3

I am trying to extract information via NETCONF from an IOS-XE device.

I am using two separate methods to achieve this and cannot replicate the success of one method while using the other:

Successful NETCONF communication

With Cisco's YANG Suite, I can craft NETCONF RPC calls, send them to the IOS-XE device, and get proper replies. For example, I wanted to get the operational status <oper-status> of the GigabitEthernet1 interface. YANG Suite says that it sent the following RPC to the device:

Sending:

#360
<nc:rpc xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:f21fbbe2-3f8d-44ae-b53c-9d959ba4a7b3">
  <nc:get>
    <nc:filter>
      <interfaces-state xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
        <interface>
          <name>GigabitEthernet1</name>
          <oper-status/>
        </interface>
      </interfaces-state>
    </nc:filter>
  </nc:get>
</nc:rpc>

##

And YANG Suite received from the device:

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:f21fbbe2-3f8d-44ae-b53c-9d959ba4a7b3">
  <data>
    <interfaces-state xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
      <interface>
        <name>GigabitEthernet1</name>
        <oper-status>up</oper-status>
      </interface>
    </interfaces-state>
  </data>
</rpc-reply>

As we can see, the device supports the urn:ietf:params:xml:ns:yang:ietf-interfaces XML namespace, and supports getting a question from the /rpc/getfilter/interfaces-state/interface/oper-status/ Xpath.

When asking for a list of interfaces from the device, YANG Suite sends the following RPC:

<nc:rpc xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:cb5eade5-dd10-420f-a9f1-366ac5cd4c85">
  <nc:get>
    <nc:filter>
      <interfaces-state xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
        <interface/>
      </interfaces-state>
    </nc:filter>
  </nc:get>
</nc:rpc>

So far so good.

Something weird at the IOS-XE CLI

At the CLI, though, IOS-XE says that it does not support neither the urn:ietf:params:xml:ns:yang:ietf-interfaces XML namespace, nor the /rpc/getfilter/interfaces-state/interface/oper-status/ Xpath.

R1#show netconf schema
New Name Space 'urn:ietf:params:xml:ns:netconf:base:1.0'
<VirtualRootTag> [0, 1] required
  <rpc-reply> [0, 1] required
...

The above output says that the only schema the IOS-XE device supports is the 'urn:ietf:params:xml:ns:netconf:base:1.0' namespace.

Or:

R1#show netconf schema | include <rpc>|<filter>|interface
  <rpc> [0, 1] required
      <filter> [0, 1] required
      <filter> [0, 1] required
R1#

NETCONF over SSHv2 does not work

When I try to send any RPC outside of the XML tree as seen in the show netconf schema over SSHv2, it fails. Below, I try to send the same RPC that YANG suite sent to the device over native NETCONF, with very different results:

<?xml version="1.0" encoding="UTF-8"?>
<nc:rpc xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:cb5eade5-dd10-420f-a9f1-366ac5cd4c85">
  <nc:get>
    <nc:filter>
      <interfaces-state xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces">
        <interface/>
      </interfaces-state>
    </nc:filter>
  </nc:get>
</nc:rpc>]]>]]>

Reply for IOS-XE:

<?xml version="1.0" encoding="UTF-8"?>
<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
  <rpc-error>
    <error-type>rpc
    </error-type>
    <error-tag>unknown-element
    </error-tag>
    <error-severity>error
    </error-severity>
    <error-info>
      <bad-element>interfaces-state
      </bad-element>
    </error-info>
  </rpc-error>
</rpc-reply>]]>]]>

We can see that IOS-XE says "look, I don't know what you are talking about when you talk about /rpc/get/filter/interfaces-state/. interfaces-state is not present in my XML tree."

