Modern approaches for IOS

XE network device
management on Cat9K
with Cisco IOS XE

Jeremy Cohoe Ashil Parekh

Technical Marketing Engineer Product Management
@jeremycohoe @Ashil34571977

Story DeWeese
Technical Marketing Engineer
@storydeweese

DEVNET-1110
Who We Are

Story DeWeese Jeremy Cohoe Who you are:

Technical Marketing Technical Marketing 1. Public sector
Engineer Engineer 2. Financial
3. Education
4. Defense
Ashil Parekh
5. MSP/Self
Product Management
6. Others

We see “web scalers” as leaders in Programmability & Automation adoption

Closely followed by: Financial, Education, Defense, Government, MSP… etc

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 2

 Agenda 01 Intro to Programmability
02 YANG, API, Tooling
11:30 – 11:50: Introduction / YANG & API / Tooling

10 mins Ashil – Why we are here

03 Device Onboarding
10 mins - Jeremy - Intro to the API’s & Tooling

11:50 – 12:05: Device Onboarding (SZTP)

04 Device Configuration
5 mins – Ashil

10 mins – Story

05 Device Monitoring
12:05 - 12:35: Configuration Management

10 mins - Ashil

06 Device Optimizations
20 mins - Jeremy

12:35 - 12:55: Monitoring and Reporting

07 Resources, Closing & Q&A

5 mins - Ashil

15 mins – Story – Telemetry & Sustainability

12:55 – 13:05: Optimization and Troubleshooting

10 mins – Story Livetools

13:05 - 13:15: Conclusion, Resources and Questions

10 mins – Story

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 3

Cisco Webex App • Please ask any questions or share any
comments you have within the Webex
Space
Questions?
• We may have time for Q&A towards
Use Cisco Webex App to chat the end of the session
with the speaker after the session
• We are happy to discuss with you 1:1
after the seminar is over as well
How
1 Find this session in the Cisco Live Mobile App

2 Click “Join the Discussion”

3 Install the Webex App or go directly to the Webex space

4 Enter messages/questions in the Webex space

Enter your personal notes here

Webex spaces will be moderated by the speaker until June 13, 2025.

© 2025 Cisco and/or its affiliates. All rights reserved. BRKOPS-1401 4

Intro to Programmability
 AI Generated Images
Prompt: Happy network engineer vs sad
network engineer - same person

➢ Fewer Sites
➢ Less Endpoints
➢ Simple Network Architecture

© 2025 Cisco and/or its affiliates. All rights reserved.

From Networks to Business Impact: The Automation
Advantages

56% 59% 29%

Improved Operational Efficiency Operating Cost Reduction Faster Service Deployment

More than 80% organizations were able to

More than 80% organizations were able reduce 95% Respondents were able to improve the
achieve process standardization, reduce Human
network outages and improve security and expedite the service deployment time and align
errors and improve Mean Time to Resolution(
compliance - [1] with their business transformation goals - [1]
MTTR) - [1]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 8

State of Network Automation Adoption

Manual Network Legacy Network Lack of Skills

Management Infrastructure
65% activities performed manually 46% IT Leaders say that Legacy 42% of IT Leaders claim their
which causes 80% of outage and systems are difficult to organizations lack network
22% of data breach[1] automate [2] automation skills [2]

[1] - Enterprise Network Automation, Why do you need it? – Deloitte

[2] – Global Network Automation Report - IDC

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 9
If It Feels Repetitive, It’s Not Automation

IoT

End-User Devices Servers & Databases IoT Devices

DC WA ISP
N

CLIs / Script

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 10

The First Generation of Network Automation:
Scripts and Struggles

DC WA ISP
N

CLI Scripting Using Python

CLIs / Script

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 11

Structured Data: The Fuel for Reliable Automation
Feature / Capability Structured Data (YANG, XML/JSON) Unstructured Data (CLI)

Designed For Machine-to-machine communication Human-to-machine interaction

Data Format Structured (XML/JSON following a schema) Free-form text, tables, headings

Parsing & Automation Easy to parse programmatically Requires fragile screen-scraping

Validation Schema-based (YANG) validation before commit No built-in validation; errors caught only at runtime

Structured errors (e.g., <rpc-error> with tags and

Error Handling Textual errors, inconsistent messages across vendors
messages)

Transactions Supports atomic commits (all-or-nothing changes) Commands executed line-by-line; no rollback capability

Consistency Across Standard models (OpenConfig, IETF) enable multi-

Vendor-specific CLI syntax and outputs
Vendors vendor support

Change Safety Supports rollback, confirmed commits No native rollback; must script it manually

Monitoring Integration Works with model-driven telemetry (push-based) Relies on CLI polling or SNMP

Scalability Efficient for managing 100s or 1000s of devices at once Slow, sequential; complex to scale manually

Extensibility Models can evolve with versioning and modularization Hard to adapt; even minor format changes break scripts

Feedback Loop Clean input/output model for closed-loop automation No structured input/output contract

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 12

Structured Data: The Fuel for Reliable Automation

Unstructured Data Structured Data

VS
(CLI) (YANG, XML/JSON)

Human-Oriented, Unstructured Text Data Format & Parsing Machine-Oriented, Structured Data

Low-Level, Procedural Logic, No intent Abstraction & Intent Intent-Based and Declarative, Describe what
abstraction, just commands you want (intent)

Siloed and Manual, Poor integration with API-Driven and Event-Aware, Easily integrates
IT Ecosystems Integration
ITSM, CI/CD, observability tools with ITSM, GitOps, telemetry pipelines

Syntax differs by vendor, OS, and version, Multi-Vendor Complexity Standard YANG models across vendors,
Scripts are bloated with conditionals Unified logic for multi-vendor networks
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 13
What’s the Difference?

Tools Protocol Stack

Mang
Data
Open Source or Infrastructure Protocol Data ISP
Resources Modeling Encoding Transport DC WAN
Automation Tools or Models
Language
Operation
Unstructured Data
Using

Vendor
- CLI - - SSH
Specific

Yang Suite
Structured Data

NETCONF
Vendor XML SSH
Using

RESTCON
IETF xPaths YANG JSON HTTPS
gNMI
OpenConfig PROTOBUF TLS
gRPC

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 14

Modern Network Automation Architecture

Automation Engine Network Infrastructure

User Interface Provisioning, Remediation, Compliance

WAN ISP
DC

Web Portals Orchestration Source of Truth

Inventory, IPAM, Circuit, Network Properties

CLIs

Dashboards

IM Systems
Telemetry & Observability
Collect Enrich, Store, Monitoring

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 15

From CLI to CI/CD: Enter NetDevOps
You can’t fully realize the benefits of network automation unless you embrace NetDevOps.

Infrastructure as Code
Network Infrastructure
Engineers Engineers

NetDevOps

Version Control

Software
Developers &
QAs CI/CD Pipelines

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 16

Industry’s most open network OS
Receptive to a wide range of management and orchestration strategies

IT personas
Cisco Network
Third-Party Tools/DIY
Controllers
NetOps DevOps AIOps CloudOps

Open Programmable APIs NETCONF RESTCONF gNMI gRPC

Cisco
Yang Data Models Native
OpenConfig IETF IEEE
Network Infrastructure
Automation Automation Home Grown
SD-WAN Tools Tools Tools
Manager Cisco Silicon One

Crosswork Intent-based Network Infrastructure

Automate Enterprise Networks
With Cisco IOS-XE Programmability
Provision. Configure. Monitor. Optimize.

Day Day
0 Model-Driven 1
Provisioning Automation
Bring up network devices into a functional state
Programmability
with minimal to no-touch Best in class open Programmability to empower
Network Plug-N-Play your NetOps and DevOps
Secure Zero Touch Provisioning (ZTP/SZTP)
NETCONF, RESTCONF and gNMI
Preboot eXectuion Environment (PXE)
YANG Data models – Cisco Native, IETF, OpenConfig, IEEE

Software Image management Model-Driven Telemetry

Manage OS, certificates and third-party Linux Real-time access to operational statistics
applications
NETCONF Dial-In gNMI Dial-In & Dial-out
gNOI gRPC Dial-out

Day
Guest Shell and application hosting On-Change and periodic telemetry
Day
N 2
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 18
YANG

Lets talk… about data models

About Data Models
YANG = Yet Another Next Generation

Interface Model definition

“A Data-Model Explicitly and

precisely defines Data Structure,
Syntax and Semantics”

The YANG modules are included inside of Cisco IOS XE

They can be ‘exported’ from the software
They can be browsed using online/offline tools

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 20

Feature Configuration via CLI or YANG

via CLI via YANG Data Model

telemetry ietf subscription 101 "mdt-config-data": {

encoding encode-kvgpb "mdt-subscription":[ {
filter xpath /memory-ios-xe-oper:memory- "subscription-id": "101",
statistics/memory-statistic "base": {
stream yang-push "stream": "yang-push",
update-policy periodic 6000 "encoding": "encode-kvgpb",
source-vrf Mgmt-intf "period": "6000",
receiver ip address [Link] 575555 "xpath": "/memory-ios-xe-oper:memory-
protocol grpc-tcp statistics/memory-statistic"
}
"mdt-receivers": {
"address": ”[Link]"
"port": "57555" }
}
]
}

Human-Oriented Interface Machine-Oriented Interface

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 21
YANG Models Example

YANG Models
XML Payload
Data

Gig 1/0/1
“CL rocks!”
enabled

YANG Models → Data Models defined using the YANG language

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 22
Cisco IOS XE - YANG model API documentation
1. There are 10 types of data models including
config, oper, actions, and deviations
2. RFC 7950 YANG data modelling language are
the API definitions for IOS XE
3. The YANG modules are available for download
from the API and are also published on
[Link]
4. Notable modules are listed below for the
running-config, feature oper, actions and event
notifications
5. XML “set” file list which modules are supported
on the various hardware platforms

Since 17.10, YANG 1.1 modules are not

advertised in NETCONF hello/capabilities but The YANG models are available for download directly from the running
are available by reading the ietf-yang-library IOS XE device’s NETCONF, RESTCONF, or gNMI API, and from:
[Link]
module
Find the model for your usecase: [Link]
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 23
Cisco IOS XE – YANG model innovations
Deep dive into YANG models and FAQ, Common Models, etc
[Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 24

Swagger API Documentation
IOS XE release 17.15 API definitions posted to Github:
[Link]
Being moved into CiscoDevNet repository
Additional API’s being added – currently all “oper” modules included
Native config model, openconfig, ietf, etc to be included
Swagger API generated from YANG Suite plugin !

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 25

API
Programmable Interfaces
CLI
The NETCONF, RETCONF and gNMI are programmatic interfaces that provide additional
SNMP
methods for interfacing with the IOS XE device – Just like the CLI, SNMP, and WebUI is
used for configuration changes and operational metrics so can the programmatic
WebUI interfaces of NETCONF, RESTCONF and gNMI

YANG data models define the data NETCONF RESTCONF gNMI

that is available for configuration YANG Data Models

and streaming telemetry
OpenConfig Cisco Native

Intent-based
Network Infrastructure
Configuration and Operation

Device Features
SNMP

Interface BGP QoS ACL …

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 27

Model Driven Programmability Interface Comparison
Protocol Benefits NETCONF RESTCONF gNMI
Minimum IOS XE 16.6 (2017) 16.7 (2017) 16.8 (2018)
Default Port 830 443 9339
Operations <get>,<get-config>,<edit- GET, POST, PUT, PATCH, DELETE GET, SET, SUBSCRIBE
config>,<establish-subscription>

Encoding XML XML or JSON RFC7951JSON_IETF + Proto

Security SSH + PKI HTTPS user/pass mTLS certificate

certificate or password with user authentication

Transport Protocol SSH HTTPS HTTP/2

Tooling YANG Suite, ncclient, YANG Suite, Postman, python, YANG Suite, gnmic, gnmi_cli
Netconf-console curl

Content YANG YANG YANG + Protobuf

Benefits/Pros Mature API with candidate REST is very common API used Single secure API for config +
datastores, validation, across industry, well know Telemetry
rollback operations
Caveats/Cons XML can be slow & difficult to No telemetry support, limited “New” API, inconsistent
use datastore support implementations across vendors, Go
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110
lang, no rollback etc 28
 Multiple API’s, same YANG data: the choice is yours
NETCONF RESTCONF gNMI CLI

curl -X 'GET' \
Request Interfaces Data

<nc:rpc xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" message-

id="urn:uuid:af602e50-6490-4b84-abff-5461a8e37502"> { show interfaces
<nc:get> '[Link] "path": [

<nc:filter>
m:443/restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces/interface' \ {

<interfaces xmlns="[Link]
"origin": "rfc7951",
-H 'accept: application/yang-data+json'
interfaces-oper"/> "elem": [
</nc:filter> {
</nc:get> "name": "Cisco-IOS-XE-interfaces-
oper:interfaces"
</nc:rpc>
},
{
"name": "interface"
}
]
}
],
"encoding": "JSON_IETF"
}
<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"
xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:af602e50-6490-4b84-abff-
{
5461a8e37502">
"Cisco-IOS-XE-interfaces-oper:interface": [
Reply from Device

<data>
{
<interfaces xmlns="[Link]
"name": "GigabitEthernet0/0",
<interface>
"interface-type": "iana-iftype-ethernet-csmacd",
<name>GigabitEthernet0/0</name>
"admin-status": "if-state-up",
<interface-type>iana-iftype-ethernet-csmacd</interface-type>
"oper-status": "if-oper-state-ready",
<admin-status>if-state-up</admin-status>
"last-change": "2025-06-04T16:48:26.49+00:00",
<oper-status>if-oper-state-ready</oper-status>
"if-index": 1,
<last-change>2025-06-04T16:48:26.731+00:00</last-change>
"phys-address": "00:50:56:bf:77:ea",
<if-index>1</if-index>
"speed": "1000000000",
<phys-address>00:50:56:bf:77:ea</phys-address>

<speed>1000000000</speed>
"statistics": {

<statistics> … </statistics>
...

… }.
</interface> ...
</interfaces> }
</data> ]
</rpc-reply> }

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 29

CLI to YANG: show run format netconf/restconf
1. This CLI addition to “show run | format” brings additional visibility into the YANG modelled configuration
2. NETCONF with XML and JSON with RESTCONF for Cisco-IOS-XE native models only
3. Easily convert CLI into YANG to re-use in tooling, scripts, and automation and orchestration systems
show run | format netconf-xml
show run | format restconf-json

• Requires netconf-yang Data Model Interfaces to be enabled

• CLIs with corresponding native YANG and modeled in show run are returned
• No support for “show run all” or additional parameters
• NETCONF “Get-Config” RPC can also get used to get the YANG modelled configuration

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 30

About NETCONF
• NETCONF provides a programmatic interface based on standard mechanisms for Attend the ACR Session
accessing configuration data, state data, data-model-specific Remote Procedure Call tomorrow to learn more!
(RPC) operations and events, defined in the YANG model. 1:00 PM – 2:00 PM
• NETCONF uses XML formatting for machine-friendly data transfers and supports the BRKENS-2604
operations described below. Atomic Config Replace with
• The YANG Suite NETCONF plugin provides options to execute and visualize the YANG data Cisco Catalyst 9000

model.

Why use NETCONF?

• Candidate datastore
• Easily convert CLI to YANG using format | Netconf-
xml
• NETCONF Access Control Model (NACM)
• Commonly used with Ansible
• Confirm Commit
• Mature RFC standard

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 31

About RESTCONF
• RESTCONF provides a programmatic interface based on standard mechanisms Why use RESTCONF?
for accessing configuration data, state data, data-model-specific Remote
Procedure Call (RPC) operations and events, defined in the YANG model. • REST-like API
• The YANG Suite RESTCONF plugin provides Swagger UI and execution
• Easy to use with
visualization of the YANG data model.
edit & get
• Use YANG Suite or Postman tool
operations
• Swagger
documentation
• Commonly used with
cURL commands,
JSON-formatting and
Python scripting
• Terraform enablement

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 32

About gNMI…
gNMI provides a programmatic interface based on standard mechanisms for accessing configuration data, state data, data-
model-specific Remote Procedure Call (RPC) operations and events, defined in the YANG model. gNMI supports GET, SET
and SUBSCRIBE operations. The YANG Suite gNMI plugin provides execution and visualization of the YANG data model.

Why use gNMI?

• gNMI API supports config management
through the “SET” operation and
includes a “Subscribe” for model-driven
telemetry. It also has some features for
TLS certificate management, OS version
upgrades, and factory-reset API’s
• gNMI is quickly becoming the standard
API used across network devices
because it supports device configuration
and telemetry all while its encoding
There are 100+ “actions” in YANG that are modelled for mechanism is just faster and more
NETCONF/RESTCONF operations, but NOT for gNMI ! efficient
TLS certificate management, OS version upgrades, factory reset
100 other actions: “clear”, reset, save, copy, ping, etc NOT with gNIMI

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 33

So which API does Cisco recommend ?
It depends! On the usecase, tooling maturity, NetDevOps investment, the complexity of the problem, etc
This is a brief introduction… API’s will be covered in more detail after Day0/Onboarding
API Pros Cons
NETCONF • Candidate datastore capability: Option to work with Running
datastore or candidate datastore (a sandbox-like environment for
• XML is slower than gNMI / gRPC
• Machine friendly (not human friendly)
testing and validation on-box before pushing code to the running • Requires installing libraries for ease of use
config) (ncclient)
• Supports config, retrieving data and telemetry
• Telemety data comes faster than SNMP
• Confirm Commit
• Standards-based

RESTCONF • Works like other REST-based APIs with standard operations like
GET, PUT, POST, etc
• No telemetry support. If RESTCONF is the only
option, aggressive poling through GET requests
• No additional libraries to install for use (REST is widely supported) can be used in place of telemetry
• Standards-based • HTML/JavaScript is commonly used for REST,
• Swagger documentation for use of use which is slower than gNMI / gRPC

gNMI • Capabilities for GET, SET, and Subscribe operations

• Telemetry data comes faster than other APIs or SNMP because
• Non-standards-based (rather it is operator-
led), meaning YANG not always at parity
gRPC uses protobuf encoding which is more efficient and faster to (actions,events,on-change,etc don’t work)
serialize & deserialize the data • Machine friendly (not human friendly)

gRPC • Fast Push-based telemetry • Only telemetry support, meaning no device

config or single gets (use gNMI)

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 34

Tooling
YANG Suite
Ansible
Terraform
Empower your NetOps with Cisco YANG Suite Free and publicly available!

Best in class tooling for open programmability

Cisco YANG Suite Customer
Complex Network Operations Use Cases
Benefits

Simplified migration
Legacy Protocol
from CLI and SNMP to
D W IS Migration
YANG
C A P
N Toolkit to integrate
with existing Device
workflows Automation

Guided workflow for Network

all things YANG Monitoring

API Testing and Validation Compliance and

Environment for
NETCONF, RESTCON, gNMI & gRPC Coverage

Get hands-on using the new learning lab! [Link]

[Link]
Docker container innovation 1 container
[Link]

Simplify your device programmability journey with Cisco YANG Suite

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 36
What is Ansible?

Role – set of playbooks • Open-source configuration management tool

Playbook – repeatable standard config • Commercially supported by Red Hat

• Declarative and idempotent
Play – set of tasks
• Ansible can be Imperative when needed
• Can manage a wide range of systems:
VMs, network devices, cloud instances, etc.
Task – single action referencing a module
• Agentless: no requirement for installation of application software to
run
Module – reusable standalone script
• Has Python server-side dependencies

[Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 37

Ansible with Cisco Catalyst & IOS XE

Ansible has full support for configuration management of Cisco IOS XE and Catalyst 9000 using
plugins for CLI, SNMP, and for the YANG based API’s including NETCONF, RESTCONF, and gNMI.

Integrations with Cisco IOS XE & Catalyst 9000:

2 CLI modules are most common:
ios_config – config CLI
ios_command – show CLI

Various CLI feature modules have been created to

support specific usecases including: bgp, l2_interface,
ntp, vlan, vrf, etc

The programmatic API interfaces of NETCONF/

RESTCONF/GNMI are also supported with a variety of
modules and playbooks

DevNet has code samples, learning labs, and sandbox

[Link]
[Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 38

Terraform with Cisco Catalyst & IOS XE

The 1 ”iosxe” terraform provider manages configuration declaratively across 19 features using 98 resources & data sources
There are 2 additional resources for imperative configuration using both CLI and YANG
The imperative resources take YANG modelled inputs and the [Link] is used to abstract CLI over RESTCONF

Terraform interfaces with Declarative support Imperative support CLI RPC YANG Model iosxe_restconf
the IOS XE RESTCONF API

iosxe_cli

Documentation on registry [Link]

Source code in Cisco DevNet GitHub repo: [Link]
RESTCONF guide [Link]
CLI RPC YANG API [Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 39

DEMO: Terraform Add Device Config

Use Terraform to manage the gRPC Dial-Out Telemetry subscriptions

[Link]
Example files: [Link]

1. Ensure Docker is installed

2. Run the following commands
1. docker pull jeremycohoe/tig_mdt
2. docker run -ti -p 3000:3000 -p
57500:57500 jeremycohoe/tig_mdt
3. Identify the container ID
1. docker ps
4. Enter into the container
1. docker exec -it CONTAINER_ID
/bin/bash
1. Note: replace CONTAINER_ID
with the ID found in step 3
5. Navigate to the correct folder
1. cd
2. cd cisco-ios-xe-panda-lab-terraform
6. Modify the device credentials in the [Link]
file
provider "iosxe" {
username = "admin"  replace with
Cisco IOS XE device username
password = "XXXXXXXX"  replace
with Cisco IOS XE device password
url = "[Link]
or-ip"  replace with Cisco IOS XE device
hostname or I
}
7. Configure the Cisco IOS XE device using
Terraform

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 40

They can coexist… it’s not an either/or story

[Link] [Link]

• Terraform keeps state locally • Ansible mutates the infrastructure

• Terraform knows what is configured • Ansible does not keep state
vs desired end-state (mostly)
• Terraform can automatically • Terraform can call Ansible to
destroy/recreate resources perform tasks post resource
deployment (e.g., on VMs
deployed)
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 41
Tooling Comparison
This is not a complete list!
Other common tools: Postman(REST), gNMIc, Python, GoLang, [Link]
Tool YANG Suite Ansible Terraform
Use Case To understand how Task-based tooling Infrastructure-as-Code
YANG models work (IaC) tooling
To help build a payload
Supported Protocols NETCONF, RESTCONF, NETCONF, RESTCONF RESTCONF
gNMI, gRPC (and more
capabilities such as
diffs, SNMP to YANG,
etc)
Benefits Getting started to Imperative – procedural Declarative
understand YANG (step-by-step)
models and build
payloads
Interface GUI web tool CLI / YAML files CLI / HCL (similar to
JSON) files

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 42

 I just received 5000
switches. How can I onboard
them reliably, efficiently and
at scale?

Device Onboarding
 AI Generated Image
Prompt: A real person in a server room, surrounded by racks

Why It’s Time for a Change?

of switches and servers. The person has connected their
laptop to one of the racks with a wire and is intently working
on their laptop. The server room is well-lit with a cool, blue-
toned lighting, reflecting off the metallic surfaces of the
servers. The person is focused, with a look of concentration

Limitations of Manual Network Provisioning on their face, as they navigate through their laptop. The
background shows rows of servers, with blinking lights
indicating active connections and data transfer.

Time Consuming & Limited Scalability with Security Risks

Error prone High Operational Costs

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 44

 AI Generated Image
Prompt: A detailed illustration of an enterprise network,

Day – 0 Network Automation

featuring a large main campus building at the center,
surrounded by only 4 to 5 smaller branch office buildings.
The network connections between the main campus and
branch offices are clearly depicted, with lines representing
data flow. The main campus is modern and sleek, with glass
windows and a well-maintained exterior. The branch offices
Zero-Touch Provisioning are smaller but share a similar architectural style. The
ZTP Server background includes a subtle cityscape, with a clear blue
sky and a few scattered clouds.

