Overview

NETCONF is a standards-based protocol for managing network device configuration through structured operations and YANG data models. It is designed for automation workflows where configuration should be validated, applied, retrieved, and rolled back in a controlled way.

For xSONiC deployments, NETCONF can help network teams move from manual CLI changes to model-driven operations across data center and campus switching platforms.

NETCONF Operations

Operation	Purpose	xSONiC Automation Use
get	Retrieve running state and operational data.	Audit device state before and after changes.
get-config	Retrieve configuration from a datastore.	Compare source of truth with device configuration.
edit-config	Apply configuration changes.	Push interface, VLAN, routing, or policy updates.
validate	Check candidate configuration.	Catch schema or logic errors before commit.
commit	Make candidate configuration active.	Apply controlled changes after validation.
discard-changes	Remove pending candidate changes.	Abort failed or unapproved updates.

Datastore Workflow

Automation source of truth
        |
        v
Build candidate configuration
        |
        v
Validate candidate
        |
        v
Commit to device
        |
        v
Retrieve and compare running state

Why Model-Driven Management Matters

Manual Workflow Risk	NETCONF/YANG Benefit
CLI output changes break scripts.	Structured data model is easier to parse.
Partial changes create drift.	Candidate and commit workflow improves control.
Change rollback is manual.	Automation can store intended state and rollback paths.
Fleet-wide consistency is hard.	Same model can apply across many devices.

Security and Access Controls

NETCONF should be treated as a privileged management interface.

• Use role-based credentials with least privilege.
• Restrict management reachability to trusted automation systems.
• Log configuration changes and automation job identity.
• Validate device certificates or SSH trust policy as part of onboarding.
• Separate read-only inventory workflows from write-capable deployment workflows.

Deployment Checklist

1. Identify the configuration domains suitable for NETCONF automation.
2. Confirm YANG model coverage for target features.
3. Define source-of-truth data structures.
4. Build validate-before-commit workflows.
5. Add drift detection by comparing intended and running state.
6. Test rollback behavior before broad rollout.

xSONiC Platform Fit

NETCONF is relevant across xSONiC data center and campus switching platforms. It is most valuable when teams manage repeated patterns: leaf/spine routing, VLAN and VRF policy, interface templates, telemetry configuration, and standard operational checks.