NETCONF, ncclient and Network Automation

I my last blog post I had discussed various network management protocols and promised that I will try to experiment with ncclient. ncclient is a Python library you need as a NETCONF client to communicate with a NETCONF server in this instance it will be an instance of Cisco CSR1000v.

The whole process is very straight forward.. in brief

  1. A Ubuntu Server instance ( could also be a Windows server/Workstation)
  2. Python install and configured (all instances of Ubuntu server have Python installed by default)
  3. ncclient installed and configured
  4.  NETCONF enabled on network device (HP, Cisco, Juniper and other supported)

My not so beefy laptop (8GB RAM and intel i5) but powerful enough to run VMware WorkStation with Ubuntu Server and Cisco CSR1000v instance

CSR1000V  VMware Workstation Settings


The Network Adapter corresponds to the GigabitEthernet1 Interface on the router

interface GigabitEthernet1
ip address
negotiation auto

Enable SSH and NETCONF access on the router

TEST_CSR#conf t
TEST_CSR(config)# ip ssh rsa keypair-name sshkeys
TEST_CSR(config)# crypto key generate rsa usage-keys label sshkeys modulus 1024
TEST_CSR(config)# ip ssh timeout 120
TEST_CSR(config)# ip ssh version 2

TEST_CSR(config)# netconf ssh

Ubuntu server NIC interface configured with an address of

Ping from the server – Success !!!

The next item on the agenda was to set up the ncclient.  Please follow the well explained instructions documented here.  Thanks for your help guys.

Cisco CSR1000v, and ncclient setup completed…

Get Device Config

>>> cisco_manager = manager.connect(host='',
... port=22,
... username='cisco',
... password='cisco',
... hostkey_verify=False,
... device_params={'name': 'csr'},
... allow_agent=False,
... look_for_keys=False
... )

Connection established.

RPC call requesting running configuration

>>> c = cisco_manager.get_config(source='running')

Print output on terminal console

>>> c

<?xml version=”1.0″ encoding=”UTF-8″?><rpc-reply message-id=”urn:uuid:e147c6d6-cebf-11e5-afac-000c29e6c046″ xmlns=”urn:ietf:params:netconf:base:1.0″>

! Last configuration change at 23:55:29 UTC Mon Feb 8 2016
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
no platform punt-keepalive disable-kernel-core
platform console virtual
hostname TEST_CSR




Small step hopefully in right direction.. I will try few other NETCONF options .. stay tuned.



SNMP, NETCONF, YANG, RESTCONF and Network Automation

In the past life as a network engineer, when working on a large deployment, I have relied on the Excel spreadsheet with macros to generate configuration files.  Copy and Paste – Job done.  Any change in the script, I had to re-run the whole process and trust me it was not fun.

Network monitoring software like HP OpenView and CiscoWorks, offered limited functionality around automation as they were primarily used for monitoring and configuration management.  Depending on the complexity of the change to be applied, using a combination of UNIX shell and Python scripts I have managed to get my way around.

I have always wanted to understand what was missing in the current management tools and what is coming down the line and now that every other technology is now a Software Defined (SD) something including Network, WAN, DC..its time that I dig deeper.  This blog will be an overview of the technologies and follow up getting started with NETCONF and YANG in the next few week.


A Simple Network Management  Protocol (SNMP) that can be used to configure and retrieve variables on a device.  MIB – A Management Information Base that defines all data managed by SNMP.

  • Transport over UDP
  • Stateless
  • Unable to backup and restore element
  •  Operations
    • GET
    • GET-NEXT
    • SET
    • TRAP ….

SNMP has been around for a long time and can also be used to configure variable on a device.  To Add VLAN requires a quite a few steps, and you would think, it will be easier to login to each switch/router and make that change and maybe this complexity is the reason why SNMP is rarely used for configuring devices.

A comprehensive list of shortcomings with SNMP discussed at the Network Management workshop in 2002 can be found here SNMP Framework Discussion


RFC 4741  The Network Configuration Protocol (NETCONF) provides mechanisms to install, manipulate, and delete the configuration of network devices. It uses an Extensible Markup Language (XML)-based data encoding for the configuration data as well as the protocol messages. The NETCONF protocol operations are realized on top of a simple Remote Procedure Call (RPC) layer.

  • Designed to be as a replacement for CLI
  • Transported over SSH (TCP)  and stateless
  • Service and Network management
  • Supports network wide transactions
  • Consistency check built in
  • Named data stores ex – Startup, Running, File/URL’s
  • Distinction between configuration and state data
  • XML Payload – Modelled in YANG

NETCONF can be conceptually partitioned into four layers:



As defined in the RFC 6020 YANG is a data modeling language used to model configuration and state data manipulated by the Network Configuration Protocol (NETCONF), NETCONF remote procedure calls, and NETCONF notifications.

YANG is a language used to model data for the NETCONF protocol. A YANG module defines a hierarchy of data that can be used for NETCONF- based operations, including configuration, state data, Remote Procedure Calls (RPCs), and notifications. This allows a complete description of all data sent between a NETCONF client and server

YANG is to NETCONF as MIB is to SNMP.

Next blog will be an attempt to setup ncclient and extract configuration from a network device. Fingers crossed..


RESTCONF is still a “work in progress” as defined “draft-ietf-netconf-restconf-05”.  

The NETCONF protocol defines configuration datastores and a set of Create, Retrieve, Update, Delete (CRUD) operations that can be used to access these datastores. The YANG language defines the syntax and semantics of datastore content, operational data, protocol operations, and event notifications. RESTCONF uses HTTP operations to provide CRUD operations on a NETCONF datastore containing YANG defined data

The one good point in and when its is standard if have some knowledge of HTTP operations this quote from the text will bring a smile “Since NETCONF protocol operations are not relevant,the user should not need any prior knowledge of NETCONF in order to use RESTCONF”

Both in Open Source world with OpenDaylight Foundation controller and Cisco commercial Cisco Open SDN Controller, NETCONF and RESTCONF are well on it way being integral part of the offerings.  Time will tell on as to when these products are widely adopted.