27/08/2026
π CCNP ENTERPRISE LAB: NETCONF OVER SSH USING GNS3
Want to understand Network Automation instead of configuring every Cisco router manually?
Let's build a practical NETCONF over SSH lab using GNS3. π
π WHAT ARE WE BUILDING?
NETCONF Client β¬οΈ SSH β¬οΈ Cisco IOS-XE Router
NETCONF allows automation software to communicate with a Cisco device and retrieve or modify configuration using structured data.
π§© TECHNOLOGIES INVOLVED
πΉ NETCONF β Network management/configuration protocol
πΉ YANG β Data modelling language
πΉ SSH β Secure transport
πΉ GNS3 β Network simulation/emulation platform
πΉ Python β Can be used to automate NETCONF operations
π₯οΈ SAMPLE GNS3 LAB
Ubuntu/Linux PC
192.168.10.10/24
β¬οΈ
Cisco IOS-XE Router
192.168.10.1/24
The Linux machine acts as the NETCONF client, while the Cisco router acts as the NETCONF server.
βοΈ STEP 1 β CONFIGURE THE ROUTER
Router # configure terminal
Router(config) # hostname R1
R1(config) # interface GigabitEthernet0/0
R1(config-if) # ip address 192.168.10.1 255.255.255.0
R1(config-if) # no shutdown
R1(config-if) # exit
π€ STEP 2 β CREATE AN ADMIN USER
R1(config) # username admin privilege 15 secret Cisco123
π STEP 3 β CONFIGURE SSH
R1(config) # ip domain-name worldlink.local
R1(config) # crypto key generate rsa modulus 2048
R1(config) # ip ssh version 2
Configure the VTY lines:
R1(config) # line vty 0 4
R1(config-line) # login local
R1(config-line) # transport input ssh
R1(config-line) # exit
π STEP 4 β ENABLE AAA
R1(config) # aaa new-model
R1(config) # aaa authentication login default local
R1(config) # aaa authorization exec default local
π STEP 5 β ENABLE NETCONF-YANG
On a supported IOS-XE image:
R1(config) # netconf-yang
This enables the NETCONF/YANG management interface.
π STEP 6 β VERIFY
Check SSH:
R1 # show ip ssh
Check NETCONF/YANG:
R1 # show netconf-yang status
You want the NETCONF/YANG service to be operational.
π§ͺ STEP 7 β TEST SSH FROM LINUX
From the GNS3 Linux/Ubuntu machine:
ssh [email protected]
Enter:
Cisco123
If you can log in, SSH connectivity is working. β
π€ STEP 8 β TEST NETCONF WITH PYTHON
Install the NETCONF Python library:
pip3 install ncclient
Create a Python script:
from ncclient import manager
device = {
"host": "192.168.10.1",
"port": 830,
"username": "admin",
"password": "Cisco123",
"hostkey_verify": False
}
with manager.connect(**device) as m:
print("NETCONF connection successful!")
print(m.server_capabilities)
Run:
python3 netconf_test.py
If successful, you have established a NETCONF session over SSH. π
π§ UNDERSTAND THE CONNECTION
The automation process looks like this:
Python Application
β¬οΈ
NETCONF Client
β¬οΈ
SSH β TCP Port 830
β¬οΈ
NETCONF Server
β¬οΈ
YANG Data Models
β¬οΈ
Cisco IOS-XE
This is the foundation of network programmability and automation.
β CCNP ENCOR EXAM TIP
Don't confuse these technologies:
SSH π
Provides the secure transport.
NETCONF βοΈ
Provides the network management protocol.
YANG π
Defines how configuration and operational data are structured.
Python π
Can automate NETCONF operations.
Remember:
YANG = DATA MODEL
NETCONF = PROTOCOL
SSH = SECURE TRANSPORT
Python = AUTOMATION
β οΈ IMPORTANT
The exact NETCONF commands depend on the IOS-XE image running in GNS3. Packet Tracer does not provide a full IOS-XE NETCONF environment, which is why GNS3/CML is more appropriate for this CCNP automation lab.
π JLINK TECH
Learn β’ Practice β’ Automate β’ Become a Network Engineer