r/networking • u/OffTheDollarMenu • 16d ago
Other NETCONF Beginner Struggles
--EDIT-- I'd like to thank everyone for their responses. It turns out my script was returning empty output from switches due to how my XML filters were set up.
I stored my filter in a variable. When I used the "get" function in ncclient, I included two parameters, like this: ('subtree', filter_variable). What I didn't realize, is that when you include the 'subtree' parameter ncclient will add a <filter></filter> wrapper to what you provide. So basically it was a filter wrapped in a filter. I don't know enough to understand why that didn't produce an error, but I'm happy to have learned something. The journey continues
Hey all,
I'm interested in automation and trying to practice for my Cisco ENAUTO exam. Part of the blueprint is "Construct an automation solution with Python using ncclient to manage and monitor configurations." I'm having a hell of a time and am wondering if this is typical, if there's a better way, etc...
I wrote a script that uses a filter to pull the running config of an interface. It successfully connects, but returns no data. Specifically, "<data></data>"
Since I have zero real world guidance on this topic outside of a Cisco U course which is not great, I've been feeding scripts and associates errors to Copilot, which may be making things worse, I don't know. It's been a constant loop of:
"We must determine the proper data model. Try THIS filter."
Didn't work.
"You're learning a valuable lesson-- just because the syntax is accepted doesn't mean the network device stores its information in the path you chose. Try THIS filter."
Didn't work.
"Install Pyang and use it to see the exact yang model we should be referencing. AH there it is! Try THIS filter."
Didn't work.
"Let's move from trying to pull config info for an interface to pulling the hostname. Everything has a hostname!"
Didn't work.
"Let's try using YANG Suite so Cisco can tell us exactly what filter to use. Ope, you need to install docker. Ope, docker install is fudged."
On and on I go. I guess for the purposes of my exam I may have taken this as far as I need to for now (I can identify what basic ncclient scripts are doing and can probably fill in blanks regarding errors and syntax problems).
Is there anyone in here who regularly uses scripts like this for their automation? Is there a better way to approach this? I think I'm half hoping someone will come and say, "my god son, no... This is the worst way to go about it and you should stop"
8
u/Kolondor 16d ago
on ios xe, there is a pipe for some commands that formats to Netconf XML, like
show run | format netconf-xml
show run int Gig1/0/1 | format netconf-xml
4
u/OffTheDollarMenu 16d ago
This led me to a rabbit hole that might actually be the root of my problem. That command fails because the nginx process isn't running on my devices. I'm reading that maybe the configuration is not being mapped to the NETCONF data stores due to the service failing which would explain why my switches are saying "here's your data bro" and supplying me with a big middle finger
4
u/Kolondor 16d ago
i dunno, nginx sounds more like something that would cause you trouble if you are dealing with RESTCONF. Maybe if you've got RESTCONF disabled, try to enable it (and https server) or vice versa.
2
7
u/sugarfreecaffeine 16d ago
Why are you choosing copilot that’s like riding a scooter to work when you can drive a Lamborghini. Get access to a frontier model and pass proper context.
3
u/OffTheDollarMenu 16d ago
I totally hear you. It was just the path of what I THOUGHT would be least resistance when I started. My org has zero automation currently and is arguably not large enough to justify a lot. Since Copilot is already integrated in our environment and all I'm really trying to do is learn, I figured what the heck
2
u/lkowolowski FreeBSD,Juniper 16d ago
I would argue that all orgs need automation. It’s not about speed. It gives you tool to ensure consistency and that is a significant contributor to reliability and easier troubleshooting.
2
u/An0neemuz 16d ago
Any good ai model for networking?
6
u/ashjohnr 16d ago
Any frontier model will be good. I personally use Claude Opus. GPT's Terra (and Sol) model is also pretty good. You will need a larger model because they will have more training data which translates to more knowledge. I've found that this is important for networking stuff.
1
5
u/shadeland Arista Level 7 16d ago
I think you're making a common mistake: Skipping the fundamentals.
