NETCONF and YANG with Python: model-driven network configuration

Why model-driven management?

CLI scraping breaks whenever output changes. Model-driven programmability replaces text with structured data that follows a published schema. Two standards sit at its heart. YANG (RFC 7950) is a data modelling language: it describes what can be configured, the types and the valid ranges. NETCONF (Network Configuration Protocol, RFC 6241) is the protocol that carries that data, encoded in XML (Extensible Markup Language), between your script and the device.

YANG models in brief

A YANG module defines a tree of containers (groups), lists (repeating entries with a key) and leaves (single values with a type). Models come from three main sources:

• IETF models, such as ietf-interfaces, which are standard and widely supported.
• OpenConfig models, written by network operators to be vendor-neutral.
• Native vendor models, which cover every platform feature but differ by vendor.

The pyang tool can print a model as a readable tree, for example pyang -f tree ietf-interfaces.yang, which is the quickest way to see the paths you need.

Datastores and operations

When a session opens, the device and client exchange capabilities, which list the supported features and YANG models. Changes are transactional: if part of an edit is invalid, the whole edit is rejected.

Using ncclient from Python

Enable NETCONF on the device first (on Cisco IOS XE the command is netconf-yang), then install pip install ncclient. This example reads interface configuration using a subtree filter, then sets an interface description.

import os
from ncclient import manager

FILTER = """
<interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
  <interface><name>GigabitEthernet2</name></interface>
</interfaces>"""

CONFIG = """
<config>
  <interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
    <interface>
      <name>GigabitEthernet2</name>
      <description>Uplink to core-sw1</description>
    </interface>
  </interfaces>
</config>"""

with manager.connect(host="192.168.10.1", port=830,
                     username=os.environ["NET_USER"],
                     password=os.environ["NET_PASS"],
                     hostkey_verify=True) as m:
    for cap in list(m.server_capabilities)[:5]:
        print(cap)
    reply = m.get_config(source="running", filter=("subtree", FILTER))
    print(reply.xml)
    m.edit_config(target="running", config=CONFIG)

Tip: hostkey_verify=True checks the device’s SSH key against your known_hosts file. Labs often turn it off, but in production it protects your credentials from being sent to an impostor.

If the device supports a candidate datastore, edit target="candidate" instead, then call m.commit(). Lock the datastore around the change so nothing else interferes. Restrict NETCONF to a management network and a dedicated account, and log its use like any other admin access. For exams, remember the port (830), the encoding (XML) and the RFCs.