- edited This chapter describes how to configure the HTTP-based Representational State Transfer Configuration Protocol (RESTCONF). and password you created into the Username and Password blank. As a reminder from the top of the blog, I am not intending to teach YANG thoroughly, but to give enough understanding that you could take the information and interface with the RESTCONF efficiently. They work as a group. A thorough explanation of YANG. Ive not looked at any other vendor besides Cisco, but the Cisco native models are very extensive, complex, and can basically perform any router task youd like. Note the key of namebelow: This gives us all the building blocks of the URL below. Cisco IOS XE Everest 16.11.1. aaa authentication login default group group-name local. In Cisco IOS XE Fuji 16.9.2, this feature was implemented on the following platforms: Cisco Catalyst 9200 and 9200L Series Switches. Additionally: The debugs on the router are near useless. Enable the Cisco IOS-HTTP services for RESTCONF. RESTCONF on a Cisco device, An elegant way to implement RESTCONF on a Cisco RESTCONF. I have found the GET differences on both IETF and Cisco Native models to be considerably different between virtual platforms and physical platforms. This blog has focused entirely on read-write configuration. The YANG model were looking for is actually in ietf-ip.yang. LetspauseandtalkaboutdatatypesforamomentThese are definitions to be familiar with for the purpose of this article. The paper includes topics from all days of the programmability and automation lifecycle pictured below. permit {host-address | host-name | any} [wildcard]. RADIUS or TACACS+ users defined with privilege level 15 access are allowed access into the system. Understanding YANG at a high-level is necessary to use NETCONF. to the configured ACLs are not allowed to access the NETCONF or RESTCONF subsystems. One of the It has an edit operation ("create", "delete", "insert", "merge", "move", "replace", or "remove") that is applied A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass NETCONF or RESTCONF authentication and do either of the following: Install, manipulate, or delete the configuration of an affected device Cause memory corruption that results in a denial of service (DoS) on an affected device . However, on 17.2.1, all the Cisco native YANG files combined are approximately 300,000 lines long. file (ietf-interfaces.yang). netconf-yang ssh {{ipv4 | ipv6 }access-list name access-list-name} | port port-number}. You could re-use the same code against Cisco, Juniper, Arista, etc, and end up with the same outcome on all of them. Remote Procedure Call (RPC) operations and events, defined in the YANG model. Address/Mask Next Hop Intf. Ill explain more on that different behavior later in the article.Youre also going to need Postman: https://www.postman.com/Why Postman? aaa authorization exec default group group-name local. Installation varies slightly from Linux distro to distro, but the basics are simple:jeff@linuxlab:~$ pip install pyang, pyang does more than Im going to cover here, but what we basically want it for is to summarize YANG files in tree format (as well as help with augments), Our initial usage of pyang will be:pyang -f tree . RESTCONF. Prerequisites for the RESTCONF Protocol Restrictions for the RESTCONF Protocol Additional References for the RESTCONF Protocol Debugs are turned on with: csr1k#debug restconf level debug. request sent via HTTPS is first received by the NGINX proxy web serve,r and the request is transferred to the confd web server Experimenting w/ IOS-XE 16.5.1 on a CSR & have attempted to query the RESTCONF API. Thats researching this article, I read some unbelievably good deep-dives of YANG, but A YANG-formated RPC invokes XML encoding is used in this example. Next, Sets conditions in an IP/IPv6 access list that will permit packets. Unless noted otherwise, Exits global configuration mode and returns to privileged EXEC mode. RESTCONF Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. automation. Once here, uncheck the default Accept header: Create a new Accept header at the bottom specifying application/yang-data+json: Press Send again, and the output should now return in JSON: Ill proceed with using JSON from here on out of personal preference. Having a hard time getting the information is needed. This is where YANG gets trickier to decipher. However, the Cisco native models have a representation of all standard configuration. in the actual files. Requirements is more likely what the YANG developers intended, but takes some patience and a One benefit is pyang is smart enough to process the augment in ietf-ip and insert it into the correct spot in the ietf-interfaces tree. The competing technology was SNMP-based. The following table shows how the RESTCONF operations relate to NETCONF protocol operations: A RESTCONF device determines the root of the RESTCONF API through the link element: /.well-known/host-meta resource that contains If that seems like a lot to absorb, Ill break it all down in greater detail later in the article. Required fields are marked *, You may use these HTML tags and attributes:

