restconf
Enables the RESTCONF API on the device, allowing external applications to manage and monitor the device using RESTful HTTP/HTTPS requests.
Definition: restconf is a Cisco IOS global config command. Enables the RESTCONF API on the device, allowing external applications to manage and monitor the device using RESTful HTTP/HTTPS requests.
Overview
The `restconf` command in global configuration mode enables the RESTCONF API on a Cisco IOS-XE device. RESTCONF is a standardized, RESTful HTTP/HTTPS-based protocol defined in RFC 8040 that allows external applications to manage and monitor network devices using YANG data models. It provides a programmatic interface for configuration, state retrieval, and event notifications, making it a cornerstone of modern network automation and DevOps workflows.
Unlike CLI or SNMP, RESTCONF uses structured data formats like JSON or XML, enabling seamless integration with automation tools such as Ansible, Python scripts, and orchestration platforms. This command is essential when you need to automate device configuration, collect operational data at scale, or integrate with a controller like Cisco DNA Center or third-party management systems. It is typically used in conjunction with the `netconf-yang` command, which enables NETCONF, another YANG-based protocol.
RESTCONF operates over HTTP/HTTPS and uses standard HTTP methods (GET, POST, PUT, PATCH, DELETE) to interact with resources defined by YANG modules. Enabling RESTCONF requires configuring an HTTPS server (via `ip http secure-server`) and optionally an HTTP server (`ip http server`). The command takes no parameters; once enabled, the device listens on port 443 (HTTPS) or 80 (HTTP) for RESTCONF requests.
The API is accessible at the base URI `https://<device-ip>/restconf`. Privilege level 15 is required to enter global configuration mode and issue this command. The change takes immediate effect and is saved to the running configuration.
Disabling RESTCONF is done with the `no restconf` command. It is important to note that RESTCONF requires a valid user account with appropriate privileges (typically privilege level 15) for authentication. The device must also have a hostname and domain name configured for certificate generation if using HTTPS.
RESTCONF is supported on IOS-XE 16.x and later; earlier IOS versions do not support it. For NX-OS, the equivalent is `feature restconf`. The command does not appear in the running config if it is disabled; when enabled, it shows as `restconf` under the global config.
This command is a gateway to model-driven programmability, enabling tasks like zero-touch provisioning, continuous compliance monitoring, and automated troubleshooting. It is particularly useful in large-scale networks where manual CLI management is impractical. By enabling RESTCONF, you allow external systems to push and pull configuration and state data, reducing human error and accelerating change deployment.
The API supports both candidate and running datastores, and operations can be transactional. For security, it is recommended to use HTTPS with a valid certificate and restrict access via ACLs. The `restconf` command is a fundamental building block for network automation, and mastering it is crucial for CCNA and CCNP candidates aiming to excel in modern network engineering roles.
restconfWhen to Use This Command
- Automating device configuration changes using a Python script that sends RESTCONF requests.
- Integrating network devices with a centralized orchestration platform like Cisco DNA Center or Ansible.
- Monitoring device health and interface statistics via RESTCONF GET requests from a monitoring system.
- Performing bulk configuration backups by retrieving device configurations via RESTCONF.
Command Examples
Enable RESTCONF with default settings
restconfDevice(config)# restconf Device(config-restconf)#
The 'restconf' command enters RESTCONF configuration mode. No additional output is shown; the prompt changes to indicate RESTCONF sub-mode.
Enable RESTCONF and specify HTTP/HTTPS transport
restconf
transport httpsDevice(config)# restconf Device(config-restconf)# transport https Device(config-restconf)#
After entering RESTCONF mode, the 'transport https' command restricts RESTCONF to HTTPS only. The prompt remains in RESTCONF sub-mode.
Understanding the Output
The 'restconf' command itself does not produce verbose output. It simply enters RESTCONF configuration mode, indicated by the prompt change to '(config-restconf)#'. From this mode, you can configure transport protocols (HTTP/HTTPS), authentication, and other RESTCONF parameters.
To verify that RESTCONF is enabled, use 'show running-config | include restconf' or 'show platform software restconf' (if available). A successful configuration will show 'restconf' in the running configuration. If RESTCONF is not enabled, the command will not appear.
Ensure that the device has an HTTP/HTTPS server configured (e.g., 'ip http server' or 'ip http secure-server') for RESTCONF to function.
Configuration Scenarios
Enable RESTCONF on a single router for remote automation
A network engineer needs to automate configuration backups and compliance checks on a branch router. Enabling RESTCONF allows a Python script to interact with the device via HTTP.
Topology
R1(Gi0/0)---10.0.0.0/24---(Gi0/0)Management_ServerSteps
- 1.Step 1: Enter global configuration mode: Router# configure terminal
- 2.Step 2: Enable the HTTP/HTTPS server: Router(config)# ip http server and Router(config)# ip http secure-server
- 3.Step 3: Enable RESTCONF: Router(config)# restconf
- 4.Step 4: (Optional) Configure authentication: Router(config)# username admin privilege 15 secret cisco
- 5.Step 5: Exit and verify: Router(config)# end
! Enable RESTCONF ip http server ip http secure-server restconf username admin privilege 15 secret cisco
Verify: Use a REST client to send a GET request to https://10.0.0.1/restconf/data/ietf-interfaces:interfaces. Expected response: HTTP 200 with JSON/XML listing interfaces.
Watch out: Forgetting to enable the HTTP/HTTPS server will cause RESTCONF to fail silently. Always verify with `show ip http server status`.
Enable RESTCONF with ACL restriction for secure access
A security policy requires that only the management server (10.0.0.10) can access the RESTCONF API. An ACL is applied to the HTTP server to restrict access.
Topology
R1(Gi0/0)---10.0.0.0/24---(Gi0/0)Management_Server(10.0.0.10)Steps
- 1.Step 1: Create an ACL to permit only the management server: Router(config)# ip access-list standard RESTCONF_ACL
- 2.Step 2: Permit the management server: Router(config-std-nacl)# permit 10.0.0.10
- 3.Step 3: Apply ACL to HTTP server: Router(config)# ip http access-class RESTCONF_ACL
- 4.Step 4: Enable HTTP/HTTPS servers and RESTCONF: Router(config)# ip http server, Router(config)# ip http secure-server, Router(config)# restconf
- 5.Step 5: Exit and verify: Router(config)# end
! RESTCONF with ACL ip access-list standard RESTCONF_ACL permit 10.0.0.10 ! ip http access-class RESTCONF_ACL ip http server ip http secure-server restconf
Verify: From the management server, send a GET request to https://10.0.0.1/restconf/data. Expected: HTTP 200. From any other IP, the request should be denied (HTTP 403 or timeout).
Watch out: The ACL is applied to the HTTP server, not to RESTCONF directly. Ensure the ACL permits the source IP of the RESTCONF client. Also, the ACL does not affect HTTPS if `ip http secure-server` is used alone; apply the ACL to both if needed.
Troubleshooting with This Command
When troubleshooting RESTCONF, the first step is to verify that the HTTP/HTTPS server is running. Use `show ip http server status` to confirm the server state and port. If the server is not running, RESTCONF will not respond.
Next, check that RESTCONF is enabled with `show running-config | include restconf`. If the command is missing, re-enter it. Common symptoms include HTTP 401 Unauthorized errors, which indicate authentication failure.
Ensure the username and password are correct and that the user has privilege level 15. Use `show users` to verify active sessions. HTTP 404 errors suggest the URI path is incorrect; the base URI should be `/restconf/data/` followed by the YANG module path.
For example, to get interface data, use `/restconf/data/ietf-interfaces:interfaces`. If you receive HTTP 500 errors, the device may have a configuration issue or the YANG module is not supported. Use `show restconf` (if available) or check the syslog for error messages.
Another common issue is certificate validation failure when using HTTPS. Ensure the device has a valid certificate or disable certificate verification on the client side for testing. If the client is timing out, check network connectivity and firewall rules.
