CloudLabBox
Try the free demo

Network automation lab 18 of 27

Troubleshooting lab: NETCONF, RESTCONF and YANG automation

Four model-driven scripts and an IOS XE router hide seven faults between them: RESTCONF authentication, an ACL that silently drops NETCONF, a mistyped module name, a reply parsed in the wrong format, a string where YANG wants a boolean, a filter namespace that returns nothing, and an augmented node without its namespace. Diagnose each from the evidence and fix it.

Run this lab

It needs Lite: its 2 nodes are set to 2 vCPU and 5,120 MB in total. That fits the free demo too.

In your workspace: Shared, then Network Automation - CCNA and CCNP Automation guided labs, then 18 - Troubleshooting lab - NETCONF RESTCONF and YANG automation

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
2 vCPU, 5,120 MB
Smallest plan
Lite

The scenario

Kestrel Freight's NOC runs four small scripts against the Manchester router xe1: two RESTCONF ones (rc_report.py lists the hostname and interfaces, rc_change.py prepares GigabitEthernet2 as the spare WAN link) and two NETCONF ones (nc_report.py lists interfaces, nc_change.py creates Loopback0). Since a security hardening change last night and a "small tidy-up" of the scripts, every one of them fails, and one of them fails without saying so. Find each fault, fix it in the right place, and prove all four scripts work.

ItemIntended state
xe1 management10.10.20.21: SSH 22, RESTCONF on HTTPS 443, NETCONF 830, all authenticated against local users
Security policyonly SSH, HTTPS, NETCONF and ping may reach Gi1 (the hardening ACL MGMT-IN stays)
GigabitEthernet2description WAN to r1 (spare), enabled
Loopback010.255.0.3/32, description Router ID

What you’ll practise

  • Separate transport, authentication and data-model problems in NETCONF and RESTCONF
  • Read RESTCONF status codes and error bodies, and NETCONF rpc-errors, to locate a fault
  • Recognise silent failures such as an empty NETCONF reply from a wrong namespace
  • Fix payloads against the YANG model: module names, types and namespaces of augmented nodes
  • Fix device-side access (HTTP authentication, management ACLs) without weakening security

The tasks

  1. Gather the evidence
  2. RESTCONF says 401: who decides?
  3. Fix rc_report.py (two faults)
  4. Fix rc_change.py
  5. NETCONF times out: find what's in the way
  6. Fix nc_report.py: the silent failure
  7. Fix nc_change.py

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting lab - NETCONF RESTCONF and YANG automation2 nodes and 1 network, 2 links. Every link is listed as text below the diagram.devboxxe1Mgmteth0Gi1
2 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • devbox eth0 to Mgmt (network)
  • xe1 Gi1 to Mgmt (network)
Nodes in Troubleshooting lab: NETCONF, RESTCONF and YANG automation, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
devboxEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
xe1Cisco CSR 1000vcsr1000vng-universalk9.17.03.08a-serial1 vCPU, 4,096 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Network Automation - CCNA and CCNP Automation guided labs.

  3. Open 18 - Troubleshooting lab - NETCONF RESTCONF and YANG automation and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network automation labs

All Network automation labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.