NETCONF

NETCONF is a network management protocol defined by the IETF for installing, manipulating, and deleting the configuration of network devices. It follows a client–server model in which a management application acts as a NETCONF client and a device exposes a NETCONF server. Clients exchange RPCs and replies to perform configuration operations and retrieve state data. Data exchanged between client and server is encoded in XML and uses a simple, extensible RPC mechanism to request operations such as get-config, edit-config, copy-config, lock, unlock, and close-session. Data modeling is performed with YANG, which defines device configuration and state data in a hierarchical structure. Through a capabilities exchange, a NETCONF session negotiates supported features and data modeling.

NETCONF typically runs over SSH as its transport mapping, providing authentication and encrypted communication. Other transport options exist, including TLS-based mappings. Security considerations emphasize strong authentication, authorization, integrity, and confidentiality, as well as session locking and proper access control. The protocol supports multiple datastores, such as a running configuration and an optional candidate datastore used for staged changes, along with mechanisms for committing or discarding those changes.

Use of NETCONF is common in service-provider networks and data-center environments, where network devices offer NETCONF endpoints and support YANG models. A wide range of device vendors provide NETCONF servers, and tooling and controller platforms leverage NETCONF to automate configuration, monitoring, and lifecycle management. By separating data modeling (YANG) from transport and command semantics, NETCONF enables interoperable, model-driven network management.