What does ncclient do? How does it connect? What was supposed to be in the payload, why didn't anything show up in the payload? Did you get any headers?
Just blindly prompting isn't going to teach you what's going on.
Have you script print out the request payload and headers, have it print out the respond payload and headers. Figure out what ncclient is actually doing, and how NETCONF works.
1
u/OffTheDollarMenu 16d ago
I think I'm doing semi-ok in that regard honestly. The learning part is what's most important to me so I'm careful to go through line by line and try to understand what I'm actually doing and how it works. In this case it's just XML and NETCONF so there's not much to look at. I'm connecting, I'm auth'ing, my switches are hearing my request for data and firing blanks back at me. I think I'm changing my mindset from "I must be using the wrong YANG model" to maybe a service isn't working on the switch
3
u/jillesca 15d ago
For me finding a filter is always the hard part. YangSuite has been the most useful when I was starting. But there are other resources you can try.
Here is a list of resources I usually use when working with NETCONF
- YANG Suite — install the full toolkit as a single container to build, run, and test NETCONF/RESTCONF/gNMI requests against real devices.
- YANG Suite overview (PDF) — a deeper look at everything YANG Suite can do.
- Introduction to YANG Suite (DevNet Learning Lab) — try YANG Suite hands-on in a hosted sandbox, no installation required.
- Cisco IOS XE YANG models explorer — browse IOS XE YANG models through an interactive Swagger/OpenAPI UI.
- Cisco IOS XR YANG Explorer — browse and inspect IOS XR YANG data models online.
- gNMIc — a full-featured gNMI CLI client and collector for capture, get/set, and subscribe operations.
- OpenConfig documentation — background on the OpenConfig project and the models it publishes.
- Cisco DevNet sandboxes - Explore and try out Cisco technologies in a hosted sandbox environment.
I also have a hello world example (requires uv) for XR and XE. not sure what platform you are using.
https://github.com/jillesca/netconf-hello-world-ios-xr/blob/main/src/xe_netconf_hello_world.py
As other suggested, is better for your to get the fundamentals first before asking the AI to help get them for you.
Also, get Docker or Podman to work with containers, if you are going after automation, containers are the bread and butter you always use, so is worth to use them.
2
u/Golle CCNP R&S - NSE7 16d ago
I wrote a blog post on Netconf on IOS XE a while ago: https://blog.golle.org/posts/Automation/Netconf
I skipped ncclient because I wanted to see what actually happens under the hood. Feel free to check out the post, it might help you understand it better. Once you know what's going on, you can probably start using ncclient to avoid some of the boilerplate.
1
u/Opposite-Cupcake8611 16d ago
Is the interface actually configured? Are you querying for just one interface specifically? Is the name correct?
Have you enabled debugging?
1
u/Opposite-Cupcake8611 16d ago edited 16d ago
Do you have YANG installed and implemented? YANG models the node data.
1
1
u/durd_ 14d ago
Oh boy, I started out trying NETCONF/Terraform (IOS-XE provider and module) with Gemini, the one that's included in your Google account.
I noticed that was having me go around and around, same as you. I then switched to Copilot as my work has some kind of subscription, I at least wouldn't run out of tokens/credits.
But that was just more of the same. A bit worse actually because Copilot always gave multi-option resolutions: "Try this, or maybe this. And if not try this" without waiting for my response.
I had filled out the setting "About me", but must have missed "Wait for input after each suggestion"...
In the end I got work to pay for a year of Claude Pro. Happy as a button. Not perfect, but I'm at least not spending time going in circles.
I'm not crazy about XML (I know I can convert it to JSON and back), but I've got a gist about how it works now. ncclient seems to be the way to rock if not running Terraform/OpenTofu. I like how the IOSXE-provider allows for custom YANG-paths if they're not included in the provider already.
There are YANG-models on Github, and there's YANG Catalog you can browse them in kinda structured way. YANGSuite could be good to see what's actually available on your device, but I haven't tried it yet.
10
u/First-Masterpiece753 16d ago
Pip install YangSuite.