What is the proper package/nNED to talk to NX-OS via NETCONF?

[cspeidel]

I'm trying to connect to a Nexus 3K using NETCONF. I know NETCONF is running because I can SSH to the box with the xmlagent option and pass XML back and forth.

What is the proper NED to use with Nexus and NETCONF?

I am using the following config. The password seems correct, because if I change it in NSO to a wrong one, NSO reports a bad user/pass. However, with the correct password I am getting an NSO internal error.

admin@ncs> show configuration devices device n3k

address   a.b.c.d;

port      22;

ssh {

    host-key ssh-rsa {

        key-data "<key-removed>";

    }

}

authgroup labauth;

device-type {

    netconf {

        ned-id netconf;

    }

}

state {

    admin-state unlocked;

}

And the authgroup:

admin@ncs> show configuration devices authgroups group labauth

umap admin {

    remote-name     admin;

    remote-password <removed>;

}

But I get the following when trying to connect:

admin@ncs> request devices device n3k connect

result false

info internal error

[alam.bilal]

Internal error usually indicates an issue which engineering should investigate further. Please raise a ticket.

For devices/platform-family that support NETCONF, the YANG models are supplied by the vendor. To use the network-element with NSO, a NETCONF NED can be auto-generated and built from the supplied YANG models.

Please take a look at:

ncs-make-package --help

Specifically:

ncs-make-package --netconf-ned DIR package-name

The above would generate the corresponding NED package which can then be built and placed into the NSO's runtime packages directory. Followed by a "packages reload" in NSO.

[alam.bilal · Accepted solution]

For Cisco, the YANG models can be found here:

https://github.com/YangModels/yang/tree/master/vendor/cisco/

[pralala]

Hi,
I have been trying to use the above yang models to compile with 4.4.2.1. I keep getting "internal error". Did you/anyone try to compile the above yang models?
I am trying to compile the following yang files:yang/vendor/cisco/xe/1661 at master · YangModels/yang · GitHub

[Jan Lindblad]

I compile lots of different versions of NX and XE models frequently. You can contact me directly to discuss details.

I note that you are mentioning XE models in your link, but an NX device on the subject line. They are not compatible.

[pralala]

Hi Jan,
That is correct. What i need is XE models. I saw a link Bilal posted for XE models and thought that someone must have used to compile and correct those yang models to avoid internal error. Hence, I posted reply on this thread.

Regards,
Pratik Lala

[Jan Lindblad]

Your best option is to download the YANG models directly from the device. That way you know you'll get the right version. You can do that using the Pioneer package on NSO, if you like. There are many threads on the Hub about compiling NETCONF NEDs if you search around a bit. If you have specific trouble compiling a NED package, feel free to contact me directly.

[pralala]

Hi Jan,
I managed to compile from the above source that Bilal had provided .
The original issue was that i was getting the xe yang files from a team i am working with. With their yang models, i always used to end up getting "internal error". I still have not been able to find out the root cause. Tried with verbose and messing around with yanger. still no luck.
But, for now, i have something to work with.

[Jan Lindblad]

Great! If you have that original package you got, I'd have a look to figure out what caused our tools to trip.

[teju321]

Dear Jan Lindblad,

Greetings for the day,

I am making use of cisco NSO to configure my netconf devices. Initially I tried to make use of pioneer package but unable to fetch yang model using pioneer the error is like "not advertising yang models". So, I have tried giving command ncs-make-package --netconf-ned DIR package-name(cisco iosxr-6.1.3 yang models from github).After giving make command in /ncs-run/package-name/src  we are getting yang model compilation errors like "illegal character after \ ","restriction require instance is not valid"/. could you please help me out regarding this and let me you need any further information.

Thanks for your time and consideration,

Regards,

Tejaswini

[scadora]

Hi, Tejaswini.

It looks like there was a syntax problem in a couple of the 6.1.3 models in github.  I'm following up with this and hope to get corrections posted to github soon.  If you want to make progress in the meantime, you can manually replace the "\" characters with "\\" in Cisco-IOS-XR-types.yang, Cisco-IOS-XR-infra-policymgr-cfg.yang, and Cisco-IOS-XR-crypto-macsec-pl-oper-sub1.yang.  I've put the diff below that enabled me to compile the NED for 6.1.3. 

Thanks,

Shelly

diff ./Cisco-IOS-XR-types.yang ~/yang/vendor/cisco/xr/613/Cisco-IOS-XR-types.yang
111c111
< "[0-9]|25[0-5])\\.){3}([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]"+
---
> "[0-9]|25[0-5])\.){3}([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]"+
127c127
< "(([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\\.){3}"+
---
> "(([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}"+
147,152c147,152
< pattern "(([a-zA-Z0-9_]*\\d+/){3,4}\\d+)|"+
< "(([a-zA-Z0-9_]*\\d+/){3,4}\\d+\\.\\d+)|"+
< "(([a-zA-Z0-9_]*\\d+/){2}([a-zA-Z0-9_]*\\d+))|"+
< "(([a-zA-Z0-9_]*\\d+/){2}([a-zA-Z0-9_]+))|"+
< "([a-zA-Z0-9_-]*\\d+)|"+
< "([a-zA-Z0-9_-]*\\d+\\.\\d+)|"+
---
> pattern "(([a-zA-Z0-9_]*\d+/){3,4}\d+)|"+
> "(([a-zA-Z0-9_]*\d+/){3,4}\d+\.\d+)|"+
> "(([a-zA-Z0-9_]*\d+/){2}([a-zA-Z0-9_]*\d+))|"+
> "(([a-zA-Z0-9_]*\d+/){2}([a-zA-Z0-9_]+))|"+
> "([a-zA-Z0-9_-]*\d+)|"+
> "([a-zA-Z0-9_-]*\d+\.\d+)|"+
165c165
< pattern "[\\w\\-\\.:,_@#%$\\+=\\|;]+";
---
> pattern "[\w\-\.:,_@#%$\+=\|;]+";
188c188
< pattern "[a-zA-Z0-9_]*\\d+";
---
> pattern "[a-zA-Z0-9_]*\d+";
196c196
< pattern "[a-zA-Z0-9_]*\\d+";
---
> pattern "[a-zA-Z0-9_]*\d+";
204c204
< pattern "[a-zA-Z0-9_]*\\d+";
---
> pattern "[a-zA-Z0-9_]*\d+";
212c212
< pattern "[a-zA-Z0-9_]*\\d+";
---
> pattern "[a-zA-Z0-9_]*\d+";
248c248
< pattern "[a-fA-F0-9]{4}(\\.[a-fA-F0-9]{4}){2}";
---
> pattern "[a-fA-F0-9]{4}(\.[a-fA-F0-9]{4}){2}";
257c257
< pattern "[a-fA-F0-9]{2}(\\.[a-fA-F0-9]{4}){0,6}";
---
> pattern "[a-fA-F0-9]{2}(\.[a-fA-F0-9]{4}){0,6}";
267c267
< pattern "[a-fA-F0-9]{4}(\\.[a-fA-F0-9]{4}){2}\\.[a-fA-F0-9]{2}";
---
> pattern "[a-fA-F0-9]{4}(\.[a-fA-F0-9]{4}){2}\.[a-fA-F0-9]{2}";
276c276
< pattern "[a-fA-F0-9]{4}(\\.[a-fA-F0-9]{4}){2}";
---
> pattern "[a-fA-F0-9]{4}(\.[a-fA-F0-9]{4}){2}";
284,285c284,285
< pattern "[a-fA-F0-9]{4}(\\.[a-fA-F0-9]{4}){2}\\.[a-fA-F0-9]{2}"+
< "\\-[a-fA-F0-9]{2}";
---
> pattern "[a-fA-F0-9]{4}(\.[a-fA-F0-9]{4}){2}\.[a-fA-F0-9]{2}"+
> "\-[a-fA-F0-9]{2}";
295c295
< "[a-fA-F0-9]{2}(\\.[a-fA-F0-9]{4}){3,9}\\.[a-fA-F0-9]{2}";
---
> "[a-fA-F0-9]{2}(\.[a-fA-F0-9]{4}){3,9}\.[a-fA-F0-9]{2}";
307c307
< pattern "[a-zA-Z][\\w\\-]*";
---
> pattern "[a-zA-Z][\w\-]*";
315c315
< pattern "(\\p{IsBasicLatin}|\\p{IsLatin-1Supplement})*";
---
> pattern "(\p{IsBasicLatin}|\p{IsLatin-1Supplement})*";
326c326
< pattern "((\\p{IsBasicLatin}|\\p{IsLatin-1Supplement})*)"+
---
> pattern "((\p{IsBasicLatin}|\p{IsLatin-1Supplement})*)"+
338c338
< pattern "([a-zA-Z0-9_]*\\d+/){3}([a-zA-Z0-9_]*\\d+)";
---
> pattern "([a-zA-Z0-9_]*\d+/){3}([a-zA-Z0-9_]*\d+)";
347c347
< pattern "([a-zA-Z0-9_]*\\d+/){1,2}([a-zA-Z0-9_]*\\d+)";
---
> pattern "([a-zA-Z0-9_]*\d+/){1,2}([a-zA-Z0-9_]*\d+)";
355,356c355,356
< pattern "((([a-zA-Z0-9_]*\\d+)|(\\*))/){2}(([a-zA-Z0-9_]*\\d+)"+
< "|(\\*))";
---
> pattern "((([a-zA-Z0-9_]*\d+)|(\*))/){2}(([a-zA-Z0-9_]*\d+)"+
> "|(\*))";

[teju321]

Hi shelly,

Thank you for your reply after trying that...I will get back to you.

Thanks once again,

Tejaswini.

[Jan Lindblad]

The NETCONF interface on NX is very new. There are many issues being ironed out as we speak, so for the time being, consider it experimental. If you're interested to work with it, don't hesitate to reach out to me.

[cspeidel]

Thank you Jan. I am updating some NX code and will test again with NETCONF at that point. By the way, nice videos from developer days!