What Is NETCONF?

NETCONF (Network Configuration Protocol) is a network management protocol that provides mechanisms for installing, updating, and deleting network device configurations. Defined by the Internet Engineering Task Force (IETF), NETCONF uses XML (eXtensible markup language) data encoding for configuration data and protocol messages, operating over secure transport protocols like SSH. Network administrators use NETCONF to configure and manage network infrastructure, helping in automation efforts and reducing manual configuration errors.

NETCONF allows organizations to perform network management tasks and troubleshooting, scaling management across networks that can support thousands of devices.

Conventionally, network administrators use the command line interface (CLI) and Simple Network Management Protocol (SNMP) to manage network devices. Network teams manually enter commands on specific devices with the CLI, leading to inefficiencies and errors. SNMP is a network management protocol designed for simple network management so it cannot provide the flexibility that modern, complex networks require. As an alternative to using CLI and SNMP, NETCONF standardizes network communication, reduces misconfigurations, and helps to automate network device management, using structured and readable configurations.

Network automation

NETCONF enables network administrators to automatically add, update, or delete configuration data across network devices. Additionally, a network management system can retrieve operational data from network devices without manual intervention.

Configuration consistency

The NETCONF protocol uses the YANG data modeling language to structure configuration data it sends to devices. YANG defines what the data looks like, while NETCONF moves the encoded data. This ensures that configuration data is formatted consistently across devices from different vendors.

Remote management

NETCONF operates across private and public networks over a secure connection. Therefore, network administrators can configure and monitor devices at any location.

Version control and rollback

When a device receives new configuration data, it stages the previous version in a temporary storage called the candidate datastore. Before applying the changes, the network device validates the updates to ensure they’re correct. If needed, network administrators can request that the device reverts to a previous version of configuration.

The NETCONF protocol architecture uses a four-layer model to enable the exchange of network configuration and operation data. Below, we share NETCONF protocol layers and how they support network monitoring and configuration operations.

Transport layer

The transport layer provides a secure communication path for network devices to transfer data. While NETCONF supports several transport protocols, Secure Shell (SSH) is commonly used to secure the transport layer. SSH is a computing technology that encrypts data so that it can be safely transferred on an unsecured network.

Messages layer

The message layer encodes remote procedure calls (RPCs) that the client and server exchange into XML format. Generally, NETCONF supports these RPC messages:

• <rpc> contains the request that a client sends to a server

• <rpc-reply> contains the response that a server sends to a client

• <notification> contains one-way alerts or event updates that a server sends to a client

Operations layer

The operation layer defines device-specific protocols that network operators use to configure or monitor devices. Messages for the operations layer include:

• <get> allows the client to retrieve operation data

• <get-config> allows the client to retrieve data from a specified configuration datastore.

• <edit-config> allows the client to add, update, or replace device configuration data

• <delete-config> allows the client to delete specific parameters from the target configuration datastores

Content layer

The content layer provides a transport-independent framing mechanism for encoding RPC and notification data. It consists of the structured payload that NETCONF devices send in their RPC messages.

Network Configuration Protocol (NETCONF) provides an RPC framework that clients use to communicate with servers. A remote procedure call is a computing method that allows a client to invoke software functions from servers as if they were declared locally.

A NETCONF client refers to network management software, while NETCONF servers are network devices such as routers, switches, and load balancers. In NETCONF, clients and servers exchange commands and responses using Extensible Markup Language (XML) messages. XML is a data format that allows devices to exchange data that is readable by machines and humans. Data exchange between client and server takes place across an encrypted communication channel.

When a NETCONF session is initiated, both server and client will send a message indicating their NETCONF capabilities. This is a <hello> message, which indicates the device’s NETCONF version, data models, and capabilities. Then, the client starts a NETCONF session, which allows it to make RPC requests to a specific server. Once a session is established, the client uses NETCONF operations to manage the network device associated with the server.

For example, a client can fetch configuration and operational data from devices, send configuration updates, and delete stored configuration. Some devices might support additional operations based on the advertised NETCONF capabilities.

Here is an example sequence of RPC exchanges between a NETCONF client and server.

• Client and server establish an SSH session

• Both client and server indicate their capabilities

• Client sends an <rpc> request containing a <get> operation to retrieve the device status

• Server replies with a <rpc-reply> message that contains the device status.

• Client requests to close the SSH session

• The server acknowledges the request with a response

• Client closes the SSH session

NETCONF simplifies network management across multiple network devices with these features.

XML-based encoding

NETCONF-based devices encode messages in XML format for sending and receiving information. XML is an independent file format that allows device data to be structured and represented in ways that can be easily understood. XML enables interoperability among devices from different vendors.

Separation of configuration and state data

The NETCONF architecture separates system configuration and state data through protocol operations and the data model. For example, the <get> RPC allows you to retrieve operational data while the <get-config> limits operations to configuration data. Additionally, the NETCONF architecture often uses YANG to constrain data types to their respective classes.

