In which configuration mode is netconf-yang used?

The netconf-yang command is entered in Global Config mode on Cisco IOS devices.

AutomationGlobal Config

netconf-yang

Enables NETCONF-YANG on the device, allowing programmatic configuration and state retrieval using YANG data models over SSH.

Definition: netconf-yang is a Cisco IOS global config command. Enables NETCONF-YANG on the device, allowing programmatic configuration and state retrieval using YANG data models over SSH.

Overview

The `netconf-yang` command, issued in global configuration mode, enables the NETCONF protocol with YANG data modeling on a Cisco IOS-XE device. NETCONF (Network Configuration Protocol) is a standardized network management protocol defined in RFC 6241 that uses XML-based data encoding and operates over SSH (typically TCP port 830). YANG (Yet Another Next Generation) is a data modeling language used to define the structure of configuration and state data, as defined in RFC 6020.

Together, NETCONF and YANG provide a programmatic, structured, and transactional interface for network automation, replacing or supplementing traditional CLI scripting and SNMP. This command is critical for modern network automation workflows, enabling tools like Ansible, Python (via ncclient), and Cisco NSO to push configurations, retrieve operational state, and subscribe to notifications in a consistent, vendor-neutral manner. Unlike CLI-based automation, which relies on parsing text output and is prone to errors from version-specific changes, NETCONF/YANG provides a structured, machine-readable data model that is versioned and validated.

This reduces the risk of misconfiguration and enables robust, scalable automation. Network engineers reach for `netconf-yang` when they need to integrate the device into an automated management system, perform configuration compliance checks, or implement continuous deployment pipelines. It is also essential for telemetry streaming (model-driven telemetry) and for using YANG-based tools like Cisco YANG Suite.

The command is available in IOS-XE 16.x and later, and it is enabled by default on some platforms. After enabling, you must also configure an SSH server and optionally set the NETCONF port (default 830). The command modifies the running configuration, and the change persists after a write memory.

Note that enabling NETCONF may increase CPU usage slightly due to XML parsing and SSH sessions, but it is generally lightweight. Privilege level 15 is required to issue this command. In terms of workflow, you typically enable NETCONF, then configure SSH, then use a NETCONF client to connect and manage the device.

This command is a foundational step for any network automation initiative on Cisco IOS-XE.

Syntax·Global Config

netconf-yang

When to Use This Command

Automating device configuration with Ansible or Python scripts using NETCONF.
Collecting operational state data (e.g., interface statistics, routing table) via YANG models for monitoring.
Implementing a centralized network management system that uses NETCONF for configuration management.
Performing compliance checks by comparing device state against YANG-defined models.

Parameters

Parameter	Syntax	Required	Description
ssh	ssh	Optional	Enables NETCONF over SSH. This is the only transport supported in IOS-XE. If omitted, the command still enables NETCONF but SSH is the default. No additional parameters are needed.

Command Examples

Enable NETCONF-YANG with default SSH port

netconf-yang

This command enables NETCONF-YANG on the device using the default SSH port 830. No output is displayed upon successful configuration.

Verify NETCONF-YANG status

show netconf-yang status

NETCONF-YANG status: enabled
SSH port: 830
Session count: 2
Active sessions:
  Session ID: 1, User: admin, Source IP: 192.168.1.100, State: established
  Session ID: 2, User: netops, Source IP: 10.0.0.50, State: established

The output shows that NETCONF-YANG is enabled, listening on port 830, with two active sessions. Each session shows the session ID, username, source IP, and state (established indicates an active NETCONF session).

Understanding the Output

The 'show netconf-yang status' command provides a quick overview of the NETCONF-YANG service. The first line indicates whether the service is enabled or disabled. The SSH port line shows the TCP port used for NETCONF sessions (default 830).

Session count shows the total number of active NETCONF sessions. The active sessions table lists each session with its ID, the username that authenticated, the source IP address of the client, and the session state (typically 'established' for active sessions). A healthy device will show 'enabled' and have sessions in 'established' state.

If the service is disabled, no sessions will be listed. Watch for sessions in 'closing' or 'idle' states, which may indicate issues.

Configuration Scenarios

Enable NETCONF-YANG on a single router for Ansible automation

A network engineer wants to use Ansible to automate configuration backups and compliance checks on a Cisco router. NETCONF must be enabled to allow Ansible's netconf connection plugin to interact with the device.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)Ansible_Server

Steps

1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
2.Step 2: Enable NETCONF-YANG: Router(config)# netconf-yang
3.Step 3: (Optional) Set the NETCONF SSH port to a non-default value: Router(config)# netconf ssh port 830
4.Step 4: Ensure SSH server is enabled: Router(config)# ip ssh version 2
5.Step 5: Create a local user with privilege 15: Router(config)# username admin privilege 15 secret cisco123
6.Step 6: Exit and save configuration: Router(config)# end, Router# write memory

Configuration

!
Router(config)# netconf-yang
Router(config)# netconf ssh port 830
Router(config)# ip ssh version 2
Router(config)# username admin privilege 15 secret cisco123
Router(config)# end
Router# write memory
!

Verify: Use 'show netconf-yang sessions' to verify active NETCONF sessions. Expected output shows no sessions initially. Use 'show netconf-yang statistics' to see protocol statistics.

Watch out: If SSH is not configured or the user does not have privilege 15, NETCONF connections will be rejected. Also, ensure the SSH server is enabled and reachable from the management network.

Enable NETCONF-YANG with custom SSH port and ACL restriction

A security-conscious organization wants to enable NETCONF on a router but restrict access to a specific management subnet (192.168.10.0/24) and use a non-standard port (8300) to avoid automated scans.

Topology

R1(Gi0/0)---10.0.0.0/30---(Gi0/0)Management_Switch---(Gi0/1)Mgmt_Server(192.168.10.100)

Steps

1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
2.Step 2: Enable NETCONF-YANG: Router(config)# netconf-yang
3.Step 3: Set custom SSH port: Router(config)# netconf ssh port 8300
4.Step 4: Create an extended ACL to permit only the management subnet: Router(config)# ip access-list extended NETCONF-ACL, Router(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 any eq 8300
5.Step 5: Apply ACL to the SSH line: Router(config)# line vty 0 4, Router(config-line)# access-class NETCONF-ACL in
6.Step 6: Configure SSH and local user as before.
7.Step 7: Exit and save.

Configuration

!
Router(config)# netconf-yang
Router(config)# netconf ssh port 8300
Router(config)# ip access-list extended NETCONF-ACL
Router(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 any eq 8300
Router(config-ext-nacl)# exit
Router(config)# line vty 0 4
Router(config-line)# access-class NETCONF-ACL in
Router(config-line)# exit
Router(config)# ip ssh version 2
Router(config)# username admin privilege 15 secret cisco123
Router(config)# end
Router# write memory
!

Verify: Use 'show netconf-yang sessions' to verify sessions. Use 'show ip ssh' to confirm SSH is enabled. Use 'show access-lists NETCONF-ACL' to verify ACL matches.

Watch out: The ACL must permit the NETCONF port (8300) specifically, not just SSH port 22. Also, ensure the custom port is not blocked by any firewall between the management server and the router.

Troubleshooting with This Command

When troubleshooting NETCONF-YANG, the primary commands are 'show netconf-yang sessions', 'show netconf-yang statistics', and 'debug netconf-yang'. A healthy NETCONF session shows an active session with state 'established' in the output of 'show netconf-yang sessions'. If no sessions appear, the NETCONF service may not be enabled, or SSH connectivity may be failing.

Check that 'netconf-yang' appears in the running configuration. Also verify that SSH is enabled and that the user has privilege 15. Common symptoms include connection timeouts, which often indicate a firewall blocking TCP port 830 (or custom port), or the SSH server not listening.

Use 'show ip ssh' to confirm SSH is enabled and 'show tcp brief all' to see if port 830 is listening. Another issue is XML parsing errors on the client side, which may indicate a mismatch in YANG models or device capabilities. Use 'show netconf-yang schema' to list supported YANG models.

If the device returns 'operation not supported', the client may be requesting an unsupported operation or data model. The 'debug netconf-yang' command provides detailed XML exchange but should be used sparingly in production due to verbosity. Correlate NETCONF issues with SSH debugging: 'debug ip ssh' can reveal authentication problems.

Also, check that the NETCONF session timeout is not too low; the default is 10 minutes. If sessions drop unexpectedly, increase the timeout with 'netconf ssh timeout <seconds>'. For performance issues, monitor CPU usage with 'show process cpu sorted' and check if NETCONF sessions are consuming excessive resources.

In summary, a systematic approach: verify NETCONF is enabled, check SSH connectivity and authentication, review ACLs, and then use NETCONF-specific show and debug commands to isolate the problem.

CCNA Exam Tips

CCNA exam tip: NETCONF uses SSH port 830 by default, not port 22.

CCNA exam tip: YANG is a data modeling language, while NETCONF is the protocol that uses YANG models.

CCNA exam tip: The 'netconf-yang' command is entered in global configuration mode; no additional parameters are required for basic enablement.

CCNA exam tip: NETCONF operations include <get>, <get-config>, <edit-config>, and <delete-config>.

Common Mistakes

Mistake: Forgetting to enable NETCONF-YANG before attempting to use it; sessions will fail to establish.

Mistake: Confusing NETCONF with RESTCONF; NETCONF uses SSH, RESTCONF uses HTTP/HTTPS.

Mistake: Not configuring SSH server or AAA authentication before enabling NETCONF, causing authentication failures.

netconf-yang vs action 1.0 cli command [cmd]

Both commands are used for automation but operate at different layers. netconf-yang enables a management protocol for external controllers, while action 1.0 defines local event-triggered actions. They are often considered together when designing both centralized and autonomous network automation strategies.

Aspect	netconf-yang	action 1.0 cli command [cmd]
Configuration Mode	Global Configuration	Applet Configuration (EEM)
Scope	System-wide (enables NETCONF service)	Event-specific (within an applet)
Persistence	Persistent across reboots	Persistent as part of applet config
Trigger	Always active once enabled	Event-driven (syslog, timer, etc.)
Typical Use	External network management via YANG models	Local automated responses to events

Use netconf-yang when you need to integrate the device with an external network management system using standard YANG models and NETCONF protocol.

Use action 1.0 cli command [cmd] when you need to automate a local response to a specific event, such as clearing counters on an interface after a link flap.

Platform Notes

In IOS-XE (16.x and later), the command is 'netconf-yang' in global config. In earlier IOS versions (15.x), NETCONF was not supported. In NX-OS, the equivalent is 'feature netconf' and 'feature netconf-yang' (depending on version); NX-OS uses a different configuration model and supports NETCONF over SSH as well.

For ASA, NETCONF is not natively supported; use ASDM or REST API instead. IOS-XR supports NETCONF via 'netconf-yang' command in XR configuration mode, but syntax differs (e.g., 'netconf agent ssh'). In IOS-XE, the default NETCONF port is 830, and you can change it with 'netconf ssh port <1-65535>'.

The command 'show netconf-yang sessions' is available in IOS-XE but not in NX-OS (use 'show netconf session' instead). Also, IOS-XE supports NETCONF over SSH only; no other transports. In IOS-XE 16.12 and later, you can also enable NETCONF via the 'netconf-yang' command without any subcommands.

Always check the specific platform documentation for exact syntax.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions