Atomic Config Replace with
Cisco Catalyst 9000
Story DeWeese & Ashil Parekh
Technical Marketing & Product Management
@StoryDeWeese
DEVNET-2385
-
• Misconfiguration
Consequences
• Intro to Atomic Config
Replace (ACR)
Agenda • NETCONF CLI RPC
• ACR Demos
• Hands-On Opportunities
• Resources
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 3
Webex App
Questions?
Use the Webex app to chat with the speaker
after the session
How
1 Find this session in the Cisco Events mobile app
2 Click “Join the Discussion”
3 Install the Webex app or go directly to the Webex space
4 Enter messages/questions in the Webex space
Webex spaces will be moderated
by the speaker until February 28, 2025.
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 4
NETWORK SECURITY
OUTAGE BREACH
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 5
Human Error
or
Misconfiguration
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 6
State of Network Misconfigurations
45%
---------------------------------------- ----------------------------------------------
22%
Network-related outages are caused by Data breaches are caused by human errors. [2]
configuration failure. [1]
$1 Million
----------------------------------------
$4.8 Million
----------------------------------------------
25% respondents said their most recent outage Is the global average cost of a data breach, increased by 10%
cost more than $1 million. [1] compared to the previous year. [2]
[1] - Annual outages analysis 2023 – Uptime
[2] - Cost of a Data Breach Report 2024 - IBM
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 7
Business Impact of Misconfiguration
$60 Million
-------------------------------------
$350 Million
-------------------------------------------
A fast-food chain lost over $60 million in Multinational telecom company lost over $350 million
revenue due to a global IT outage caused by in revenue due to network-wide outage caused by a
misconfiguration. config error.
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 8
Introducing
Introducing Atomic
Atomic Configuration
Configuration Replace
IOSd Replace
Validate
Request
write
Validate
Config Staging
Validate Configuration
Validate Read Memory
Response Staging System verifies configuration
Environment integrity before applying.
Catches potential
errors early
IOS
IOS ––
Running
Running
Config
Config
Commit
Request
write
Apply
Commit
Config
Response Read Atomic Transaction Config Rollback
Apply configuration changes If issues arise, revert to last
as a single transaction. All known good configuration
changes succeed, immediately
or none do
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 9
Evaluating ACR Benefits
Without Atomic Replace With Atomic Replace
VS
Manual Verification Config Verification Syntax, Semantic and Dependency Verification
Immediate Command Execution - Incremental Config Changes Pre-Validated Configuration Deployment -
Changes Transactional Integrity
Costly configuration errors, Reactive Proactive error prevention and reduced risk of
Troubleshooting & Outage outage to enable seamless network
troubleshooting with high risk of outage
management
Errors can leave the network exposed with Ensures adherence to security policies and
higher risk of non-compliant configurations Security & Compliance compliance requirements
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 10
Cisco IOS XE Architecture
Modularized Components for Software Abstraction
Route Process Forwarding Process Chassis Mgmt
(RP) Complex (FP) Complex I/O Complex
Control Plane Management Plane
Data Plane Data Plane
FMAN-RP CMAN-RP FMAN-FP IOMD/XCVR
XE
IOSd SSO DB
Apps CMAN-FP CMAN-CC
(RF/CF)
Platform Mgr System Admin Stack Mgr System Admin System Admin
FED / CPP Infrastructure Services CPA / CIA Infra Services Infra Services
Linux Kernel
Interfaces & Transceivers Device Interconnects (Backplane) ASICs & FPGAs
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 11
NETCONF CLI
RPC
-
Original 17.9
YANG model for CLI execution
Any configure CLI can now be sent within the YANG payload
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" <rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"
message-id="101"> message-id="101">
<config-ios-cli-rpc <config-ios-cli-trans
xmlns=[Link] xmlns=[Link]
<config-clis> <clis>
interface Loopback111 interface Loopback111
description configured-via-CLI-YANG description configured-via-CONFD-YANG
no shutdown no shutdown
</config-clis> </clis>
</config-ios-cli-rpc> </config-ios-cli-trans>
</rpc>]]>]]> </rpc>]]>]]>
“cli rpc” sends CLI to the IOS parser
This is similar to configuring CLI on the VTY
Directly into running-config, then synchronized to ConfD
“transactional cli rpc” sends a list of CLI to ConfD
This is similar to sending edit-config RPCs corresponding to the CLI’s.