15%
------------------------
Organizations identified a supply
chain compromise as the source of
a data breach [1]

$4.8 Million
------------------------
Is the global average cost of a data
breach, increased by 10%
compared to the previous year [1]

[1] - Cost of a Data Breach Report 2023/24 -

IBM
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 45
 How Secure ZTP works
MASA=Manufacturer Authorized Signing Authority
MASA is a cloud service that enables certificate signing Cisco MASA Server

DHCP Server

Restconf Server
1 TLS Handshake, SUDI Certificate
Database/ Web Server
(Artifacts)
Server Certificate

Get Bootstrapping Data | Signed-data-preferred

Cisco IOS-XE OC | OV | Redirect Info | Trust Anchor
Owner Certificate
Conveyed Information

TAm 2 Network Admin

Get Bootstrapping Data | Without signed-data-preferred

Bootstrapping Artifacts:

3 •
•
•
Ownership Voucher
Owner Certificate
Onboarding Information

SUDI SUDI SUDI

Certificate Private Key Public Key

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110

SZTP/Bootstrap Server 46
Manual Provisioning vs ZTP vs SZTP

Manual
ZTP Secure - ZTP
Provisioning

Provisioning Automation ✓ ✓
Configuration Consistency ✓ ✓
Scalability ✓ ✓
End to End Security ✓
Audit Logs ✓
Easy Image Upgrade ✓
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 47
ZTP, Gust Shell with CentOS 8 and Python 3
• ZTP runs when there is no config and DHCP Option 43 is set
• Embedded CentOS linux container with API’s into IOS XE
• Disabled by default, enable with interface config + “guestshell enable” CLI
Intent-based
Network Infrastructure
Guest Shell
(CentOS 8)

Python / YANG / CLI / EEM APIs

IOS XE

[Link]
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 48
Example Python ZTP Script ([Link])

[Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 49

NETCONF API
The NETCONF interface on Cisco IOS XE is accessible from
within the Guest Shell, which can be used at Day 0. No interface
configuration or connectivity is required.

The ncclient Python library can be used to connect to the

NETCONF interface when there is no IP connectivity, similar to
the Python CLI modules and API. This can be used by ZTP at Day
0 to programmatically configure the device using either CLI or
YANG.

NETCONF API
CLI API
Preform RPC Actions
ZTP Enable NETCONF
Enable AAA Programmatic Configuration
of device features

Authentication from Guest Shell to NETCONF is still required, both credentials and certificates are supported
get_hostname.py example at [Link]
[Link] example at. [Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 50

Admin Setup for Secure ZTP Workflow

1 Order 5000 new switches

2 Receive 5000 new switches

with serial numbers for each Day 0 SZTP onboarding complete!
F01 F02 F03

3 Add each serial number

(+PDC) to MASA
6 Devices onboard using OV
with its serial number

4 Generate OV per device from

MASA
OV1 OV2 OV3

Put OVs into bootstrapping

5 service

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 51

RFC8572 Secure ZTP

RFC details: [Link]

1. Conveyed Information: used to encode the redirect information and onboarding information (switch config)
2. Ownership Certificate: used by a device to verify the signature over the conveyed information
3. Ownership Voucher: used to verify a device owner as defined by the manufacturer (from the MASA)

Classic Zero Touch Provisioning Device Secure Zero Touch Provisioning

Secure Zero Touch Provisioning RFC8572 (2019)

Turn on
DHCP Server
DHCP Discovery Bootstrapping
(RESTCONF)
Option 143 (136), URL List Server
TLS Handshake; SUDI Client Certificate Validate client
Server Certificate using SUDI

get- bootstrapping- data using YANG- modeled RPC POST Request

Bootstrapping Artifacts:
• Ownership Voucher
• Owner Certificate
• Conveyed Information
Validate Server

Some security requirements for classic ZTP are resolved using Secure ZTP: Update Image Information

• Management system needs to validate the device Device Trust

Ownership Ownership Conveyed
Configuration Scripts
NETCONF Configuration
• Device needs to validate the server
Voucher Certificate Information
Anchor (RFC 8366) Encoded Redirect Traffic

• Device must validate the data is what server sent

and Onboarding
Information Guestshell

As part of the SZTP RFC, the device supports image upgrade as part of the conveyed information
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 52
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 53
Learn more about Secure Zero Touch Provisioning

SZTP Blog Cisco SZTP Guide ZTP guide for hands-on lab

[Link] [Link] [Link]

1836-programmabilty-and-
automation/blob/main/[Link]

ZTP Script repository

[Link]
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 54
 How can I configure all
5000 new switches reliably,
efficiently and at scale?

Device Configuration
Why It’s Time for a Change?
• The Complexity and Struggles of CLI-Based Automation

Config
</>

Creating Error Handling & Scalability & Operational

Configurations That Rollback Efficiency
Just Work

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 56

Why It’s Time for a Change?

Creating Error Handling & Scalability & Operational

Configurations That Rollback Efficiency
Just Work
1. Declarative Config Management 1. Atomic Config Replace 1. Programmable Interfaces
NETCONF
RESTCONF

Terraform Transactional Config Change APIs & Yang Models

2. Two-Phase Commit 2. Multiple Rollback Options 2. Infrastructure as Code

Verify before apply

Instant Rollback
Post Deployment Rollback
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 57
IOS XE programmability and Telemetry “Stack”
CLI
The NETCONF, RESTCONF, gNMI and gRPC are programmatic interfaces that provide
SNMP
additional methods for interfacing with the IOS XE device – Just like the CLI, SNMP, and
WebUI is used for configuration changes and operational metrics so can the programmatic
WebUI interfaces of NETCONF, RESTCONF, gNMI, and gRPC.

YANG data models define the data NETCONF RESTCONF gNMI gRPC

that is available for configuration

YANG Data Models
and streaming telemetry
OpenConfig Cisco Native

Intent-based
Network Infrastructure
Configuration and Operation

Device Features
SNMP
Interface BGP QoS ACL …

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 58

NETCONF
NETCONF over SSH

• NETCONF uses SSH port 830 but is independent from the SSH service
• ACL can ben applied for this interface as necessary

• Laptop
• Client
• Workstation
• Orchistrator IOS XE
• Etc NETCONF/SSH
port 830

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 60

IOS XE NETCONF Datastores

“A Datastore holds a copy of the configuration data

that is required to get a device from its initial default
state into a desired operational state” Running Running-config
Running is the default and only mandatory Datastore

The Candidate Configuration feature enables support Candidate Candidate config

for candidate capability by implementing RFC 6241
with a simple commit option.
The candidate datastore provides a temporary
workspace in which a copy of the device's running
configuration is stored.
The candidate configuration supports the confirmed
commit capability
Commit with
confirm

[Link]
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 61
How to enable NETCONF ?

Cat9k-1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Cat9k-1(config)#aaa new-model Enable AAA
Cat9k-1(config)#aaa authentication login default local
Cat9k-1(config)#aaa authorization exec default local
Cat9k-1(config)#username admin privilege 15 password cisco

Cat9k-1(config)#netconf-yang Enable NETCONF

Cat9k-1(config)#

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 62

Example NETCONF GET IETF-Interfaces
[Link] GET-config operation

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 63

Demo: Generate Python from NETCONF

Access YANG Suite >

Protocols > NETCONF

Select YANG model then

Build RPC payload

Select Replays

Select Generate Python

script

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 64

NETCONF + Ansible

Similar to the “Generate Python” functionality, a new

functionality generates YAML formatted for Ansible.

Requirements
1. Install Ansible
2. Install NETCONF collection:
ansible-galaxy collection install NETCONF

- name : conf-host
hosts: c9300
connection: netconf
gather_facts: no

tasks:
- name: hostname-conf
netconf_config:
xml: |
<config xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<native xmlns="[Link]
<hostname>c9300-pod29</hostname>
</native>
</config>

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 65

NETCONF + Ansible Update Interface Description Demo

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 66

[Link]

This YANG data model allows sending CLI through the YANG API interfaces
Previously only YANG modelled data was supported

[Link]
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 67
Get Modelled Config CLI RPC

• Sending the “get-modelled-config-clis” RPC returns

the modelled running-config in CLI format
• Anything not modelled will not be returned (AppH)
• Unsupported model config will be ignored (AppH)
• This is used as the template to update the device with
after being modified as needed

RPC:
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="101">
<get-modelled-config-clis xmlns="[Link]
</rpc>

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 68

Enable IPv6 on IOS XE using YANG models
Automate with Python

Configuration payload

<native
xmlns="[Link]
IOS-XE-native">
<ipv6>
<unicast-routing/>
<router>
<ospf>
<id>1</id>
</ospf>
</router> Send to device
</ipv6> over a NETCONF
</native> session

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 69

TECENT-2150 69
 Watch the recording:

Introducing Atomic Configuration Replace BRKENS-2604

Atomic Config Replace with
Cisco Catalyst 9000

IOSd

Validate
Request

Validate
Write Validate Configuration
Config Staging System verifies configuration
Validate Read Memory integrity before applying.
Response Staging Catches potential
Environment
errors early

IOS
IOS ––
Running
Running
Config
Config
Commit
Request

Write
Apply
Commit
Config Atomic Transaction Config Rollback
Response Read
Apply configuration changes If issues arise, revert to last
as a single transaction. All known good configuration
changes succeed, immediately
or none do

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 70

RESTCONF
YANG Suite RESTCONF

RESTCONF provides a programmatic interface based on standard mechanisms for accessing configuration data, state data,
data-model-specific Remote Procedure Call (RPC) operations and events, defined in the YANG model. The YANG Suite
RESTCONF plugin provides Swagger UI and execution visualization of the YANG data model.

YANG Suite RETSCONF replaces the need for POSTMAN, which

doesn’t have integration with YANG models

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 72

REST vs RESTCONF: not the same!

RESTCONF
REST NETCONF RESTCONF gNMI gRPC

YANG Data Models

GET
Open Native
POST

API PUT
Configuration and Operation

DELETE
Device Features
SNMP

Interface BGP QoS ACL …

“A framework for client-server communications”

“REST-like protocol for accessing
YANG models”
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 73
Enable RESTCONF

Cat9k-1#conf t
Enter configuration commands, one per line. End with CNTL/Z.

Cat9k-1(config)#restconf Enable RESTCONF

Enable HTTP server
Cat9k-1(config)#ip http secure-server

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 74

YANG Suite RESTCONF Demo

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 75

RESTCONF + Ansible
Requirements
1. Install Ansible
2. Install the required
collection:
ansible-galaxy
collection install
[Link]

- name: interface
hosts: HOST_NAME_HERE
gather_facts: no
tasks:
- name: interfaces_oper
[Link].restconf_get:
# Output can either be json or xml
output: json
path: Cisco-IOS-XE-interfaces-oper:interfaces

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 76

IPsec tunnel + cloud automation with Terraform

1. Terraform configures the IPsec tunnel between

the 9300X and the cloud service where the AWS
internal resources are available
2. Terraform also manages the cloud-native
resources including certificate key management
and IP subnetting
3. Connections between VPC, VPN, CGW and
device certificates, tunnels, and interfaces are
created
1. Virtual Private Cloud (VPC) 1. Tunnel
2. Virtual Private Network (VPN) 2. Proposal
3. Customer Gateway (CGW) 3. Policy
Branch 1 4. Keyring
5. Profile
6. IPSEC Transform
7. IPSEC Profile
8. Tunnel Interface

Cisco Catalyst 9300X/9400X IOS XE

RESTCONF / YANG with Terraform Internal
Branch 2, N AWS resources

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 77

Terraform + Crypto IPsec Demo

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 78

gNMI
gRPC and gNMI

gRPC gNMI

Google gRPC
Remote Procedure Call Network Management Interface

C9300#show run | sec telemetry C9300#show run | i gnxi

telemetry ietf subscription 101 gnxi
encoding encode-kvgpb gnxi secure-trustpoint gnxi-tls-cert
filter xpath /process-cpu-ios-xe-oper:cpu-usage/cpu- gnxi secure-server
utilization/five-seconds gnxi secure-port 9339
source-address [Link]
stream yang-push show gnxi state detail
update-policy periodic 500
receiver ip address [Link] 57500 protocol grpc-tls profile
myca

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 80

Enable gNMI

Cat9k-1#conf t
Enter configuration commands, one per line. End with CNTL/Z.

Cat9k-1(config)# gnmi-yang Enable gNMI

Cat9k-1(config)# gnmi-yang server Config server
Port
Cat9k-1(config)# gnmi-yang port 50052

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 81

Enabling gNxI: secure-server

Cat9k-1#conf t
Enter configuration commands, one per line. End with CNTL/Z.

Cat9k-1(config)# gnxi secure-trustpoint <<trustpoint name>> Create a trustpoint

Cat9k-1(config)# gnxi secure-server
Use trustpoint

Alternative approach:
Cat9k-1#conf t
Enter configuration commands, one per line. End with CNTL/Z.

Cat9k-1(config)# gnxi secure-init Alias for above

config

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 82

gNMI GET IETF Interfaces

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 83

gNMI + Ansible

Requirements
1. Install Ansible
2. Install the required collection
ansible-galaxy collection install [Link]

- name : gNMI playbook

gather_facts: false
hosts: MY_HOST_NAME

collections:
- [Link]

tasks:
- name: gNMI RPC
gnmi_config:
update:
- path: system/config/hostname
val: set-by-ys-gnmi-ansible

register: testout
- name: dump test output
Note: the ansible gnmi integration works only with OpenConfig model
debug:
msg: '{{ [Link] }}'

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 84

gNMI + Ansible demo

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 85

 How can I monitor all
5000 new switches reliably,
efficiently and at scale?

Device Monitoring
Why It’s Time for a Change?
Challenges of SNMP Monitoring

Lack of Real-Time and Scalability and

Security Risks
Granular Monitoring Performance Bottlenecks

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 87

Telemetry Data Flow
Cisco C9610-SUP-3 & 3XL
Powered by Cisco Silicon One E100 & K100

Cisco C9350 Series

Powered by Cisco Silicon One A100

Cisco IOS XE Devices

Collector/Receiver
Decodes to text
Storage
Time Series Database
Monitoring
and Visualizations

[Link] [Link]
[Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 88

Splunk integration Cisco C9610-SUP-3 & 3XL
Powered by Cisco Silicon One E100 & K100

Cisco C9350 Series

Powered by Cisco Silicon One A100

Cisco IOS XE Devices

Collector/Receiver
Decodes to text

Storage
Time Series Database 89

Monitoring
and Visualizations

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 89

Cisco-on-Cisco Telemetry Integrations ?
Q: How does Cisco consume telemetry from IOS XE ?
A: The Cisco software controllers also use the gRPC & NETCONF telemetry interfaces to collect data
Meraki Dashboard Catalyst Center Catalyst SD-WAN
Available in 20.16+

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 90

Model Driven Telemetry Interfaces

Dial In: Collector establishes a connection to the device then subscribes to telemetry (pub/sub)

Dial Out: Telemetry is pushed from the device to the collector based off configuration (push)

Publication / Subscription

XML, JSON, proto and

kvGPB encoding

Intent-based Consistent YANG data

Network Infrastructure
models between interfaces

On-change event and time-

based publication options

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 91

Model Driven Telemetry Interface Comparison
NETCONF gRPC (Dial-Out) gNMI Network
architecture,
Minimum IOS XE Version 16.6 (2017) 16.10 (2018) Dial-In: 16.12 (2019) security
gRPC tunnel (2023) posture and
Telemetry Direction Dial-In, Dial-Out Dial-In policy, YANG
IOS XE is server IOS XE is client IOS XE is server data modules,
Dial-Out tools and
gRPC Tunnel language
preferences,
Configuration Dynamic Static Dynamic
and standards,
per session per configuration per session
and software
Telemetry Collector Client Server Client version, are
some
Encoding XML KV GPB JSON_IETF + PROTO
considerations
Security SSH + PKI mTLS or plain-text mTLS certificates when
certificate or mTLS cert only or
mTLS cert + user/pass authentication leveraging the
password various MDT
Transport Protocol SSH HTTP2 HTTP2 interfaces

Data Models YANG YANG YANG

• NETCONF for RFP/compliance use only – not really seen in use in production
• gRPC for most enterprises: the NetOps configures the telemetry to push to the server
• 2025gNMI
© Cisco and/orfor leading
its affiliates. edge: NetDevOps accesses the network
All rights reserved. device
DEVNET-1110 92
Cisco Telemetry Data Broker (Telegraf)

Cisco Telemetry Broker provides many benefits include brokering, filtering, and transforming
data. It provides the ability to replicate telemetry data.

[Link] aka [Link]

[Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 93

Publication options
We’ll focus on periodic in this session because it is the most common!

On-Change Periodic

t t t t t t t t t t t t t t

Feature Model “On-Change” Notifications Feature Model “Periodic” Notifications

Event Notifications (failed login, optic fault, etc) Time based publication
State and Configuration Minimum interval 100 centiseconds (1s)

OpenConfig YANG with GNXI, not NETCONF

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 94
Model Driven Telemetry: usage comparison

60-minute collection sample with 60-second update interval

Interface CPU PCAP file Data byte Data bit Average Average
Impact size/data Rate rate Packet Packet
size (MB) Rate Size
(sec) (bytes)
gNMI +3% 23 MB 6 kBps 53 kbps 5 1180
gRPC +3% 69 MB 19 kBps 155 kbps 58 333
NETCONF +2% 83 MB 23 kBps 185 kbps 29 780
17 xpaths collected at 60 second update interval
RESTCONF +4% 200 MB 35 kBps 281 kbps 37 945 /arp-ios-xe-oper:arp-data
/cdp-ios-xe-oper:cdp-neighbor-details
/environment-ios-xe-oper:environment-sensors
SNMP * +6% 120 / 87 24 kBps 197 kbps 90 273 /if:interfaces-state
/interfaces-ios-xe-oper:interfaces/interface
/ios:native
/lldp-ios-xe-oper:lldp-entries
/matm-ios-xe-oper:matm-oper-data
/mdt-oper:mdt-oper-data/mdt-subscriptions
/memory-ios-xe-oper:memory-statistics/memory-statistic
/oc-if:interfaces/interface/state/counters
NETCONF gNMI gRPC /oc-platform:components
/oc-sys:system
/platform-ios-xe-oper:components
/poe-ios-xe-oper:poe-oper-data/poe-switch
/process-cpu-ios-xe-oper:cpu-usage/cpu-utilization
/process-memory-ios-xe-oper:memory-usage-processes
This demonstrates that even when SNMP is only measuring Interfaces the load is still significantly higher
than YANG which is measuring significantly more YANG data + Device-hardware-oper + Switch-stack-oper + more ?

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 95

Model Metadata with YANG Suite

The CLI config to enable MDT

filter xpath / PREFIX : XPATH
requires the “filter xpath” which
defines which YANG data to
publish

Use YANG Suite to find the prefix

and xpath from the YANG models
to use in the configuration

Configuration Guide:
[Link]
/docs/ios-
xml/ios/prog/configuration/1610/b
_1610_programmability_cg/model
_driven_telemetry.html

filter xpath /process-cpu-ios-xe-oper:cpu-usage/cpu-utilization

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 96

Configure a gRPC Telemetry Subscription

Configuring telemetry subscriptions like the following to collect CPU data over time

On Cisco IOS XE Device:

configure terminal
telemetry ietf subscription 1
encoding encode-kvgpb
filter xpath /process-cpu-ios-xe-oper:cpu-usage/cpu-utilization
stream yang-push
update-policy periodic 60000
receiver ip address [Link] 57500 protocol grpc-tcp

See more examples at: [Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 97

Enhanced Energy Metering IOS XE 17.15.1

System Meter
Meter start time 2024-10-22 10:36:34 PST
Energy Data For Last 180 Minute

What it is System Energy System Meter Update

Mod Model No (MilliWattSec) Time
--- -------------------- -------------- ------------------------
Enables energy meter for Switch System Power and PoE 1 C9300-24H 234894600 2024-10-22 11:32:39 PST
switchport power consumption --- -------------------- -------------- ------------------------
Platforms: C9200, C9300, C9400
PoE Port Meter
What it does SB-Salone1-C9324H#sho power inline meter
Module Available Used Remaining
(Watts) (Watts) (Watts)
------ --------- -------- ---------
1 860.0 120.0 740.0

Interface Meter Update Hourly Metered Metered Energy in MilliWattSec (15min Buckets)
System Energy is power consumed by the system for a Time Value (MilliWattSec)
---------- ----------------------- -------------------- ------------------------------------------------------
specific duration, measured in unit of Watt Second. Macro- ------------------------------------------------------
Gi1/0/1 2024-10-22 11:21:09 PST 0 0-0-0-0-0-0-0-0-0-0-0-0

metered window size of 3-hours with 12 x 15-minute micro- Gi1/0/2 2024-10-22 11:21:09 PST 10507380 1465368-3553224-3558320-1930468-0-0-0-0-0-0-0-0

meters 15 minutes/bucket # 0
15 min
1 30 min
Gives the visibility within the windows of consumption that can Hour-1
2 45 min
be further analyzed and considered for carbon intensity
3
reporting, density-based usage analysis and so on. 60 min
4 75 min

Power
5 90 min
What it receives Telemetry
6 105 min Hour-2

7 120 min
Ledger on Energy consumption for System Power and PoE Port 8
135 min
with a bucketized data of 15 minutes each. 9
150 min
165 min Hour-3
10
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 180 min 98
11
Subscription to the new platform data

telemetry ietf subscription 79007

encoding encode-kvgpb
filter xpath /platform-ios-xe-oper:components/component/platform-properties/platform-property
source-address [Link]
stream yang-push
update-policy periodic 300000
receiver ip address [Link] 57000 protocol grpc-tcp

telemetry ietf subscription 79008

encoding encode-kvgpb
filter xpath /poe-ios-xe-oper:poe-oper-data/poe-port-detail
source-address [Link]
stream yang-push
update-policy periodic 30000
receiver ip address [Link] 57000 protocol grpc-tcp

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 99

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 100
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 101
 CLI Telemetry

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 102
 Auto-off StackPower PSU

Switch # 1 1A 1B Switch # 1 1A 1B

Switch # 2 2A 2B Switch # 2 2A 2B

Switch # 3 3A 3B Switch # 3 3A 3B

Switch # 4 4A 4B Switch # 4 4A 4B

Switch # 5 5A 5B Switch # 5 5A 5B

Switch # 6 6A 6B Switch # 6 6A 6B

Switch # 7 7A 7B Switch # 7 7A 7B

Switch # 8 8A 8B Switch # 8 8A 8B

8 x C9300X switch stack 8 x C9300X switch stack - PSU Active

2 StackPower Domains 2 StackPower Domains
16 Active PSUs 4 Active PSUs - PSU auto-off

- Stack-power group

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 103
StackPower Power draw with auto-off

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 104
StackPower Efficiency with auto-off

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 105
What can we do with Power Telemetry

Grafana

InfluxDB

Telegraf

Power Telemetry

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 106
Catalyst 9800 WLC Calendar Template scheduling
To enable power save mode on Cisco Catalyst Access Points
[Link]

wireless profile power "Off Work Hours"

0 radio 6ghz state shutdown
1 radio secondary-5ghz state shutdown
2 usb 0 state disable
3 radio 5ghz state shutdown

wireless profile calender-profile name "Off Work 5PM to Midnight"

day monday
day tuesday
day wednesday
day thursday
day friday
recurrance weekly
start 17:00:00 end 23:59:59

wireless profile calender-profile name "Off Work Midnight to 8AM"

day monday
day tuesday
day wednesday
day thursday
day friday
recurrance weekly
start 00:00:00 end 08:00:00

ap profile default-ap-profile
calendar-profile "Workday 5pm to Midnight"
action power-saving-mode power-profile "Off Work Hours"
calendar-profile "Workday Midnight to 8am"
action power-saving-mode power-profile "Off Work Hours"

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 107
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 108
Monitoring & Automation Impact

Up to 25%
of Energy usage reduction on POE
switchports with IOT endpoints turned off ~ 9hrs/Day

Minimum of 12%
Energy usage reduction for controller-
based Cisco Catalyst Access Points

100 % Visibility on POE Power Consumption

*based on use case and data presented in demos

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 109
 How can I troubleshoot
and manage image
upgrades for all 5000
new switches reliably,
efficiently and at scale?

Device Optimization
Livetools: YANG support for
common networking
operations
1. MTR 3. Throughput 5. Wake-On-LAN
2. Ping 4. Traceroute
Cisco-IOS-XE-livetools: Ping, Traceroute, MTR, etc

• 5 common network management tasks including ping and traceroute are now available through the YANG
API (mtr, ping, tracerout, throughput, WOL)
• They are called from the “RPC” model with variable inputs like IP address, etc
• A “JobID” is returned to programmatically retrieve the results
• The Results are available by querying the “oper” model

1. MTR
2. Ping
3. Throughput
4. Traceroute
5. Wake-On-LAN
These “live tools” enable additional programmatic network connectivity troubleshooting and validation

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 112
Ping RPC
The ping RPC measures the network latency in milliseconds to the specified IP or hostname
RPC TO EXEC PING
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="101">
<ip-ping-action xmlns="[Link]
<count>5</count>
<src-if>vlan311</src-if>
<host-ip>[Link]</host-ip>
</ip-ping-action>
</rpc>

RPC TO GET PING RESULTS

<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="101">
<get>
<filter>
<livetools-oper-data xmlns="[Link]
<ip-ping-result>
<job-id>1</job-id>
</ip-ping-result>
</livetools-oper-data>
</filter>
</get>
</rpc>

RESPONSE FROM API

<livetools-oper-data xmlns="[Link]
<ip-ping-result>
<job-id>1</job-id>
<req-info>
<ni-type>net-inst-default</ni-type>
<ni-name/>
<src-if>vlan311</src-if>
<host-ip>[Link]</host-ip>
</req-info>
<job-info>
<request-time>2024-09-11T23:34:01.976+00:00</request-time>
<end-time>2024-09-11T23:34:02.348+00:00</end-time>
<status>job-completed</status>
</job-info>
<error>ip-ping-no-err</error>
<resp-info>
<echo-info>
<seq-num>1</seq-num>
<status>echo-success</status>
<latency>75</latency>
</echo-info>
<echo-info>
<seq-num>2</seq-num>
<status>echo-success</status>
<latency>74</latency>
</echo-info>

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 113
Resources
 Cisco Live US Programmability Learning Map

Sunday—8th Monday—9th Tuesday—10th Wednesday—11th Thursday—12th

TECOPS-2314 9:00A 10-11:30
11:30-1:15
BRKOPS-2256 CISCOU-1059 4-4:30PM
Automating All Things DEVNET-1110
Observability at TorIX:
YANG, All the time - Exploring Practical Modern approaches for
custom telemetry
Programmability and AIOps Use Cases for IOS XE network device
solutions on next-gen
Automation 101 with Enterprise Networks management on Cat9k
campus switching
Cisco IOS XE with Splunk 1-2PM 1:30-2:30
BRKDEV-2017
BRKENS-2604 gRPC, gNMI, gNOI... Oh
Atomic Config Replace My! An Enterprise
with Cisco Catalyst Network Automation
Journey 2-3:30
9000 3:30-5PM

BRKOPS-1401 BRKOPS-2223
Cisco IOS XE: Network of the Future is
Telemetry, Automation, Here - Let's Automate
and YANG—Oh My! your IPv6 deployment
[Link]
with Python!

Walk-in labs (open Monday-Thursday)

✓ Efficiently monitoring device statistics in real-time using gRPC Dial-out with IOS XE [LABPRG-
2004]
✓ Explore and test YANG models for model driven telemetry on IOS XE with Cisco’s YANG Suite
[LABOPS-2000]
✓ Hands-On Lab: Monitoring Cisco IOS-XE Devices with RESTCONF [LABDEV-2001]
 Cisco Live US Catalyst 9000 Learning Map

Sunday—8th Monday—9th Tuesday—10th Wednesday—11th Thursday—12th

TECENS-2620 9:00AM BRKENS-1500 8:00AM LTRARC-3001 8:00AM BRKENS-2655 1:30PM BRKENS-2610 10:30AM BRKENS-2094 9:30AM
Catalyst 9000 Switching Introduction to Campus Mastering Catalyst 9000 Catalyst Center Network Catalyst Center Network Media & Time Sensitive
Architecture and Software Network Design and Switches: Architectural Operations Essentials using Operations Essentials using Networking with C9K Switches:
Innovations Multilayer Architectures Insights and Troubleshooting UI and APIs UI and APIs Converging Time Sensitive
Strategies Applications & Devices onto
BRKENS-2092 8:00AM Ethernet
TECENS-2680 2:00PM LTRENS-2429 8:00AM BRKENS-1402 3:00PM
CIUG-1109 10:30AM
BGP EVPN in Enterprise BRKARC-2099 10:30AM
Cisco Catalyst 9000 Campuses with Catalyst AI/ML in Cisco Catalyst Deploying Cisco Catalyst Catalyst 9000 Switching
Switching Family 9000 Series Switches Center: Transforming Center with CICD Innovations & Roadmap Catalyst 9000 Series
Architecture Network Operations! Switching Family: Core and
BRKENS-2095 9:30AM Distribution
TECARC-2446 2:00PM Designing Highly Available BRKARC-2092 11:00AM BRKARC-2039 4:00PM LTRENS-2256 1:00PM BRKARC-2098 10:30AM
Networks using Catalyst
BGP EPVN in Enterprise Unlocking the Automation Cisco Catalyst 9000 Cisco Catalyst Switching
9000 Series Switches Open-Source GenAI Bot for
Campus with Catalyst 9000 Power in Catalyst Center for Switching QoS with Silicon Innovations Lab Catalyst Center
Switching Platforms Wired and Wireless One ASICs Deep Dive
BRKENS-2652 11:00AM
Networks
Connecting Beyond Fabric: BRKENS-2603 4:00PM BRKENS-2500
Catalyst 9000 BGP EVPN
BRKENS-2609 11:00AM 1:30PM

Handoff Scenarios Deploy Cisco Catalyst Center Catalyst Switching enabled Advanced Campus Network
with Rest-API's Smart Buildings : Beyond Design: Multilayer
BRKENS-2604 1:00PM PoE Connectivity Architectures and Next-Gen
Atomic Config Replace with Protocols
Cisco Catalyst 9000 BRKARC-2668 3:30PM
Campus Switching
BRKENS-2608 2:30PM
Architecture for Future
Future-proofing Campus Proofed Workspaces
Switching for WiFi7

BRKARC-1012 2:30PM
Investment Protection with
Catalyst 9000 Series
Switching & Wireless: A
Competitive Edge
BRKENS-2099 4:00PM
Innovations on Cisco
Campus Switching for
Sustainability and Energy BU-led sessions
Management
 BU-led sessions
© 2025 Cisco and/or its affiliates. All rights reserved.

-
#CiscoLiveAPJC © 2024 Cisco and/or its affiliates. All rights reserved. Cisco Public
 Cisco Live US SD-Access Fabric Learning Map

Sunday—8th Monday—9th Tuesday—10th Wednesday—11th Thursday—12th

TECENS-2820 9:00AM BRKENS-2810 10:00AM BRKENS-1805 11:00AM BRKENS-2816 10:30AM BRKENS-2650 8:30AM
Cisco Software-Defined Cisco Software-Defined SD-Access in Action: Cisco SD-Access Transit: Designing and Deploying Cisco
Access LISP: Architecture Access LISP Solution Trusted Outcomes Across Advanced Design Principles SD-Access with BGP EVPN
Overview Fundamentals Education and Finance-
Featuring UC Riverside &
LTRENS-3751 CIBC Bank
LTRENS-2509 9:00AM 1:00PM BRKENS-2824 2:00PM IBOENS-2826 10:30AM BRKENS-2700 8:30AM
Mastering Cisco SD-Access: SD-Access as Code with Deploying Your First Cisco Cisco SD-Access Design Fabric Networking in the
LISP Pub/Sub and its Cisco Catalyst Center and SD-Access Project and Deployment Best Campus: What's the fuss and
Benefits Made Simple ISE Automation Practices what are the choices?

