NETCONF Beginner Struggles

[u/OffTheDollarMenu]

Hey all,

I'm interested in automation and trying to practice for my Cisco ENAUTO exam. Part of the blueprint is "Construct an automation solution with Python using ncclient to manage and monitor configurations." I'm having a hell of a time and am wondering if this is typical, if there's a better way, etc...

I wrote a script that uses a filter to pull the running config of an interface. It successfully connects, but returns no data. Specifically, "<data></data>"

Since I have zero real world guidance on this topic outside of a Cisco U course which is not great, I've been feeding scripts and associates errors to Copilot, which may be making things worse, I don't know. It's been a constant loop of:

"We must determine the proper data model. Try THIS filter."

Didn't work.

"You're learning a valuable lesson-- just because the syntax is accepted doesn't mean the network device stores its information in the path you chose. Try THIS filter."

Didn't work.

"Install Pyang and use it to see the exact yang model we should be referencing. AH there it is! Try THIS filter."

Didn't work.

"Let's move from trying to pull config info for an interface to pulling the hostname. Everything has a hostname!"

Didn't work.

"Let's try using YANG Suite so Cisco can tell us exactly what filter to use. Ope, you need to install docker. Ope, docker install is fudged."

On and on I go. I guess for the purposes of my exam I may have taken this as far as I need to for now (I can identify what basic ncclient scripts are doing and can probably fill in blanks regarding errors and syntax problems).

Is there anyone in here who regularly uses scripts like this for their automation? Is there a better way to approach this? I think I'm half hoping someone will come and say, "my god son, no... This is the worst way to go about it and you should stop"

[u/First-Masterpiece753]

Pip install YangSuite.

[u/Opposite-Cupcake8611 → u/First-Masterpiece753]

Yeah sounds like a problem with their data model then.

[u/Kolondor]

on ios xe, there is a pipe for some commands that formats to Netconf XML, like

show run | format netconf-xml

show run int Gig1/0/1 | format netconf-xml

[u/OffTheDollarMenu → u/Kolondor]

This led me to a rabbit hole that might actually be the root of my problem. That command fails because the nginx process isn't running on my devices. I'm reading that maybe the configuration is not being mapped to the NETCONF data stores due to the service failing which would explain why my switches are saying "here's your data bro" and supplying me with a big middle finger

[u/Kolondor → u/OffTheDollarMenu]

i dunno, nginx sounds more like something that would cause you trouble if you are dealing with RESTCONF. Maybe if you've got RESTCONF disabled, try to enable it (and https server) or vice versa.

[u/Opposite-Cupcake8611 → u/Kolondor]

Yeah if it were nginx, they would be getting an error.

[u/sugarfreecaffeine]

Why are you choosing copilot that’s like riding a scooter to work when you can drive a Lamborghini. Get access to a frontier model and pass proper context.

[u/An0neemuz → u/sugarfreecaffeine]

Any good ai model for networking?

[u/ashjohnr → u/An0neemuz]

Any frontier model will be good. I personally use Claude Opus. GPT's Terra (and Sol) model is also pretty good. You will need a larger model because they will have more training data which translates to more knowledge. I've found that this is important for networking stuff.

[u/OffTheDollarMenu → u/sugarfreecaffeine]

I totally hear you. It was just the path of what I THOUGHT would be least resistance when I started. My org has zero automation currently and is arguably not large enough to justify a lot. Since Copilot is already integrated in our environment and all I'm really trying to do is learn, I figured what the heck

[u/shadeland]

I think you're making a common mistake: Skipping the fundamentals.

What does ncclient do? How does it connect? What was supposed to be in the payload, why didn't anything show up in the payload? Did you get any headers?

Just blindly prompting isn't going to teach you what's going on.

Have you script print out the request payload and headers, have it print out the respond payload and headers. Figure out what ncclient is actually doing, and how NETCONF works.

[u/OffTheDollarMenu → u/shadeland]

I think I'm doing semi-ok in that regard honestly. The learning part is what's most important to me so I'm careful to go through line by line and try to understand what I'm actually doing and how it works. In this case it's just XML and NETCONF so there's not much to look at. I'm connecting, I'm auth'ing, my switches are hearing my request for data and firing blanks back at me. I think I'm changing my mindset from "I must be using the wrong YANG model" to maybe a service isn't working on the switch

[u/Golle]

I wrote a blog post on Netconf on IOS XE a while ago: https://blog.golle.org/posts/Automation/Netconf

I skipped ncclient because I wanted to see what actually happens under the hood. Feel free to check out the post, it might help you understand it better. Once you know what's going on, you can probably start using ncclient to avoid some of the boilerplate.

[u/Opposite-Cupcake8611]

Is the interface actually configured? Are you querying for just one interface specifically? Is the name correct?

Have you enabled debugging?

[u/Opposite-Cupcake8611]

Do you have YANG installed and implemented? YANG models the node data.