Use `telnet <device-ip> 443` to test TCP connectivity to the HTTPS port. If the port is not reachable, verify that the `ip http secure-server` command is configured and that no ACL is blocking the port. For HTTP, test port 80.
Additionally, ensure that the device's clock is set correctly if using certificates. The `debug ip http all` command can provide verbose HTTP debugging, but use it cautiously in production as it can generate a lot of output. Correlate RESTCONF errors with the device's syslog messages.
For example, a syslog message like `%HTTPS_SERVER-3-ERROR` indicates an HTTPS server issue. If RESTCONF works intermittently, check for resource exhaustion (CPU/memory) using `show processes cpu` and `show memory statistics`. Finally, if you are using a custom YANG module, ensure it is properly loaded with `show yang module`.
CCNA Exam Tips
CCNA exam may ask which command enables RESTCONF; answer is 'restconf' in global config.
Remember that RESTCONF requires an HTTP/HTTPS server to be enabled; 'ip http server' or 'ip http secure-server' must be configured.
Know that RESTCONF uses YANG data models and is an alternative to NETCONF for programmatic access.
Be aware that RESTCONF can use both HTTP and HTTPS, but HTTPS is recommended for security.
Common Mistakes
Forgetting to enable the HTTP/HTTPS server before using RESTCONF, causing connection failures.
Assuming RESTCONF works without configuring authentication; RESTCONF uses the device's AAA or local credentials.
Confusing RESTCONF with NETCONF; RESTCONF uses HTTP/HTTPS and JSON/XML, while NETCONF uses SSH and XML.
restconf vs ip http server
These two commands both enable HTTP-based management on Cisco IOS devices, but they serve different purposes and are often confused. 'ip http server' activates the traditional web GUI, while 'restconf' enables a RESTful API for programmatic YANG-based configuration and monitoring.
| Aspect | restconf | ip http server |
|---|---|---|
| Purpose | Enable RESTCONF API for YANG-based management | Enable legacy HTTP web server (GUI) |
| Protocol/API | RESTCONF (RESTful over HTTP/HTTPS) | HTTP/HTTPS for web browser access |
| Dependencies | Requires 'ip http secure-server' for HTTPS; may need 'netconf-yang' | May also need 'ip http authentication' and 'ip http path' |
| Security | Typically uses TLS; integrates with AAA and RBAC | Legacy; often uses basic auth or local user database |
| Typical use | Programmatic automation, SDN, orchestration | Manual web-based monitoring/configuration |
Use restconf when you need a programmable, standards-based interface for network automation and integration with external tools.
Use ip http server when you require a browser-based GUI for occasional manual management or legacy applications.
Platform Notes
On IOS-XE (16.x and later), the `restconf` command is available in global configuration mode. The syntax is identical across IOS-XE versions, but the underlying YANG models may vary. For example, IOS-XE 16.12 introduced additional YANG modules for advanced features.
On NX-OS, the equivalent command is `feature restconf` in global configuration mode. NX-OS also requires `feature http-server` or `feature https-server` to be enabled. The RESTCONF base URI on NX-OS is the same (`/restconf/data/`).
On ASA, RESTCONF is not supported; instead, use the ASDM or SSH/CLI for management. IOS-XR does not support RESTCONF natively; it uses NETCONF or gRPC for programmatic access. In older IOS versions (12.x, 15.x), RESTCONF is not available; these platforms use SNMP or CLI scripting.
When migrating from IOS to IOS-XE, note that the `restconf` command is only available in IOS-XE, not classic IOS. Also, on IOS-XE, the `ip http server` command is required for HTTP access, while `ip http secure-server` is required for HTTPS. On NX-OS, the HTTP/HTTPS servers are enabled separately with `feature http-server` and `feature https-server`.
The authentication method also differs: IOS-XE uses local username/password or AAA, while NX-OS uses local or TACACS+/RADIUS. For both platforms, privilege level 15 is typically required for full access. The output format (JSON/XML) is consistent across platforms, but the available YANG modules differ.
Always check the platform-specific YANG module list with `show yang module` on IOS-XE or `show yang models` on NX-OS.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions