Unable to enable Restconf on Cisco C9300, IOS-XE 17.3.4

[Smithers]

Hey Guys,

i tried basically everything in the internet.

My ::> show run

Any more parts interesting for you? What am I missing.

> -----curl https//:{host}:443 -u "name:pw" ------------ is not working either! Postman neither! Browser neither...

Chrome is giving me:

Has anyone an idea? Thanks to everyone!

[balaji.bandi]

what License you have on the switch ?

can you post @:

# show platform software yang-management process  

most of the time netconf uses port TCP 830

some reference :

https://developer.cisco.com/docs/ios-xe/#!enabling-netconf-on-ios-xe/163

[Smithers]

Hi! Thanks for the fast response!
This is my Output:
_________
Switch-ZTP-Telemetry-Generic#show platform software yang-management process
confd : Running
nesd : Running
syncfd : Running
ncsshd : Running
dmiauthd : Running
nginx : Running
ndbmand : Running
pubd : Running
gnmib : Running
________


Concerning the licences. I've got network advantage & dna advantage.

Should be possible to enable RESTCONF... don't you think? (RESTCONF, not NETCONF btw )

[balaji.bandi]

just tested with Cat 9300 netconf works as expected :

#show run | in netco
netconf-yang
netconf-yang feature candidate-datastore

#show netconf-yang datastores
Datastore Name : running
Datastore Name : candidate

# show netconf-yang sessions
R: Global-lock on running datastore
C: Global-lock on candidate datastore
S: Global-lock on startup datastore

Number of sessions : 1

session-id transport username source-host global-lock
--------------------------------------------------------------------------------
24 netconf-ssh mgmt 10.10.10.5 None

root@Linux# ssh bbcisco@10.10.10.10 -p 830 -s netconf
The authenticity of host '[xxxxxxxxxxxx]:830 ([xxxxxxxxxxx]:830)' can't be established.
RSA key fingerprint is SHA256:hAiw/dNTtVPwFVVpu6S+fAAdrIZf+6YSkvsawddhaug.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[xxxxxxxxxx]:830' (RSA) to the list of known hosts.
mgmt@xxxxxxxxxx's password:
<?xml version="1.0" encoding="UTF-8"?>
<hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<capabilities>
<capability>urn:ietf:params:netconf:base:1.0</capability>
<capability>urn:ietf:params:netconf:base:1.1</capability>
<capability>urn:ietf:params:netconf:capability:confirmed-commit:1.1</capability>
<capability>urn:ietf:params:netconf:capability:confirmed-commit:1.0</capability>
<capability>urn:ietf:params:netconf:capability:candidate:1.0</capability>
<capability>urn:ietf:params:netconf:capability:rollback-on-error:1.0</capability>
<capability>urn:ietf:params:netconf:capability:validate:1.0</capability>
<capability>urn:ietf:params:netconf:capability:validate:1.1</capability>

.....

<capability>
urn:ietf:params:netconf:capability:notification:1.1
</capability>
</capabilities>
<session-id>24</session-id></hello>]]>]]>

[Smithers]

So netconf is working on my device too!

But i cant access the switch via HTTP / RESTCONF. You have any idea on that too?

[balaji.bandi]

aaa new-model
!
aaa authorization exec default local

!

ip http server
ip http authentication local
ip http secure-server 

!

restconf

From my Linux box :

# curl -i -k -X "OPTIONS" "https://10.10.9.100:443/restconf/data/Cisco-IOS-XE-native:native/logging/monitor/severity" -H 'Accept: application/yang-data+json' -u 'admin:Cisco123'
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 24 Oct 2022 14:18:32 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Allow: DELETE, GET, HEAD, PATCH, POST, PUT, OPTIONS
Cache-Control: private, no-cache, must-revalidate, proxy-revalidate
Accept-Patch: application/yang-data+xml, application/yang-data+json
Pragma: no-cache

[Smithers]

Unfortunately did not change anything

any more ideas?

[balaji.bandi]

what did not change ? can you explain what steps you followed ?

post the latest config for us to review again.

[Smithers]

Thanks for your response!
So i added to my config what you wrote:

aaa new-model
!
aaa authorization exec default local

!

ip http server
ip http authentication local
ip http secure-server 

!

restconf

_____________

But i still can't access my switch. Neither with Postman, Curl, Browser, nor Java OkHTTP Client.

I always get some errors related to something like this.
SSL Handshake failed.

Received fatal alert: internal_error > at at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:133)

The above mentioned Chrome SSL error message.

My Config is attached.

[balaji.bandi]

seems to be some bugs on 17.3.X code, don't have bug in hand to give you.

Try postman settings :

https://developer.cisco.com/codeexchange/github/repo/jeremycohoe/cisco-ios-xe-postman-collections