Tutorial 10: Network Automation, NETCONF, RESTCONF, and APIs

COMP347 Unit 8 – Network Management and Network Operations

Table of Contents

• Learning Objectives
• Overview
• Technical and Theoretical Content
  • 1. Introduction to Network Automation
  • 2. Automation Principles and Best Practices
  • 3. NETCONF Protocol
  • 4. RESTCONF Protocol
  • 5. YANG and Data Models in Automation
  • 6. REST APIs for Network Devices
  • 7. Automation Tools and Frameworks
  • 8. DevOps and CI/CD for Networking
  • 9. Securing Automation APIs
  • 10. Case Studies
• Quiz (46 questions)
• Exercises (24 problems)
• Homework (18 assignments)
• Summary

Learning Objectives

After completing this extended tutorial, you should be able to:

• Define network automation and articulate its drivers and benefits.
• Explain key automation principles: idempotency, declarative vs. imperative, and the role of APIs.
• Describe the NETCONF protocol, its operations, and the role of YANG.
• Describe the RESTCONF protocol and compare it with NETCONF.
• Create and modify configurations using NETCONF/RESTCONF.
• Use REST APIs for network programmability (e.g., Cisco DNA Center, Juniper Mist).
• Select appropriate automation tools and frameworks for different scenarios.
• Integrate network automation into a CI/CD pipeline.
• Implement security best practices for APIs and automation.
• Analyze automation deployments in enterprise and service‑provider environments.

Overview

Network automation is the use of software, scripts, and APIs to perform network configuration, monitoring, and management tasks with minimal human intervention. It is a critical enabler for modern, scalable, and agile network operations. This tutorial provides a comprehensive, in‑depth exploration of network automation, focusing on the key protocols and interfaces: NETCONF, RESTCONF, and REST APIs. We begin with the fundamentals: drivers for automation (scale, speed, consistency), the distinction between imperative (scripting) and declarative (intent‑based) approaches, and the importance of idempotency.

We then dive into NETCONF (RFC 6241), a network configuration protocol that uses XML and YANG for structured data, supporting transactional changes, candidate configurations, and rollback. We cover its operations (get, get‑config, edit‑config, copy‑config, delete‑config, lock, unlock, commit, etc.) and illustrate with examples. RESTCONF (RFC 8040) is presented as a RESTful alternative to NETCONF, using HTTP/JSON and YANG, making it easier for web‑friendly applications. We also discuss vendor‑specific REST APIs (e.g., Cisco, Juniper) that offer similar capabilities. The role of YANG models is emphasized throughout, as they provide the data structure for both protocols.

We explore automation tools (Ansible, Terraform, Python scripts), and how to integrate them with CI/CD pipelines. Security considerations (authentication, authorization, encryption) are addressed. Case studies illustrate successful automation implementations, from cloud provider networks to enterprise campus environments. The quiz, exercises, and homework are designed to build both theoretical and practical skills.

Technical and Theoretical Content

1. Introduction to Network Automation

Network automation is the practice of using software to perform networking tasks that were traditionally done manually via CLI. Key drivers:

• Scale: Managing thousands of devices manually is impossible.
• Speed: Automated changes can be executed in seconds vs. hours.
• Consistency: Automation reduces human error and ensures configurations are uniform.
• Agility: Supports continuous deployment and business responsiveness.
• Cost reduction: Fewer manual tasks free up staff for higher‑value work.

Automation can be applied to provisioning, configuration, compliance, troubleshooting, and reporting.

2. Automation Principles and Best Practices

• Idempotency: Running the same automation multiple times should result in the same final state, without unintended side effects.
• Declarative vs. Imperative: Declarative defines the desired state (e.g., “interface should be up”), while imperative defines the steps to achieve it. Declarative is generally preferred for simplicity and consistency.
• Abstraction: Use templates and variables to separate device‑specific data from general logic.
• Testability: Automate testing (syntax validation, dry‑runs) before production deployment.
• Version control: Store automation code and configurations in Git.
• Peer review: Use pull requests and approvals.
• Monitoring: After changes, verify success via telemetry or health checks.

3. NETCONF Protocol

NETCONF (Network Configuration Protocol) is defined in RFC 6241. It uses an SSH‑based transport (or sometimes TLS) and XML encoding. It provides:

• Operations: get, get‑config, edit‑config, copy‑config, delete‑config, lock, unlock, commit, discard‑changes, validate, and others.
• Candidate configuration: A working copy that can be edited and validated before committing.
• Transactional changes: All edits are applied atomically; if one fails, the whole change is rolled back.
• Data modeling: Uses YANG to define the data structure.

Example of an edit‑config RPC:

<rpc message-id="101">
  <edit-config>
    <target>
      <running/>
    </target>
    <config>
      <interfaces xmlns="urn:example:interfaces">
        <interface>
          <name>eth0</name>
          <enabled>true</enabled>
        </interface>
      </interfaces>
    </config>
  </edit-config>
</rpc>
        

NETCONF also supports notifications (event‑driven messages) and is widely implemented in modern devices.

4. RESTCONF Protocol

RESTCONF (RFC 8040) is a RESTful protocol that uses HTTP methods (GET, POST, PUT, PATCH, DELETE) to interact with YANG‑defined data. It uses JSON or XML encoding, typically over HTTPS. It provides:

• Simpler integration: Uses familiar HTTP verbs and URIs.
• Data model: Based on YANG, like NETCONF.
• Operations: GET (retrieve), POST (create), PUT (replace), PATCH (partial update), DELETE.
• Comparable to NETCONF: Lacks candidate and commit operations; changes are applied directly (or via datastore oriented capabilities). Some implementations support datastore operations via query parameters.

Example: To get the system hostname:

GET /restconf/data/system/hostname
        

Response (JSON):

{
  "system:hostname": "router1"
}
        

5. YANG and Data Models in Automation

YANG (RFC 7950) is the data modeling language used by both NETCONF and RESTCONF. It defines the structure of configuration and state data. In automation, YANG models:

• Provide a schema for data, enabling validation and autocompletion.
• Enable multi‑vendor interoperability (OpenConfig models).
• Allow tools to generate APIs automatically.
• Support RPCs and notifications.

Automation tools like Ansible can use YANG models (via `yang` modules) to validate configurations before applying.

6. REST APIs for Network Devices

Many vendors provide proprietary REST APIs (e.g., Cisco DNA Center, Juniper Mist, Arista CloudVision). These APIs often use JSON over HTTPS and offer a higher‑level abstraction than NETCONF/RESTCONF, often catering to specific use cases (e.g., intent‑based networking). They are important for automation because:

• They simplify complex operations (e.g., provisioning a new site).
• They are easier to consume from cloud‑native applications.
• They often include built‑in orchestration.

When selecting an API, consider: coverage, stability, rate limits, and authentication mechanisms (OAuth, API keys).

7. Automation Tools and Frameworks

• Ansible: Agentless, uses YAML playbooks, and has modules for many network devices (Cisco, Juniper, Arista, etc.). Can be integrated with Git and CI/CD.
• Terraform: Infrastructure as Code tool for cloud and network; supports providers for network devices via REST APIs.
• Python with NETCONF/RESTCONF: Using libraries like `ncclient` (NETCONF) or `requests` (RESTCONF) for custom scripting.
• Jenkins/GitLab CI: To trigger automation jobs on code changes.
• Network automation platforms: e.g., Cisco NSO, Itential, NetYCE.

Choice depends on team skills, device types, and integration needs.

8. DevOps and CI/CD for Networking

Applying DevOps principles to networking involves:

• Infrastructure as Code (IaC): Store all configurations and automation code in Git.
• Continuous Integration: Automatically lint, validate, and test changes when code is pushed.
• Continuous Deployment: Automatically deploy validated changes to staging, then production.
• Monitoring and feedback: Use telemetry to verify success and detect issues.
• Collaboration: Network engineers use the same tools as developers (Git, CI/CD).

This reduces lead time for changes and improves reliability.

9. Securing Automation APIs

• Encryption: Use TLS/HTTPS for all API traffic.
• Authentication: Use strong methods: OAuth 2.0, client certificates, API keys, or username/password over TLS.
• Authorization: Implement role‑based access control (RBAC) to limit what each automation user can do.
• Audit logging: Log all API calls and changes for compliance and troubleshooting.
• Credential management: Never store credentials in plain text; use vaults (e.g., HashiCorp Vault) and secrets management in CI/CD.
• Network segmentation: Limit automation traffic to management networks.

10. Case Studies

• Cloud provider: Uses RESTCONF with YANG to provision new virtual routers in minutes, with telemetry to validate connectivity.
• Enterprise: Adopts Ansible and Git to automate ACL updates across 300 firewalls, reducing change time from 4 hours to 15 minutes.
• Service provider: Uses NETCONF for BGP policy updates, with candidate configurations and automated rollback if validation fails.

Quiz (46 Questions)

All answers are hidden; click Show Answer to reveal.

Exercises (24 Applied Problems)

Sample solutions are hidden – click to reveal.

<rpc message-id="101">
  <get-config>
    <source>
      <running/>
    </source>
  </get-config>
</rpc>
            

from ncclient import manager
with manager.connect(host='10.0.0.1', port=830, username='user', password='pass', hostkey_verify=False) as m:
    result = m.get_config('running', filter=('subtree', ''))
    print(result)
            

- name: Enable interface
  hosts: routers
  tasks:
    - name: Set interface up
      ios_config:
        lines:
          - no shutdown
        parents: interface GigabitEthernet0/1
            

<rpc>
  <edit-config>
    <target><candidate/></target>
    <config>
      <interfaces xmlns="urn:example:interfaces">
        <interface operation="delete">
          <name>eth0</name>
        </interface>
      </interfaces>
    </config>
  </edit-config>
</rpc>
            

import requests
url = "https://device/restconf/data/system/hostname"
headers = {"Accept": "application/yang-data+json"}
auth = ("user", "pass")
response = requests.get(url, headers=headers, auth=auth, verify=False)
print(response.json())
            

- name: Show running config
  ios_command:
    commands: show running-config
  register: result
- debug: var=result.stdout_lines
            

<rpc message-id="102">
  <commit/>
</rpc>
            

Homework (18 In‑Depth Assignments)

Sample answers are hidden; use them to guide your study.

Summary

This extended tutorial has provided a comprehensive exploration of network automation, focusing on NETCONF, RESTCONF, and REST APIs. We covered the drivers and principles of automation (idempotency, declarative vs. imperative), and dove deep into the NETCONF and RESTCONF protocols, their operations, and their use of YANG data models. We also examined vendor‑specific REST APIs, automation tools (Ansible, Terraform, Python), and the integration of automation into CI/CD pipelines. Security considerations and best practices were discussed, along with case studies illustrating real‑world implementations.

Network automation is a critical skill for modern network professionals, enabling scale, speed, and consistency. The quiz, exercises, and homework assignments are designed to build both theoretical knowledge and practical experience. In the next tutorial, we will explore SDN Management and Programmable Networks, extending automation concepts to software‑defined architectures.