A Netconf session is the logical connection between a network configuration application and a network device. A device should be capable of supporting multiple sessions and atleast one Netconf session.

Characteristics of a netconf session:

• Netconf is connection-oriented - SSH is the underlying transport.

• The netconf client establishes session with the server.

• Netconf sessions are established with the hello message. Features and capabilities are announced.

• Sessions can be terminated using the close or kill messages.

Basic Netconf operations:

• Get configuration <get-config>

• Get all information <get>

• Edit configuration <edit-config>

• Copy configuration <copy-config>

  Note	<copy-config> does not support source attribute with “data store” at present.

• <lock>, <unlock>

• <kill-session>

• <close-session>

• Commit configuration <commit>

Each feature has a defined Yang Model which is synthesized from the schemas. A model is published in a tree format and includes:

• Top level nodes and their subtrees

• Subtrees that augment nodes in other yang models

Example: The aaa Yang model
(exec-19.42.10) bash-4.2$ pyang -f tree Cisco-IOS-XR-aaa-lib-cfg.yang
module: Cisco-IOS-XR-aaa-lib-cfg
    +--rw aaa
       +--rw accountings
       |  +--rw accounting* [type listname]
       |     +--rw type                  xr:Cisco-ios-xr-string
       |     +--rw listname              xr:Cisco-ios-xr-string
       |     +--rw rp-failover?          dt1:Aaa-accounting-rp-failover
       |     +--rw broadcast?            dt1:Aaa-accounting-broadcast
       |     +--rw type-xr?              dt1:Aaa-accounting
       |     +--rw method1?              dt1:Aaa-method-accounting
       |     +--rw method2?              dt1:Aaa-method-accounting
       |     +--rw method3?              dt1:Aaa-method-accounting
       |     +--rw method4?              dt1:Aaa-method-accounting
       |     +--rw server-group-name1?   string
       |     +--rw server-group-name2?   string
       |     +--rw server-group-name3?   string
       |     +--rw server-group-name4?   string
       +--rw authorizations
       |  +--rw authorization* [type listname]
       |     +--rw type                  xr:Cisco-ios-xr-string
       |     +--rw listname              xr:Cisco-ios-xr-string
       |     +--rw method1?              dt1:Aaa-method
       |     +--rw method2?              dt1:Aaa-method
       |     +--rw method3?              dt1:Aaa-method
       |     +--rw method4?              dt1:Aaa-method
       |     +--rw server-group-name1?   string
       |     +--rw server-group-name2?   string
       |     +--rw server-group-name3?   string
       |     +--rw server-group-name4?   string
       +--rw accounting-update!
       |  +--rw type                 dt1:Aaa-accounting-update
       |  +--rw periodic-interval?   uint32
       +--rw banner
       |  +--rw login?   string
       +--rw authentications
          +--rw authentication* [type listname]
             +--rw type                  xr:Cisco-ios-xr-string
             +--rw listname              xr:Cisco-ios-xr-string
             +--rw method1?              dt1:Aaa-method
             +--rw method2?              dt1:Aaa-method
             +--rw method3?              dt1:Aaa-method
             +--rw method4?              dt1:Aaa-method
             +--rw server-group-name1?   string
             +--rw server-group-name2?   string
             +--rw server-group-name3?   string
             +--rw server-group-name4?   string

Advantages of using the Yang model are:

• Yang supports programmatic interfaces.

• Yang supports simplified network management applications.

• Yang supports interoperability that provides a standard way to model management data.

The workflow displayed here, will help the user to understand how Netconf-Yang can configure and control the network with minimal user intervention. The required components:

• Cisco 8000 Series Router with Netconf capability

• Netconf Client Application with connection to the router

The Yang models can be downloaded from a prescribed location (ftp server) or can also be retrieved directly from the router using the get-schema operation.

For a feature, separate Yang models are available for configuring the feature and to get operational statistics (show commands). The -cfg.yang suffix denotes configuration and -oper*.yang is for operational data statistics. In some cases, -oper is followed by -sub, indicating that a submodule(s) is available.

For a list of supported Yang models, see https://github.com/YangModels/yang/tree/master/vendor/cisco/xr

In case of a DoS (Denial of Service) attack on Netconf, wherein, Netconf receives numerous requests in a short span of time, the router may become irresponsive if Netconf consumes most of the bandwidth or CPU processing time. This can be prevented, by limiting the traffic directed at the Netconf agent. This is achieved using the netconf-yang agent rate-limit and netconf-yang agent session commands.

If rate-limit is set, the Netconf processor measures the incoming traffic from the SSH server. If the incoming traffic exceeds the set rate-limit, the packets are dropped.

If session-limit is set, the Netconf processor checks for the number of open sessions. If the number of current sessions is greater than or equal to, the set limit, no new sessions are opened.

Session idle- timeout and absolute-timeout also prevent DoS attacks. The Netconf processor closes the sessions, even without user input or intervention, as soon at the time out session is greater than or equal to the set time limit.

The relevant commands are discussed in detail, in the System Security Command Reference for Cisco 8000 Series Routers