCONF - Lab 4
 ip address 192.0.2.99 255.255.255.0
 ip address 192.0.2.100 255.255.255.0 secondary
end

R1# show ip interface brief | include Loopback99

R1# show interfaces Loopback99

# netconf_delete_interface.py
# Delete an interface using NETCONF edit-config with delete operation

from ncclient import manager

device = {
    'host': '10.10.20.10',
    'port': 830,
    'username': 'admin',
    'password': 'Cisco123!',
    'hostkey_verify': False
}

# XML payload with operation="delete" to remove the interface
# You only need to specify the interface name (key field)
config_delete = '''
<config>
  <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
    <interface xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" nc:operation="delete">
      <name>Loopback99</name>
    </interface>
  </interfaces>
</config>
'''

with manager.connect(**device, device_params={'name': 'iosxe'}) as m:
    print("Deleting Loopback99 via NETCONF...")

    # edit-config with delete operation
    netconf_reply = m.edit_config(
        target='running',
        config=config_delete
    )

    if "<ok/>" in netconf_reply.xml:
        print("OK: Interface deleted successfully!")
        print("\nVerify with CLI:")
        print("  show ip interface brief | include Loopback99")
        print("  (should return no output)")
    else:
        print("ERROR: Operation failed")
        print(netconf_reply)

python netconf_delete_interface.py

R1# show ip interface brief | include Loopback99

R1# show running-config interface Loopback99

^
% Invalid input detected at '^' marker.

R1# show ip interface brief

<interface xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" nc:operation="remove">
  <name>Loopback99</name>
</interface>

module Cisco-IOS-XE-vlan {
  container vlans {
    list vlan {
      key "id";
      leaf id;        // VLAN number (1-4094)
      leaf name;      // VLAN name
    }
  }
}

# netconf_create_vlan.py
# Create a VLAN on Cisco 3650 switch using NETCONF

from ncclient import manager

# Switch connection parameters
device = {
    'host': '10.10.20.30',  # SW1 IP address
    'port': 830,
    'username': 'admin',
    'password': 'Cisco123!',
    'hostkey_verify': False
}

# XML payload to create VLAN 100 named "Engineering"
# Uses Cisco-specific YANG model
config_vlan = '''
<config>
  <native xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-native">
    <vlan>
      <vlan-list xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-vlan">
        <id>100</id>
        <name>Engineering</name>
      </vlan-list>
    </vlan>
  </native>
</config>
'''

with manager.connect(**device, device_params={'name': 'iosxe'}) as m:
    print("Creating VLAN 100 on switch via NETCONF...")

    netconf_reply = m.edit_config(
        target='running',
        config=config_vlan
    )

    if "<ok/>" in netconf_reply.xml:
        print("OK: VLAN 100 created successfully!")
        print("\nVerify with CLI on switch:")
        print("  show vlan brief | include 100")
    else:
        print("ERROR: Operation failed")
        print(netconf_reply)

python netconf_create_vlan.py

SW1# show vlan brief | include 100

100  Engineering                      active

SW1# show vlan brief

# netconf_get_vlans.py
# Retrieve VLAN configuration from switch

from ncclient import manager
import xmltodict
import json

device = {
    'host': '10.10.20.30',
    'port': 830,
    'username': 'admin',
    'password': 'Cisco123!',
    'hostkey_verify': False
}

# Filter for VLAN configuration
filter_vlans = '''
<filter>
  <native xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-native">
    <vlan>
      <vlan-list xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-vlan"/>
    </vlan>
  </native>
</filter>
'''

with manager.connect(**device, device_params={'name': 'iosxe'}) as m:
    print("Retrieving VLANs from switch via NETCONF...\n")

    netconf_reply = m.get_config(source='running', filter=filter_vlans)

    # Parse XML to dictionary
    xml_dict = xmltodict.parse(netconf_reply.xml)

    # Navigate to VLAN list
    vlan_list = xml_dict['rpc-reply']['data']['native']['vlan']['vlan-list']

    # Print VLAN information
    print("VLANs configured on switch:")
    print("-" * 40)

    # Handle single VLAN (dict) vs multiple VLANs (list)
    if isinstance(vlan_list, list):
        for vlan in vlan_list:
            print(f"VLAN {vlan['id']}: {vlan.get('name', 'default')}")
    else:
        # Only one VLAN configured
        print(f"VLAN {vlan_list['id']}: {vlan_list.get('name', 'default')}")

Retrieving VLANs from switch via NETCONF...

VLANs configured on switch:

----------------------------------------
VLAN 1: default
VLAN 100: Engineering

SW1# show vlan brief

with manager.connect(**device) as m:
    # Lock candidate
    m.lock(target='candidate')

    # Make changes to candidate
    m.edit_config(target='candidate', config=xml_config)

    # Validate
    m.validate(source='candidate')

    # Commit to running
    m.commit()

    # Unlock
    m.unlock(target='candidate')