I figured that IOS-XE does not know about (or support) the urn:ietf:params:xml:ns:yang:ietf-interfaces namespace, and that is the reason it does not know about the interfaces-state part of the tree. And yes, during the initial hello over NETCONF over SSHv2, IOS-XE blatantly tells me: Look, I only know very few namespaces:

<?xml version="1.0" encoding="UTF-8"?>
<hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
  <capabilities>
    <capability>urn:ietf:params:netconf:base:1.0
    </capability>
    <capability>urn:ietf:params:netconf:capability:writeable-running:1.0
    </capability>
    <capability>urn:ietf:params:netconf:capability:startup:1.0
    </capability>
    <capability>urn:ietf:params:netconf:capability:url:1.0
    </capability>
    <capability>urn:cisco:params:netconf:capability:pi-data-model:1.0
    </capability>
    <capability>urn:cisco:params:netconf:capability:notification:1.0
    </capability>
  </capabilities>
  <session-id>3375721824
  </session-id>
</hello>]]>]]>

The above list of capabilities is a very far cry from what YANG Suite has available.

Note: I am using the same username/password when connecting with both SSH and YANG Suite, so I do not think it is rights-related:

R1#show runn | include netconf
username netconf privilege 15 password 0 netconf
netconf ssh
netconf-yang
netconf-yang feature candidate-datastore

Questions

  1. What am I doing wrong? Why can't I get IOS-XE to give me a list of interfaces over NETCONF over SSHv2, as it is supposed to be able to do (and does when YANG Suite asks the same question over native NETCONF?
  2. Is it possible that the NETCONF over SSHv2 implementation in IOS-XE supports fewer namespaces that the native NETCONF implementation does?

2 Answers 2

2

So, it seems that I bumped into a somewhat-well-known issue with IOS-XE. The best documentation I found online for this is at IPspace: https://blog.ipspace.net/2017/04/netconf-agents-on-cisco-ios-xe-16x.html

IOS-XE (at least version 16.3) has two separate NETCONF implementations and subsystems within its code. I don't know what their proper names are, but for my purposes here I will refer to them as legacy and proper. Other than my use here, these labels mean nothing and I have not seen them anywhere else. Below I am listing the main characteristics per version:

Legacy NETCONF implementation

  • Enabled with the netconf ssh command
  • Listens on TCP port 22 (at the netconf subsystem)
  • Can be debugged with the debug netconf all command
  • Supports a very limited number of NETCONF namespaces (~6)
  • Once the legacy NETCONF implementation is enabled on IOS-XE, you can connect to it with the ssh [email protected] -s netconf
  • Will reply to RPC calls, even if the client does not send its capabilities with a hello message.
  • You can view information about the state and status with show netconf commands.
  • Documented in NETCONF over SSHv2

Proper NETCONF implementation

  • Enabled with the netconf-yang command
  • Listens on TCP port 830 (at the netconf subsystem)
  • Cannot be debugged
  • Supports a huge number of NETCONF namespaces (in the 100s)
  • Once the proper NETCONF implementation is enabled on IOS-XE, you can connect to it with the ssh [email protected] -p 830 -s netconf
  • Will not reply to RPC calls unless the client sends its capabilities with a hello message. Actually, the implementation will reset the session if the first message from the client is not a hello.
  • You can view information about the state and status with show netconf-yang commands.
  • Documented at Configure NETCONF/YANG for Cisco IOS XE 16.X Platforms

In conclusion, I have made three mistakes to create my issue:

  1. I enabled the legacy NETCONF implementation with the netconf ssh command on the IOS XE device.
  2. I used the wrong SSH command to connect to NETCONF on the IOS XE device. I forgot the -p 830 option, and so the SSH client connected to the default SSH port (TCP port 22)
  3. I expected the legacy NETCONF implementation to be the same as the proper NETCONF implementation.

From Cisco's documentation, it seems like Cisco calls the two implementations "NETCONF over SSHv2" and "NETCONF/YANG". Note that both implementations run over SSHv2 and both are based on YANG models.

1

Cisco NETCONF uses SSH for transport on port 830. SSH is enabled when NETCONF is enabled with the netconf-yang command. I do not believe that you can first run SSH then use NETCONF across that connection. Connecting with NETCONF uses SSH.

Cisco has several documents about this, e.g. Configure NETCONF/YANG for Cisco IOS XE 16.X Platforms that has a data retrieval example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.