, Someone will be in touch to answer your questions. and apply the following configuration commands: ip route 10.122.68.112 255.255.255.255 VirtualPortGroup0. You can configure an IPv4 or IPv6 access control list (ACL) for NETCONF and RESTCONF sessions. The HTTPS-based RESTCONF protocol (RFC 8040), is a stateless protocol that uses secure HTTP methods to provide CREATE, READ, Crossconnect and Cisco wireless solutions go hand in hand. /restconf/data/ = This path will be specified for RESTCONF config data. urn:ietf:params:restconf:capability:yang-patch:1.0, show platform software yang-management process monitor, show platform software yang-management process, Feature Information for the RESTCONF Protocol, Authentication of NETCONF/RESTCONF Using AAA, Enabling Cisco IOS HTTP Services for RESTCONF, Configuration Examples for the RESTCONF Protocol, Example: Configuring the RESTCONF Protocol, Additional References for the RESTCONF Protocol. Something to note: The body is irrelevant in this type of request. A YANG-Patch is identified by a unique patch-id. It provides Transport Layer Security (TLS)-based HTTPS. In this post I'll show how to use Cisco's native YANG model to modify static IP routes. 2022 Cisco and/or its affiliates. streaming, see the GitHub respository, and view *-oper in the naming convention. Sets conditions in an IPv6 access list that will permit packets. locate that particular resource to take an action specified by an HTTPS method or property. This white paper is designed to be read either as a . For example: Methods are HTTPS operations (GET/PATCH/POST/DELETE/OPTIONS/PUT) performed on a target resource. With that covered, back to pyang.As I mentioned above, pyang only runs in Linux, so back to your Linux box! Lets start by trying to find BGP. A well-written script and an API can do in minutes what a human would take hours to perform, and at the cost of zero man-hours. meant to be both read and write, but the write element never gained wide This module describes the service-levels ACLs supported on NETCONF and RESTCONF, and how to configure it. NGINX is an internal webserver that acts as a proxy webserver. Now we just need to see them both in the same tree. Make sure there are no gaps in your Palo Alto infrastructure with a Best Practice Assessment. End with CNTL/Z., Youll also need a local user thats privilege 15:csr1k(config)#username cisco priv 15 secret cisco123, Now, lets load up Postman and see if we cant get restconf to do something. Exits IPv6 access list configuration mode and returns to global configuration mode. education. To receive security and technical information about your products, you can subscribe to various services, such as the Product Compare to the prior screenshot of pyang that didnt have the ipv4 tree information in it. NOTE:Its worth mentioning that Cisco has tools available that are potentially more powerful for these particular operations than pyang is. read as the Cisco native ones. Specifies a standard IP access list and enters standard access-list configuration mode. Since were also going to be using a tool that only Prerequisites for the RESTCONF Protocol Restrictions for the RESTCONF Protocol Additional References for the RESTCONF Protocol Lets take a look in ietf-interfaces and try and gain some basic understanding. The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and The following example shows that the Loopback 1 is inserted after Loopback 0: The following example shows Loopback 1 is moved before Loopback 0: NETCONF and RESTCONF connections must be authenticated using authentication, authorization, and accounting (AAA). Programmability Configuration Guide, Cisco IOS XE Amsterdam 17.1.x, View with Adobe Reader on a variety of devices, View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone, View on Kindle device or Kindle app on multiple devices. Clients that do not conform The nginx process gets restrated and DMI process are started, when the restconf command is configured. You can configure an access control list (ACL) for NETCONF and RESTCONF sessions. In Cisco jeff@linuxlab:~/yang/vendor/cisco/xe/1721$ pyang -f tree Cisco-IOS-XE-native.yang tree-depth=3 > native.out jeff@linuxlab:~/yang/vendor/cisco/xe/1721$ vi native.outSearch for bgp. Exits line configuration mode and returns to privileged EXEC mode. This feature was implemented on the following platforms: Cisco 4000 Series Integrated Services Routers, Cisco ASR 1000 Aggregation Services Routers (ASR1000-RP2, ASR1000-RP3, ASR1001-HX, ASR1001-X, ASR1002-HX, ASR1002-X). So, if you want to replicate my results be sure youre on the CSR1K. The documentation set for this product strives to use bias-free language. to the target resource. technical issues with Cisco products and technologies. Cisco Developer and DevNet enable software developers and network engineers to build more secure, better-performing software and IT infrastructure with APIs, SDKs, tools, and resources. Clients that do not conform to the configured ACL are not . As shown in this article you can use the RESTCONF protocol to simplify and manage network configurations and operational features. The first, and from my understanding, the original, is the IETF. Yang Suite is brand new, as in it launched while I was typing this document. ACL are not allowed to access the NETCONF or RESTCONF subsystems. RESTCONF supports YANG-Patch media type as specified by RFC 8072. Please note the user that is authenticating must have previlage 15. actually been around quite a long time the RFC was published in 2006. itself outside of why we trimmed the URL. To make things even more interesting I'll use RESTCONF, an HTTP-based sibling of NETCONF. Navigating RESTCONF for Cisco Network Engineers, https://www.openconfig.net/projects/models/, https://your-ip-address/restconf/data/Cisco-IOS-XE-native:native, https://10.200.200.100/restconf/data/Cisco-IOS-XE-native:native/banner/exec, https://github.com/CiscoDevNet/yang-explorer, https://your-router-ip/restconf/operations, The cliff notes version of the pyang tool, A quick & dirty way to implement working Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Can we fully switch to API for managing our devices, or do we have to expect that some percentage of configuration cannot be done via API? Important Note: For some preliminary understanding, its not possible to configure the router in its completion with the IETF models or Openconfig models. csr_mgmt Activated iosxe-remote-mgmt.03.16.04a.S.155-3 and apply the following configuration commands: ! You can either configure an IP access list or an IPv6 access list for your RESTCONF session. While trying to edit a file, the first edit already exists and an error is reported. However; DMI proceses are not enabled. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. YANG is a hierarchical language, built in a tree-format, that defines in a readable format the generalized models required to configure a network. the running configuration, the command will be replaced by this request. Tree-depth limits how deep the tree is displayed. Building off this example, Ive grabbed the JSON contents of it and modified one field the IP address from .102 in the fourth octet to .103. The unique identifier is the Key, defined in the list. The CLI was written for humans to interpret. While its great that its human-readable, 300,000 lines is not a readable length, summarization is necessary. Ive also enabled the interface. Parameters Notes Note This module requires the RESTCONF system service be enabled on the remote device being managed. Lets say our goal is to turn up the BGP process and add a neighbor. Note Ive asked pyang to create a tree for both ietf-interfaces.yang and ietf-ip.yang simultaneously. The YANG models used are identical between NETCONF and understanding of YANG is needed. RESTCONF is a IETF standard and documented on RFC 8040. wrap your head around, but its really not too bad. There are two strategies The key to the list is name, which must be unique, so that it can be independently referenced, modified, or deleted.Each element equals one line of configuration in IOS: The BGP example is also a good one, where a list can create more than one line of IOS configuration. Although just recently gaining traction, NETCONF has works in Linux, youll need yourself a Linux box or VM from here on in. for further syntax/semantics check. Configures a IP address and encryption key for a private RADIUS server. All the samples Ive pasted above have had a rw next to them for read/write as my blog focus was about creating configuration, but theres a whole side of this just for programmatically monitoring statuses. Again, Im using v17.2.1. Hello guys,i'm trying to enable restconf on a CSR1000v (03.16.03), but the service has not yet enabled. RESTCONF provides a programmatic interface based on standard mechanisms for accessing configuration data, state data, data-model-specific Remote Procedure Call (RPC) operations and events, defined in the YANG model. interface VirtualPortGroup0 ip unnumbered GigabitEthernet4 ! All rights reserved. A deep dive of REST. I send following request: But if i show the running configuration, i can see that there are PoE configurations on the interface that are not shown in the API output: Is this part of the configuration found on some other path? Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Ensure that the logging monitor command is not availabel in the running configuration. Change the POST to DELETE. It doesnt matter. IOS XE Fuji 16.8.1 and later releases, operational data works on platforms running NETCONF (similar to how configuration data Much detail on NETCONF. Use these resources to familiarize yourself with the NSO Developer community: Customers Also Viewed These Support Documents, Free NSO training material - Introduction, Itential Automation Platform (Solution Plus Partners), Accedian Skylight (Solution Plus Partners). For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Specifies that no authentication is required while logging into a system. For more information, see RFC 8040 - RESTCONF Protocol. Adds the RADIUS server and enters server group RADIUS configuration mode. deny {protocol-number | ipv6-source-address | ipv6-source-prefix | protocol}any 12:29 PM First, since well be using TLS, you need an encryption key: csr1k#crypto key generate rsa, Then youll need to enable the secure HTTP server and setup local authentication:csr1k#conf t, Enter configuration commands, one per line. there is no session to keep that kind of data flowing. Ensures that session identification (ID) information that is sent out for a given call will be made identical. Feature Information for NETCONF and RESTCONF Service-Level ACLs, Information About NETCONF and RESTCONF Service-Level ACLs, Overview of NETCONF and RESTCONF Service-Level ACLs, How to Configure NETCONF and RESTCONF Service-Level ACLs, Configuring an ACL for a NETCONF-YANG Session, Configuring an ACL for a RESTCONF Session, Configuration Examples for NETCONF and RESTCONF Service-Level ACLs, Example: Configuring an ACL for a NETCONF Session, Example: Configuring an ACL for a RESTCONF Session, Additional References for NETCONF and RESTCONF Service-Level ACLs. YANG data models for various releases of IOS XE, IOS XR, and NX-OS platforms. An easy way to think of RESTCONF is just putting a web API on top of dynamically configure an extended access-list with CLI commands, with a Pop open ietf-interfaces.yang in your favorite text editor:jeff@linuxlab:~/yang/vendor/cisco/xe/1721$ vi ietf-interfaces.yang, ietf-interfaces.yang is one of the smallest major YANG files, but its still 725 lines long. NETCONFs XML interface by optionally offering JSON as a data format (XML can This table lists While Some quick intro knowledge is that there are several different creators of YANG models. When I first started on this topic, I was hoping for a translation of RESTCONF into CLI to show what was actually going on behind the scenes, but no such luck. NETCONF/RESTCONF + YANG are to take those same tasks and make them more In the body, change the name to Loopback and a number of your choosing, change type to softwareLoopback, change the IP address to something that doesnt overlap with other interfaces, and (optionally) change your netmask to a /32. The IETF files are some of the easiest to interpret via Programmability Configuration Guide, Cisco IOS XE Dublin 17.10.x, View with Adobe Reader on a variety of devices, View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone, View on Kindle device or Kindle app on multiple devices. Postman allows you to interact with a REST API without writing any code.Assuming you have those things running, lets make RESTCONF do something. develop strategies to understanding creating the body. Following configuration changes are supported: Hostname Interface OSPF BGP Currently there is only Cisco Native support. The server-name argument specifies the RADIUS server group name. Think about a BGP neighbor state, or an interface error count things you wouldve perhaps previously monitored with SNMP. Here is the link for download. this back to our earlier example: Ill show this in a better visual when we get to demoing pyang. Now that weve confirmed that RESTCONF is running on the router and shown how to change to JSON output, lets do a few more simple interactions to show what were trying to accomplish here.I want to specifically call out that my next examples are on a CSR1K. That Find answers to your questions by entering keywords or phrases in the Search bar above. Sounds great, right? Learn more about how Cisco is using Inclusive Language. Enables the RESTCONF interface on your network device. GigabitEthernet0/0/2 - https://10.104.50.97/restconf/data/Cisco-IOS-XE-native:native/interface/GigabitEthernet=0%2F0%2F2, fields=name https://10.104.50.97/restconf/data/Cisco-IOS-XE-native:native/interface/GigabitEthernet=0%2F0%2F2?fields=name, depth=1 - https://10.85.116.59/restconf/data/Cisco-IOS-XE-native:native/interface/GigabitEthernet?depth=1, Name and IP - https://10.85.116.59/restconf/data/Cisco-IOS-XE-native:native/interface?fields=GigabitEthernet/ip/address/primary;name, MTU (fields) - https://10.104.50.97/restconf/data/Cisco-IOS-XE-native:native/interface?fields=GigabitEthernet(mtu), MTU - https://10.85.116.59/restconf/data/Cisco-IOS-XE-native:native/interface/GigabitEthernet=3/mtu, Port-Channel - https://10.85.116.59/restconf/data/Cisco-IOS-XE-native:native/interface/Port-channel, Char to Hex conversion chart: http://www.columbia.edu/kermit/ascii.html. Enter configuration commands, one per line. Your email address will not be published. This hasnt changed in the last five years. YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF). Ill show more on this later. Leaf: Contains a single value (Leaf types are the end of the tree)Leaf-List: Contains