Transaction-based operations

NETCONF supports atomic operations when performing configuration transactions, meaning that changes are accepted only if all parameter values are updated successfully. Otherwise, the client can roll back the configuration to a previous version. For example, let’s say that you want to update 50 parameters in a sequence. If the 49th parameter contains an error, the managed device will discard all requested changes.

Candidate configuration datastore

The candidate configuration datastore stores new configuration values that have not yet been activated. This database allows temporary staging of configuration data without affecting existing network operations.

Validation capabilities

Validation capability is the network device’s ability to verify the configuration data it receives for correctness. It prevents the device from updating its configuration with data containing any errors.

NETCONF provides a set of functions that simplify management in modern networking infrastructure. Here are some of NETCONF’s key capabilities.

Device configuration management

NETCONF allows network administrators to create, merge, update, and delete configuration data on network devices. Before making changes, they can temporarily upload and validate the configuration data to ensure a seamless transition to the new configurations.

Network state retrieval

NETCONF supports efficient retrieval of operational data from network devices. A network management system can retrieve various state data, including the routing table, server statistics, and bandwidth usage, with the <get> RPC.

Event notification

If notification capability is supported, the client can configure network devices to automatically send notifications for specific alarms or events. This way, network administrators will be alerted to network changes without manual checks.

Bulk configuration changes

NETCONF supports simultaneous updates on multiple network parameters. Instead of updating one configuration value after another, you can update all the parameters with a single RPC call. To ensure data integrity, network devices validate requested updates based on specified rules and syntax before applying these changes.

SNMP is a legacy network management protocol that uses a simple agent-server approach for network monitoring. Meanwhile, NETCONF is a modern network management protocol that supports programmatic message exchange for automating monitoring and configuration.

SNMP transfers data over UDP, which doesn’t guarantee delivery, while NETCONF operates over SSH, which uses TCP, to provide reliable connection-based sessions. SNMP operates with basic security, while NETCONF encrypts data that devices send with a secure transport layer.

When retrieving operational data, SNMP relies on a special database called the Management Information Base (MIB) and Object Identifiers (OID), which vary amongst vendors, while NETCONF uses standard XML. SNMP transactions are non-atomic, which means that each piece of configuration data is immediately updated when it is processed. Conversely, NETCONF allows configuration values to be staged in a temporary storage to reduce the risks of misconfiguration.

NETCONF datastores are storage that is allocated for configuration data in network devices. NETCONF datastores store configuration data according to a structure defined by data models like YANG. Each network device has a mandatory running datastore, while some devices support additional configuration datastores such as candidate and startup. These datastores allow systematic configuration of devices with NETCONF messages.

Running configuration

A running configuration datastore consists of the device's current configuration. Only one running datastore can exist for one device.

Candidate configuration

The candidate configuration capability provides temporary storage for new configuration values. The client can update the candidate configuration datastore without impacting the device’s operation. Once the new configuration is validated, the client can commit the changes, which moves the data in the candidate datastore to the running datastore.

Startup configuration

A startup configuration datastore contains configuration data that the network device loads when powered up.

These are how network specialists apply NETCONF in modern networking use cases.

Multi-vendor network management

Managing multi-vendor networks requires consolidating differences between proprietary protocols developed by the respective manufacturers. NETCONF provides a single common network protocol that organizations can use to access standard application programming interfaces (API) on network devices.

Software-defined networking (SDN)

Software-defined networking (SDN) uses programmatic methods to decouple the control and data planes in traditional network architecture. SDN can use NETCONF to automate network configuration, including IP routing, load balancing, and firewall rules.

Network function virtualization (NFV)

Network function virtualization replaces hardware network functionality with an equivalent software component called virtualized network functions (VNFs). These VNFs can use NETCONF as a configuration framework to manage virtual or physical network devices.

Cloud network infrastructure

Provisioning network resources in the cloud requires flexibility, scalability, and automation that legacy methods like SNMP and the CLI can’t provide. Instead, NETCONF can provide the foundation for managing network infrastructure at scale in public, private, or hybrid cloud environments.

AWS offers solutions to help manage and automate NETCONF-based devices and network infrastructure at scale:

Amazon Virtual Private Cloud (Amazon VPC) allows you to define and launch AWS resources in a logically isolated virtual network. Amazon VPC gives you full control over your virtual networking environment, including resource placement, connectivity, and security.

AWS Network Firewall helps you protect your Amazon VPCs with automated, intelligence-driven network security. You can create granular rules to control traffic, automatically block active threats using AWS-managed rules powered by Amazon threat intelligence.

AWS Transit Gateway connects your Amazon Virtual Private Clouds (VPCs) and on-premises networks through a central hub. Transit Gateway acts as a highly scalable cloud router where each new connection is made only once.

Get started with network automation on AWS by creating a free account today.