NETCONF

A NETCONF client connects to TCP port 830, authenticates over SSH, opens an SSH session channel and requests the subsystem named "netconf". The subsystem hands the channel straight to the NETCONF server, so no shell prompt or login banner corrupts the XML stream.

SNMP was designed for cheap polling of counters and status, and standard MIB modules rarely expose writable configuration; NETCONF was designed for configuration, with full-configuration retrieval, staged and validated edits, an all-or-nothing commit and a YANG schema.

Edits to the candidate change nothing on the device. <validate> checks the candidate, <commit> sets running to the candidate's entire contents, and <discard-changes> throws the edits away by resetting the candidate to running.

A NETCONF <lock> gives one session exclusive write access to a whole datastore until it unlocks or its session ends; other sessions, SNMP and CLI cannot change it, and a competing <lock> fails with lock-denied naming the holder's session-id.

<get-config> returns only configuration data from a named datastore such as running, candidate or startup; <get> returns the running configuration plus read-only state such as counters. A backup job should call <get-config>, so the archive holds only restorable data.

The request used replace: an operation="replace" attribute on the interface entry, or default-operation replace. Replace makes the sent data the whole entry, so the omitted description is deleted; merge, the default, would have changed only the MTU.

Each NETCONF peer sends a <hello> listing its capabilities as soon as the session opens, without waiting for the other. They use the highest base protocol version both list, or stop; only the server's hello carries the <session-id>.

YANG 1.0 modules appear in the NETCONF hello as capability URIs carrying module, revision, features and deviations parameters. YANG 1.1 moved the list into the ietf-yang-library data, read with <get>; the hello carries only an identifier that changes when that list does.

Send <get> (counters are state data, which <get-config> never returns) with a subtree filter: interfaces and interface as containment nodes, name with the text eth0 as a content-match node, and an empty statistics element as a selection node.

A confirmed commit applies the candidate but reverts running to its prior state unless a confirming <commit> arrives within confirm-timeout (600 seconds by default); it also reverts at once if the issuing session drops, unless <persist> was set.

With :startup, the device boots from a separate startup datastore, and changes to running are not copied there automatically. Persist a change with <copy-config> from running to startup, ideally after testing it.

The candidate is a scratch pad every session may share, and <commit> publishes all of it; locking candidate keeps other sessions' edits out of your commit, and locking running stops anyone changing or committing to running until you finish.

Automation should branch on error-tag, a fixed string from RFC 6241's Appendix A such as data-exists or invalid-value, refined by error-app-tag, and locate the problem with error-path. error-type gives the layer; error-message is for humans.

The ]]>]]> delimiter assumed that sequence never occurs in well-formed XML, but it can, inside attributes, comments or processing instructions. Chunked framing length-prefixes each chunk instead. Hellos always end with ]]>]]>; chunked framing follows only when both hellos list :base:1.1.

SMIv2 describes scalar objects arranged into conceptual tables, with writability as an access level. YANG describes nested configuration trees, marks configuration apart from state, and states constraints and references that the server must enforce before a change is accepted.

The client reads the schemas list of the ietf-netconf-monitoring module (RFC 6022) with <get>, then sends <get-schema> with the module's identifier, ideally its version, and format yang; the reply's <data> holds the module text.

On the :candidate router you stage the change in pieces, validate, and commit it in one step. On the running-only router every <edit-config> is live and must leave running valid, so send the change as one edit after checkpointing running.

The pipeline takes the holder's session-id from lock-denied, confirms through NETCONF monitoring that the session is really stale, and sends <kill-session>; that releases the lock but does not roll back edits the dead session already made to running.

delete fails with data-missing when the node is absent; remove deletes it if present and is ignored otherwise, so a retried cleanup stays quiet. default-operation none stops the request's ancestors being merged; they only locate the target.

stop-on-error, the default, aborts at the first error without promising to undo earlier edits; continue-on-error applies what it can and still replies with an error; rollback-on-error, which needs the :rollback-on-error capability, restores the target to its state before the request.

Framing must follow both hellos: chunked only if both list :base:1.1, otherwise ]]>]]>. A client that switches to chunked on the server's hello alone, or never switches, sends or expects a message end the other side never produces, so one reader waits.

A SetRequest is atomic only within one PDU on one agent, while a fleet change spans many PDUs and devices with no lock, staging or rollback. NETCONF adds per-device locks, validated candidates and self-reverting confirmed commits that an orchestrator coordinates.

When selection needs more than exact matches, such as comparisons, functions or conditions elsewhere in the tree. The server must advertise the :xpath capability; then the filter has type xpath, an empty <filter> element and the expression in a select attribute.

Lock running and candidate on each router, load and validate, then confirmed-commit everywhere, test the network, and confirm only when all pass; otherwise cancel. NETCONF gives per-device atomicity and an undo window, not a cross-device transaction.

Configure through NETCONF wherever devices support it, keep a single writer per device, and give SNMP read-only access; poll counters with SNMPv3 across the whole fleet, and accept traps or informs from legacy devices beside NETCONF notifications from the rest.

Running is what clients configured; intended is running after transformations such as template expansion, read-only and validated; operational is what the device actually uses. Configuration for a missing resource stays in running and intended but is absent from operational.

A <partial-lock> locks selected nodes of running so two managers can edit different sections at once; it protects only the nodes its XPath matched at lock time, plus their subtrees, never later-created siblings, reads, or the rest of the configuration.

With NETCONF call home (RFC 8071) the device opens the TCP connection to the manager, on port 4334 for SSH or 4335 for TLS. Only the TCP role reverses: the device remains the SSH or TLS server and the NETCONF server.

SNMP traps are unacknowledged UDP datagrams sent to configured targets; informs add acknowledgement and retransmission. RFC 5277 notifications flow only after a client subscribes, ride its reliable NETCONF session, carry an eventTime, and can be replayed from a log.