← Back to Lab Index
Lab 17 §5.3.c §5.3.d Expert ⏱ 60 min

NETCONF/YANG & RESTCONF — IOS XE API

Interact with IOS XE via NETCONF/YANG using ncclient and RESTCONF using Python requests. Configure model-driven telemetry.

Network Topology
MPLS CORE + PE EDGE DMVPN WEST DMVPN EAST CUSTOMER EDGE + BORDER CORE-1 10.255.1.1 CORE-2 10.255.1.2 CORE-3 10.255.1.3 CORE-4 10.255.1.4 EDGE-1 10.255.2.1 EDGE-2 10.255.2.2 EDGE-3 10.255.2.3 EDGE-4 10.255.2.4 HUB-WC-1 172.16.10.254 HUB-WC-2 172.16.10.253 HUB-EC-1 172.16.20.254 HUB-EC-2 172.16.20.253 SPK-WC-1 .10.1 SPK-WC-2 .10.2 SPK-WC-3 .10.3 SPK-EC-1 .20.1 SPK-EC-2 .20.2 SPK-EC-3 .20.3 BORDER-1 10.255.3.1 BORDER-2 10.255.3.2 CE-CORP-1 10.255.6.1 CE-CORP-2 10.255.6.2 P Router (CORE) PE Router (EDGE) DMVPN Hub DMVPN Spoke Border (ASBR) Customer Edge (CE) AS 65000 — OSPF Area 0 — LDP

Prerequisites

Task Sheet — CCIE Exam Format

Task 1Medium
Enable NETCONF and RESTCONF on CORE-1: 'netconf-yang', 'restconf'. Verify ports: NETCONF TCP 830, RESTCONF HTTPS 443.
✓ Verify: show platform software yang-management process
Task 2Hard
Using Python ncclient, connect to CORE-1 and retrieve running configuration via NETCONF get-config RPC. Print XML response.
✓ Verify: python3 netconf_restconf_example.py
Task 3Hard
Using Python requests, perform a RESTCONF GET to retrieve all interfaces: GET /restconf/data/ietf-interfaces:interfaces
✓ Verify: curl -k -u admin:Lab@2024#EI https://10.255.1.1/restconf/data/ietf-interfaces:interfaces
Task 4Hard
Using RESTCONF PUT, configure Loopback99 with IP 10.255.99.1/32 and IPv6 2001:db8:ff:99::1/128.
✓ Verify: show interface Loopback99
Task 5Expert
Configure model-driven telemetry subscription via NETCONF: subscribe to OSPF neighbor state changes, push to collector 10.10.1.100:57500 via gRPC.
✓ Verify: show telemetry ietf subscription all
Task 6Expert
Verify telemetry using 'show telemetry internal connection' and confirm gRPC connection established.
✓ Verify: show telemetry internal connection

Key Concepts

NETCONF (RFC 6241) is an XML-based protocol for network configuration, running over SSH (port 830). YANG (RFC 6020/7950) defines the data models. NETCONF operations: get-config (read), edit-config (write), get (operational data). The ncclient Python library handles the SSH/NETCONF session, XML namespaces, and RPC envelope.

RESTCONF (RFC 8040) provides a REST API over HTTPS using JSON or XML encoding. It uses standard HTTP methods: GET (read), PUT (replace), PATCH (merge), POST (create), DELETE (remove). The base URL is /restconf/data/{module}:{container}/{list}={key}. Content-Type must be 'application/yang-data+json' or +xml.

Model-driven telemetry (MDT) pushes operational data from the router to a collector at configurable intervals or on change, using gRPC transport. Unlike SNMP polling (pull), MDT is push-based, reducing collector load and providing faster visibility. The 'on-change' subscription type sends data only when a YANG leaf value changes — ideal for event-driven monitoring.

Verification Commands

show platform software yang-management process
NETCONF: Running, RESTCONF: Running
curl -k -u admin:Lab@2024#EI https://10.255.1.1/restconf/data/ietf-interfaces:interfaces -H 'Accept: application/yang-data+json'
JSON response with interface list
show telemetry ietf subscription all
Subscription 101: Valid, gRPC transport
show telemetry internal connection
Connection to 10.10.1.100:57500 — Established

Common Mistakes & Troubleshooting

NETCONF connection refused

Verify 'netconf-yang' is in running config. Check port 830 not blocked by ACL. NETCONF requires 'aaa new-model' and a local user with privilege 15.

RESTCONF 401 Unauthorized

Basic auth must use correct credentials. Verify 'restconf' in config. Check 'ip http secure-server' is enabled. SSL certificate warning is expected in lab — use 'verify=False' in Python requests.

Telemetry not streaming

Verify gRPC collector is running and reachable. Check 'show telemetry internal connection' for errors. Some IOS XE versions require 'ip http client source-interface' for telemetry to source correctly.

Solution Configs

Attempt the tasks yourself before viewing solutions.
Type SOLUTION to unlock.

Python Script

# See netconf_restconf_example.py in this lab folder
Study Timer
45:00
CCIE EI v1.0 Blueprint: §5.3.c §5.3.d  ·  ← All Labs  ·  Independent study resource. Not affiliated with Cisco Systems, Inc.
⬇ Initial Configs — Load These to Start the Lab
⬇ EDGE-1-initial.cfg
Solution Configs — Reveal After Completing Tasks
Complete the tasks above, then check the solution configs folder after git clone.

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.