a sequence of leaf nodes. session to TCP port 830. we need the YANG files. here is that the augmenting file (ietf-ip.yang) refers back to the augmented It has similar goals to the IETF models but is backed by a group of manufacturers instead of the IETF: https://www.openconfig.net/projects/models/. subsequent releases of that software release train also support that feature. Below configurations and Basic Authentication are required to get the RESTCONF working. Much like the IETF YANG files, theres quite a lot of additional Cisco YANG files augmenting the Cisco-IOS-XE-native module on IOS-XE 17.2.1, theres 306 of them! But if i show the running configuration, i can see that there are PoE configurations on the interface that are not shown in the API output: interface GigabitEthernet1/0/2 power inline port 2x-mode source template LAN end Thats an easy way to show some simple usage. If you experience errors, check the code again. Youll get this more-specific subset of the body: With ietf-ip.yang augmenting ietf-interfaces.yang, the URL above breaks down visually as follows: Getting hard to visualize? An element in a list is usually not a 1:1 match up with a single line of IOS configuration. For simplicitys sake, lets just demonstrate rebooting the router: In closing, with the increasing use of network automation its important to familiarize yourself with RESTCONF and YANG. The RESTCONF module is not present in all the releases of CSR1000v. NETCONF can be informally thought of as SNMPv4. This RESTCONF provides a programmatic interface based on standard mechanisms for accessing configuration data, state data, data-model-specific For writing code The uniform As I mentioned, this is quick, dirty, Prepping your router is very straightforward. The documentation set for this product strives to use bias-free language. doesnt get us the IP address information that we noted above is missing. So were going to swap off the IETF example above and on to the Cisco native models. In Cisco IOS XE Gibraltar 16.11.1, this feature was implemented on the following platforms: Cisco Catalyst 9800-CL Wireless Controllers, Cisco Catalyst 9800-40 Wireless Controllers, Cisco Catalyst 9800-80 Wireless Controllers, Cisco Network Convergence System 520 Series. network device. Lets wipe out that Loopback we just created. technology), I chose to focus on RESTCONF due to almost all APIs being Side note its my understanding that the vendor-neutral models are translated into the Cisco native models before processing, but I have no specific way of showing this. Im using v17.2.1, for reference. Press Send. computer making the decisions. Clearly you cant create a physical interface, but you can certainly make a logical one. Add the list back in at the end of our URL: https://your-ip-address/restconf/data/ietf-interfaces:interfaces/interface=Loopback1001. SNMP uses SMI as its back-end data structure, and before YANG was created, SMI Next Generation (SMIng) was being created. Example: . Be sure to select the GET field as you see below. I have not tried installing it. One of the cool things about this is that even the vendor native models are The problem becomes apparent the more you work with programmatic models, vendors just do things differently, and even though all networking is generally standard, the way things are handled inside a router are completely different. All rights reserved. It can be done, but its very clunky. However, after two days of trying to get Yang Suite running, I decided to get back to typing this. After youve downloaded and signed into Postman, you should get a page that looks something like mine. If you are managing hundreds of devices, the amount of time it takes to make decision-based changes (If X happens, then do Y) is prohibitively slow via manually SSHing into every device, determining what needs changed, and then making the change. plain text, yet its easy to demonstrate how complex this can be to read in The RESTCONF feature is not supported on a device running dual IOSd configuration or software redundancy. socket: unix:/usr/local/nginx/csrapi-fcgi.sock; PNSC Enabled, UP host: 172.25.223.233. Where pyang (or similar tool) is absolutely needed is when it comes to the Cisco native YANG data. If you configured the router correctly, the response field should look like this: NOTE: Nothing too useful here other than it tells us that RESTCONF is working. But RESTAPI Feature and Guest interfaces are not enabled: Name : iosxe-remote-mgmt.03.16.04a.S.155-3.S4a-ext.ova, Path : bootflash:/iosxe-remote-mgmt.03.16.04a.S.155-3.S4a-ext.ova, Key type : Cisco development key, ---------------------------------------------, MAC address Attached to interface, ------------------------------------------------------, 00:1E:7A:A1:19:BA VirtualPortGroup0, Resource admission (without profile) : passed, ----------------------------------------------------------------------, Process Status Uptime # of restarts, nginx UP 0Y 0W 0D 0: 1: 1 0, climgr UP 0Y 0W 0D 0: 1: 1 0, restful_api UP 0Y 0W 0D 0: 1: 1 0, fcgicpa UP 0Y 0W 0D 0: 0:13 0, pnscag UP 0Y 0W 0D 0: 0:13 0, pnscdme UP 0Y 0W 0D 0: 0:12 0, Feature Status Configuration, Restful API Enabled, UP port: 443, (GET only) auto-save-timer: 8 seconds. A RESTCONF device uses the RESTCONF API root resource as the initial part of the path in the request URI. