What is NETCONF, and which transports does it run over?

NETCONF (Network Configuration Protocol) is an IETF-standard protocol that uses YANG data models to communicate with network devices. It runs over SSH, TLS and (rarely) SOAP.

* NETCONF's four layers: YANG-modelled content, the operations on it, XML RPC messages, and a secure transport underneath. *

NETCONF is the protocol that carries YANG-modelled data between a management application and a device. In practice it almost always runs over SSH, on the standard port 830, which gives it encryption and authentication for free.

What it brings over older approaches:

• it uses the YANG models as the contract for the data,
• messages are structured XML remote procedure calls instead of text commands,
• it separates configuration data from operational data,
• it supports transactions: test a configuration, apply it, roll back.

It is defined in RFC 6241 and is widely supported, for example on Cisco IOS XE, Juniper Junos and Nokia SR OS.

Go deeper:

• RFC 6241 — Network Configuration Protocol (NETCONF) — the protocol standard, including the layer model.
• NETCONF — Wikipedia — overview and related RFCs.