TECENS-2850 2:00PM IBOENS-1100 2:30PM BRKENS-2804 4:00PM BRKENS-2836 10:30AM BRKENS-3834 10:30AM
Security in Enterprise - A Cisco Catalyst Center and The Power of Cisco SD- Endpoint profiling and 1 to 100: Master All Steps of
cross domain security primer SD-Access Design Access LISP Fabric: segmentation using AI Automated and Seamless
across LAN, wLAN and WAN Fundamentals Simplified Deployment to endpoint Analytics and Cyber Deployment, Integration, and
Advanced Use Cases - Part Vision for next generation SD Migration of Large SDA and SD-
2 Access manufacturing plants WAN Networks
BRKENS-1804 3:30PM IBOENS-2828 4:30PM BRKENS-1806 1:00PM BRKENS-3810 2:30PM
The Power of Cisco SD- Network Quest: Exploring Transforming Enterprise How to Adopt Zero Trust using
Access LISP Fabric: Campus Fabrics and Secure Networks with Cisco SD- SD-Access and Default-Deny
Simplified Deployment to Segmentation Access: Real-World without Tears
Advanced Use Cases - Part Strategies from CDW
1
BRKENS-1851 4:00PM BRKENS-3826 3:30PM
Zero Trust: Secure the Advanced LISP SD-Access
Workplace with Cisco Forwarding Architecture
Software-Defined Access

BU-led sessions
Cisco Catalyst Programmability Sessions
at Cisco Live San Diego 2025
Sunday June 8 Monday June 9 Tuesday
May 2017
June 10 Wednesday
June 2017
June 11

9:00 AM – 1:00 PM 1:00 PM – 2:00 PM 11:30 AM - 1:15 PM 4:00 PM - 4:30 PM

TECOPS-2314 BRKENS-2604 DEVNET-1110 CISCOU-1059
Automating All Things Atomic Config Replace Modern approaches for Observability at TorIX:
YANG, All the time - with Cisco Catalyst 9000 IOS XE network device custom telemetry
Programmability and management on Cat9k solutions on next-gen
3:30 PM – 5:00 PM campus switching
Automation 101 with
1:30 PM – 2:30 PM
Cisco IOS XE BRKOPS-1401
Cisco IOS XE: BRKDEV-2017
Telemetry, Automation, gRPC, gNMI, gNOI... Oh
and YANG—Oh My! My! An Enterprise
Network Automation Walk-in labs (open Monday-Thursday)!
Journey
2:00 PM – 3:30 PM ✓ Efficiently monitoring device statistics in real-time
using gRPC Dial-out with IOS XE [LABPRG-2004]
BRKOPS-2223
Network of the Future is
✓ Explore and test YANG models for model driven
Here - Let's Automate
telemetry on IOS XE with Cisco’s YANG Suite
your IPv6 deployment
[LABOPS-2000]
with Python!
Session Levels:
✓ Hands-On Lab: Monitoring Cisco IOS-XE Devices
Beginner with RESTCONF [LABDEV-2001]
Intermediate [Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 119
Programmability Website

The one-stop-shop for Cisco IOS XE Programmability resources including videos, white papers, labs and more!

• Community Forum
• IOS XE FAQ
• White Papers
• Code Exchange
• IOS XE Docs & Guide
• Learning Tracks and Labs
• Sandboxes
• … and more !

[Link]
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 120
Cisco YANG Suite

YANG API Testing and Validation Environment

Construct and test YANG based APIs over

NETCONF, RESTCONF, gRPC and gNMI
[Link]/yangsuite
IOS XE / IOS XR / NX OS platforms
[Link]/CiscoDevNet/yangsuite
On-Demand Learning Lab with YANG Suite in Docker
[Link]
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 121
API White Paper
[Link]

[Link]
Website: [Link]
PDF: [Link]
Webinar with live demos & examples: [Link]
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 122
 Model Drive Telemetry (MDT) White Paper
The Model Driven Telemetry White Paper includes examples, use cases and tooling related to telemetry.
This paper is now available online and in PDF form!

Website

PDF

View online: [Link]

View as PDF: [Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 123
dCloud Programmability
[Link]
“Cisco Catalyst 9000 IOS XE Programmability & Automation Lab v1”
[Link]
lab-v1

Model Driven Telemetry

Use Cases: Telemetry configuration with CLI and YANG Suite
EVPN: Collection with TIG_MDT container and tooling
Ansible with CLI deployment of EVPN solutions
EVPN management over RESTCONF/YANG with
Postman YANG Programmability
Declarative EVPN fabric management with Terraform YANG Suite tooling and integrations to YANG API’s
Ansible integrations

Tooling and Integrations Ubuntu VM Details:

YANG Suite Syslog receiver from all switches
• NETCONF/RESTCONF/gNMI API TFTP config backup
• Ansible integration See slide
• NETCONF/gNMI Dial-In Telemetry
• gRPC Dial-Out Telemetry receiver
Windows VM Details
Telemetry VS Code
• TIG stack in Docker Terraform @ folder
• Grafana dashboard for device health Ansible @ folder VLAN1
c9k-spine
Chrome browser IP: [Link]
Postman / RESTCONF YANG Suite, Grafana developer /
• EVPN fabric API calls Bash/PS/Cmd shells C1sco12345
SSH into C9K or Ubuntu c9k-leaf1
Terraform/RESTCONF IP: [Link]
Postman developer /
• Declarative EVPN fabric management Workspace for EVPN C1sco12345
c9k-leaf2
Ansible IP: [Link]
C9K VM’s
• EVPN solution enablement using CLI developer /
C1sco12345
c9kvdd-1 - unconfigured
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 124

c9kvdd-7 - unconfigured
DevNet Sandbox – overview for Campus and Enterprise
[Link]

1. Reservable Physical: C9200, C9300, C9300X including stacks

About to go into production April 2025
Usecases: Application Hosting, Power telemetry, etc
2. Reservable Virtual: C8KV Router + NX + XR + Ubuntu VM
Usecases: Enterprise topology, dual-ZTP
3. Always-On: C9KV
Usecase: Virtual switch for basic config validation usecases
DNS: [Link] C9KV user is priv15
“Launch Sandbox” to get login credentials and has full
4. Always-On: C8KV permissions, there
DNS is [Link] is reset automation
5. Reservable Catalyst Center (Physical & Virtual) for when you break
it now too ☺
CML and C9KV, ISE for SDA
Additional enablement labs:
1. YANG Suite “Learning Lab 2.0”
Interactive guide with tool running in Docker container
“YANG Suite as a service”
2. dCloud Programmability Lab
EVPN topology with all programmability features enabled
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 125
C9KV Always-On with reservation New C9kV Sandbox now available!

Sandbox access: [Link]

Hostname: [Link]

C9KV Sandbox Capabilities:

• Cisco IOS XE 17.15.1 Virtual Catalyst 9000 UADP 8 port
switch
• “Always-On” outside of the Cisco Network DMZ in a
colocation on hardware in VMWARE/OVA
• Accessible with reservation though Cisco’s Developer
Enablement platform
• Reservable by anybody including customers, partners
and external
• Enabled for read-only usecases with SSH/CLI and API:
NETCONF/YANG, RESTCONF, gNMI
• Support for Model-Driven Telemetry and basic
configuration changes through the API
• Supports 40 concurrent sessions

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 126
Cisco University (Cisco U) part of L&D

[Link]
[Link]

Direct link to Tutorial, requires login to [Link] first:

1. [Link]
2. [Link]
3. [Link]
4. [Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 127
 Complete Your Session Evaluations

Complete a minimum of Earn 100 points per Level up and earn Complete your surveys
4 session surveys and survey completed exclusive prizes! in the Cisco Live
the Overall Event and compete on the mobile app.
Survey to be entered in Cisco Live Challenge
a drawing to win 1 of 5 leaderboard.
full conference passes
to Cisco Live 2026.

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 128
 Continue your education

Visit the Cisco Book your one-on-one Attend the interactive Visit the On-Demand
Showcase for related Meet the Engineer education with DevNet, Library for more
demos meeting Capture the Flag, and sessions at
Walk-in Labs [Link]/
on-demand

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-1110 129
Questions
Thank you