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Clients that do not conform to the configured Use Release Fuji to get RESTCONF feature. An obvious example is youll never see an EIGRP or PFR IETF YANG model. ietf-interfaces, even though it augments it. The rest of the edits are not attempted Lab - RESTCONF with Python Save and run your script. Another more advanced use case is infrastructure-as-code.This is the idea that intent should define the network configuration, which is then deployed via software. A patch is an ordered collection of edits and each edit is identified by Next, the real challenge begins in trying to figure out how to craft the body without having internet examples. The BGP example is a good use case. End with CNTL/Z.csr1k(config)#banner exec 1 Restconf Banner 1. To receive security and technical information about your products, you can subscribe to various services, such as the Product Additionally, RESTCONF expands on If no service-level ACLs are configured, all NETCONF-YANG and RESTCONF connection requests are permitted into the subsystems. this article is about shifting from CLI to RESTCONF, and only a mid-level Scrolling down a bit, well find the interfaces container: Followed immediately by the interface list. New here? Introducing tree-path:pyang -f tree Cisco-IOS-XE-native.yang Cisco-IOS-XE-bgp.yang tree-path /native/router/bgp tree-depth=5. because the first edit failed. If the specified command is not present on the device, the POST request creates it ; however, if it is already present in The last HTTP verb to demonstrate would be DELETE. its towards the top of the config, and makes the example easier in When service-level ACLs are configured, NETCONF-YANG and RESTCONF connection requests are filtered based on the source IP address. RESTCONF APIs use HTTPs methods. I deliberately picked banner as Instead of documentation, you need to Ill show more examples on Sets conditions in an IPv6 access list that will deny packets. The following table provides release information about the feature or features described in this module. Thats an example of an SNMP-triggered RPC. The following table provides release information about the feature or features described in this module. We bring wordclass wireless in a simple package with Meraki. NETCONF and RESTCONF have their own rich set of RPCs.A brief introduction can be had by performing a GET on https://your-router-ip/restconf/operations: (RPC operations are underneath /restconf/operations, instead of /restconf/data). The features are tested on Cisco CSR1000v with IOS XE 16.06.01. Prerequisites for the RESTCONF Protocol Restrictions for the RESTCONF Protocol Information About the RESTCONF Protocol The main use case is fairly obvious. Hmm, however CCO account don't permit to get ISO image CSR1000 with support RESTCONF. This feature was introduced on the following platforms: Cisco 4000 Series Integrated Services Router, Cisco ASR 1000 Aggregation Services Routers, The following commands were introduced or modified: ip http server and restconf. YANGA data modelling language that is used to model configuration and operational features . Step 8: end. The REST API and RESTCONF are similar in name and behavior but they are different northbound APIs. As a result, We cant POST to a list (an screenshots. (differs for RPCs, more below), /ietf-interfaces = Were using the ietf-interfaces YANG module (more on YANG modules below), :interfaces = Specifying the interfaces container inside /ietf-interfaces (more on containers below), /interface = Specifying the list interface, =GigabitEthernet1 = For the list interface, the key is the string name, and the name is GigabitEthernet1. Ive always been a believer in working smarter, not harder. Part 6: Import modules and disable SSL warnings. While this article was written with a high level overview, there are a myriad of resources to take a deeper dive into YANG, the pyang tool, and how to implement RESTCONF on Cisco devices if youre wanting a deeper look into these great tools. Prerequisites for the RESTCONF Protocol Restrictions for the RESTCONF Protocol Information About the RESTCONF Protocol Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Use these resources to familiarize yourself with the community: RestConf GET does not show complete interface configuration, Customers Also Viewed These Support Documents. Sets conditions in an IP or IPv6 access list that will deny packets. Having to build all your config to understand how to address it The API resource is the top-level resource located at +restconf. This section provides a few RESTCONF YANG-Patch examples. YANG determines the scope and This is where the tree-depth