Synchronized from ConfD into the CLI running-config
[Link]
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
[Link]
This YANG data model allows sending CLI through the YANG API interfaces
Previously only YANG modelled data was supported
[Link]
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 15
Get Modelled Config CLI RPC
• Sending the “get-modelled-config-clis” RPC returns
the modelled running-config in CLI format
• Anything not modelled will not be returned (AppH)
• Unsupported model config will be ignored (AppH)
• This is used as the template to update the device with
after being modified as needed
RPC:
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="101">
<get-modelled-config-clis xmlns="[Link]
</rpc>
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 16
Atomic Config Replace - ACR
Atomic Config Replace enables full or partial config replace
Ability to send an entire configuration to the device in an XML/JSON payload
Support for traditionally documented CLI’s over the [Link]
Full and selective replace supported as part of Merge, Replace operations supported as part of
CLI RPC over NETCONF/YANG NETCONF/YANG
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 17
IOS XE NETCONF Datastores *
“A Datastore holds a copy of the configuration data
that is required to get a device from its initial default
state into a desired operational state” Running Running-config
Running is the default and only mandatory Datastore
The Candidate Configuration feature enables support Candidate Candidate config
for candidate capability by implementing RFC 6241
with a simple commit option.
The candidate datastore provides a temporary
workspace in which a copy of the device's running
configuration is stored.
The candidate configuration supports the confirmed
commit capability
Commit with
confirm
* Recommend to use running datastore only during this phase
[Link]
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 18
2-Stage Commit
• The 2-Stage commit process includes error and syntax checking
• It enabled a multi-stage commit process with verify before apply
• It is a non-disruptive application processes for the changes – no impact to packet processing
• 2-Stage Commit is only seen when config is rejected as there is no disruption to service
Enable 2-stage commit with # yang-interfaces feature ios-two-stage
CLI will be simplified to # yang-interfaces features atomic-config
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
Pre-requisites for ACR
On the Catalyst device, the following CLI’s must be configured for ACR:
1. netconf-yang
2. netconf-yang feature candidate-datastore
3. yang-interfaces feature atomic-config
4. yang-interfaces feature deprecated disable
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
ACR demos
-
Python Script Using ACR
Detailed Python Script workflow:
1. Start
2. Initialize Device
3. Netconf Connect
4. Discard Changes
5. Get Pre-check Config
6. Apply Config (edit_config)
7. Get Post-check Config
8. Compare Pre & Post Configs
9. Confirmed Commit
10. Get Post-confirmed Commit Config
11. Commit Changes
12. Compare Pre & Final Configs
13. End
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 23
ACR Demo 1: Syntax & Dependency Error
Isolation
See demo of these steps in the next slide!
1. Send a “full-replace” operation to a C9300 switch to fully replace
all the current config on the device with the new config provided
in the “target_C9K_config.xml” file
2. Notice syntax error is found in the “target_C9K_config.xml” file
by ACR and the exact line of the error is provided
3. Fix the syntax error in the “target_C9K_config.xml” file
4. Send the “full-replace” operation once again to the C9300
switch
5. Verify that the ACR result is “Configuration applied successfully”
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 24
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 25
ACR Demo 2: rollback config because no confirm
commit
See demo of these steps in the next slide!
1. Send a “full-replace” operation to a C9300 switch to fully replace
all the current config on the device with the new config provided
in the “target_C9K_config.xml” file
2. Notice that although the configuration is valid and applied to the
device, the device returns to its previous known state because
no “confirm commit” was issued
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 26
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 27
ACR Demo Scenario: Day1 to Day N
Atomic Config Replace with NETCONF/YANG
Config: ACR/[Link]
Hostname: jcohoe-c9300x-border1-acr-day1
Applied with: [Link] and [Link]
Day 1 Day N
Config: ACR/[Link]
Hostname: jcohoe-c9300x-border1-acr-dayn
Applied with: [Link] and [Link]
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 28
[Link]
tme@tme-yangsuite:~/acr/jcohoe-c9300x-border1-acr$ cp [Link] [Link].good1
cat ~/acr/jcohoe-c9300x-border1-acr/[Link]
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 29
[Link]: device configuration & config file
Specify Device (line 244)
Authentication User/Pass
XML configuration file (line 256)
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 30
Day- 0 to Day - 1
Hostname before:
VNC2-BORDER1-X
Hostname after:
jcohoe-c9300x-border1-acr-day1
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 31
Day-1 to Day-N
Hostname before:
jcohoe-c9300x-border1-acr-day1
Hostname after:
jcohoe-c9300x-border1-acr-dayn
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 32
Ready to get
hands-on?