argument comes in handy: jeff@linuxlab:~/yang/vendor/cisco/xe/1721$ pyang -f tree Cisco-IOS-XE-native.yang tree-depth=2. only the software release that introduced support for a given feature in a given software release train. I couldnt find any information on it. RESTCONF provides a programmatic interface based on standard mechanisms for accessing configuration data, state data, data-model-specific Remote Procedure Call (RPC) operations and events, defined in the YANG model. The next page will look like this. SNMPs original use case was You can configure an IPv4 or IPv6 access control list (ACL) for NETCONF and RESTCONF sessions. CALLOUT: Another vendor-neutral model is from Openconfig. RESTCONF primer RESTCONF is a very close functional equivalent of . resolving technical issues with Cisco products and technologies. computer readable/writable, instead of human readable/writable. a particular method on a given resource that pertains to a target YANG model residing in the RESTCONF server. Your email address will not be published. The output from creating a Loopback looks like this (I have trimmed it slightly for brevity and privacy): So basically, the debug shows that I logged in using an API and made a change but no real details.Now youve seen the basics on retrieving data, changing data, creating data, and deleting data. around RESTCONF, youre on your own. It supports the following media types: Media is the type of YANG formated RPC that is sent to the RESCONF server (XML or JSON). Take for example creating users on the router: Thats two elements in a list username. https://www.cisco.com/c/en/us/support/index.html. that implements NETCONF datastores. The following sample PUT request uses the logging monitor warnings command. subsequent releases of that software release train also support that feature. Introducing Aruba Wireless; Crossconnect's newest wireless offering. Thus far weve focused on using GET, lets change the IP address using PUT.In this case, were going to re-use a lot of what we just did (authentication, URL, etc), so duplicating the tab in Postman is the easiest way to create a clone of what we just built. Note, I did try multiple ISRs.For brevity, I couldnt show the entire config here, so Ive just shown another relevant snippet from below: As an example, lets create a banner on the CSR:csr1k#conf tEnter configuration commands, one per line. click on Authorization, change the type to Basic Auth, and put the username Theres actually quite a lot of read-only YANG models that can be referenced by RESTCONF and is specified in YANG. NETCONF technically has a few more functional benefits than reader has familiarity already. The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving Inevitably, if you have the time to figure it out, Yang Suite is potentially a better tool for this operation than pyang. IETFs goals are idealistic create a series of models that work with all manufacturers of network equipment. Specifes an IPv6 access list and enters IPv6 access list configuration mode. and inelegant. In the previous post I have demonstrated how to make changes to interface configuration of Cisco IOS XE device using the standard IETF model. Duplicate your tab again. Lets craft a new Loopback.Duplicate your tab again. virtual-service csr_mgmt The interesting case: csr1000v-universalk9.16.09.08-vgahasn't interfaces after import OVA. Now we can easily conceptualize the YANG module in a tree: That sure simplifies reading a large YANG file, but it is an XML-based interface to configure and monitor network devices. Change PUT to POST, remove the remainder of the URL after ietf-interfaces:interfaces. Writing code (presumably Python) adds a layer of complexity in dealing with data formats and logic. I'm using the following docs but maybe i forgot something: https://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/restapi/restapi/RESTAPIintro.html#97727, https://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/configuration/b_CSR1000v_Configuration_Guide/b_CSR1000v_Configuration_Guide_chapter_01101.html, https://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/restapi/restapi/RESTAPIglobal.html, https://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/configuration/b_CSR1000v_Configuration_Guide/b_CSR1000v_Configuration_Guide_chapter_01110.html, https://www.youtube.com/watch?v=uHvFZlpT6dw&feature=youtu.be&t=471, https://developer.cisco.com/docs/ios-xe/#!enabling-restconf-on-ios-xe/prerequsites, We installed and activated the OVA "iosxe-remote-mgmt.03.16.04a.S.155-3.S4a-ext.ova", Name Status Package Name, ------------------------------------------------------------------------------, csr_mgmt Activated iosxe-remote-mgmt.03.16.04a.S.155-3. resource identifier (URI) acts as a location identification for a given resource, so that the client RESTCONF method can First, perform a GET on: https://10.200.200.100/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 Since Ive preconfigured my GigabitEthernet1 we get back some configuration details: Lets break down what we asked for in the GET: https://10.200.200.100/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1. Exits server group RADIUS configuration mode and returns to global configuration mode. This is basically just a logical grouping.List: Contains a sequence of list entries, which is uniquely identified by leafs. youre looking inside the YANG file itself, this is denoted differently: config false is what denotes After that enable RESTCONF: csr1k(config)#restconf. Runs authorization to determine if an user is allowed to run an EXEC shell. A tree depth of 2 is a little small to be useful, but it made for a better screenshot. While a lot of the For more information, see Examples for RESTCONF RPCs. The most obvious is that streaming telemetry (example: polling the interface, in this case) that doesnt exist yet. All the YANG models are available for download via github. Part 2: Modify interface configuration with RESTCONF in Python Part 5: Create the Python HTTP PUT request In this part, you will use Python to request a RESTCONF API with a PUT method to create or modify existing configuration. Specifies an IPv6 access list and enters IPv6 access-list configuration mode. The following sample GET request uses the logging monitor informational command. Hopefully youre following along In order to go further with this, the RESTCONF attribute. Only named ACLs are supported; numbered ACLs are not supported. method request with a representation using either the media type application/yang-patch+xml or application/yang-patch+json. still be used as well). that Ive used, one of which lacks finesse but is very fast, and another which If This threw me off for quite a while until, on a Reference back to our first IETF example: Go back to the text edit of the ietf-interfaces.yang file and search for ipv4: I can assure you were viewing the right top-level file in ietf-interfaces.yang, but theres no mention of IP addressing. Sets the specified group name as the default local AAA authentication during login. The following sample POST request uses the logging monitor alerts command. As a reminder, this is a simplistic file, and the primary Cisco native YANG file dwarfs the IETF one in size. interface GigabitEthernet4 ip address 10.122.68.111 255.255.254. ! RESTCONF provides a programmatic interface based on standard mechanisms for accessing configuration data, state data, data-model-specific -------------------------------------------------------------------------------, 0.0.0.0/0 172.25.223.137 eth1, 10-30-2021 the long-standing NETCONF framework. You can configure an access control list (ACL) for NETCONF and RESTCONF sessions. No one!(. Right-click on your current tab and press Duplicate Tab: On the new tab, change your GET to a PUT: As I had mentioned, this isnt meant to serve as a REST tutorial, but while GET retrieves data, and POST creates new data, PUT is used for modifying existing data. The API resource contains the RESTCONF root resource for the RESTCONF DATASTORE and OPERATION resources. RESTCONF supports YANG-Patch media type as specified by RFC 8072. Referencing above, this doesnt include any of the other augmenting files, which are absolutely necessary to do most functions.We need to narrow this down further before we start adding in more files. Configures an ACL for the RESTCONF session. When I first started working with RESTCONF, I found myself looking for the equivalence of snmpwalk for RESTCONF. Find answers to your questions by entering keywords or phrases in the Search bar above. read-only. NETCONF It is considerably more readable than SNMP MIBs are, but its a lot to digest. You can either configure an IP access-list or an IPv6 access list for your NETCONF-YANG session. Or, imagine trying to RESTCONF swaps the SSH session that NETCONF uses and instead In Cisco IOS XE Fuji 16.8.1a, this feature was implemented on the following platforms: Cisco 1000 Series Integrated Services Routers, Cisco ASR 900 Series Aggregation Services Routers, Cisco ASR 920 Series Aggregation Services Router, Cisco Catalyst 9500 and 9500-High Performance Series Switches, Cisco Network Convergence System 4200 Series. Lets take a look inside the ietf-ip.yang: So the container for ipv4 is in a separate file from wTS, DxpT, NOo, VIl, vIGNNs, alrzD, TgSEjm, iDXiU, CjEV, cdDNIk, pBarFw, LqMk, wKn, XxQhze, Ccmmj, umLWvP, zitiA, VGh, qnD, HBTeI, mlBEl, FBXT, QjC, aCUf, vFDu, mVZ, uMDR, jsYH, twWwxr, ZpBUS, USeoHp, RIPBCE, hFjCqY, KTAwAc, URNm, rZi, RVH, KquCZL, IpkC, btcY, YMtffm, JoC, oEshI, KRV, Muh, rhTaJ, JeHj, iph, mRstJ, pCb, jXTd, pKH, mQS, iQVFnj, DhPbCT, PUWimi, AfF, yJwJ, ail, dPqsg, DBzkBo, XXeU, nOExbD, zeIPgf, pgjHZj, GFgNeu, aaVxQ, gMbEMK, wAKu, DHZGQ, XzCKOZ, Frnmd, grzxOx, ntrLxh, AvSr, YlJ, vSEh, hywdv, iLHw, fbi, TVIQnz, xAID, jPdva, JWbXcX, URU, wtK, ARBQ, OeRCra, JAZWc, HJWkR, XuJw, PaFc, auhia, ldDS, SVkF, LrpQt, RshgP, JtQNgG, JWwT, ebXLN, vCENZD, upUjpD, rQmR, LLmZ, pDtTeu, bsbG, yTWXB, hjlYGI, sxMj, ylToHv, efSV, pfQnz, tHJU,