-
ACR: Scope
• Validates only device-level configurations
• Network-level configurations are not validated
• Pre-Release Feature: Available for Early Field Trials
• Supported on Catalyst 9300 & 9500
• 9200, 9400 & 9800 (WLC) support coming soon! Category Features
• Supported on programmable interfaces Basic L2
Ethernet interfaces, Port channel interfaces, Port channel, Spanning tree,
LACP, Logging, Err-disable
• Exclusively with NETCONF & NETCONF CLI RPC VRF, VLAN interfaces, Loopback interfaces, IP, IP DHCP, IP Route, MPLS,
L3 and SVL
• Works with specific set of features
ARP, Track
Class-map, Policy-map, Route-map, AAA, Ssh, IP ACL, TACACS, Crypto,
Policy (Security and Others)
certs etc, Username
Management, Device HTTP, SNMP, Banner, Line, NTP, Monitor, Call home, Hostname, Service,
configuration and access etc. Archive, PnP, Event Manager
Post-deployment rollback, Config Diff, Commit Comment, ISSU, Manage
Advanced features
static imperative device objects
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 34
Resources
-
Cisco Catalyst Programmability Sessions at Cisco
Live EMEA 2025
Sunday Feb 9 Monday Feb 10 Tuesday
May 2017
Feb 11 Wednesday
June 2017
Feb 12 Thursday Feb 13
Session Levels: 3:30 PM 10:00 AM 11:30 AM 11:00 AM
Beginner DEVNET-1249 Secure DEVLIT-2062 Getting DEVNET-2385 CISCOU-1043
Intermediate Zero Touch Provisioning Started with Secure Atomic Config Replace Maximizing Cisco IOS XE
(SZTP) with Cisco Zero Touch Provisioning with Cisco Catalyst 9000 Efficiency with YANG
Catalyst Switches Suite
11:00 AM 1:30 PM
DEVLIT-2083 SKILLS-1110
Automate Cisco IOS XE Configure IOS XE Using
Device Configuration the CLI
Using Terraform
2:30 PM
2:00 PM
SKILLS-1111
DEVWKS-2008 Configure IOS XE Using
Automation
NetDevOps 3,2,1,
Action! Reduce the
Attack Surface of IOS XE
with Ansible
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 36
Programmability Website
The one-stop-shop for Cisco IOS XE Programmability resources including videos, white papers, labs and more!
• Community Forum
• IOS XE FAQ
• White Papers
• Code Exchange
• IOS XE Docs & Guide
• Learning Tracks and Labs
• Sandboxes
• … and more !
[Link]
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 37
Cisco YANG Suite
YANG API Testing and Validation Environment
Construct and test YANG based APIs over
NETCONF, RESTCONF, gRPC and gNMI
[Link]/yangsuite
IOS XE / IOS XR / NX OS platforms
Get hands-on using the new learning lab! [Link]/CiscoDevNet/yangsuite
[Link]
Docker container innovation 1 container
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 38
[Link]
API White Paper
Website: [Link]
PDF: [Link]
Webinar with live demos & examples: [Link]
[Link]
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 39
Model Drive Telemetry (MDT) White Paper
The Model Driven Telemetry White Paper includes examples, use cases and tooling related to telemetry.
This paper is now available online and in PDF form!
Website
PDF
View online: [Link]
View as PDF: [Link]
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 40
dCloud Programmability
[Link]
“Cisco Catalyst 9000 IOS XE Programmability & Automation Lab v1”
[Link]
Model Driven Telemetry
Use Cases: Telemetry configuration with CLI and YANG Suite
EVPN: Collection with TIG_MDT container and tooling
Ansible with CLI deployment of EVPN solutions
EVPN management over RESTCONF/YANG with
Postman YANG Programmability
Declarative EVPN fabric management with Terraform YANG Suite tooling and integrations to YANG API’s
Ansible integrations
Tooling and Integrations Ubuntu VM Details:
YANG Suite Syslog receiver from all switches
• NETCONF/RESTCONF/gNMI API TFTP config backup
• Ansible integration See slide
• NETCONF/gNMI Dial-In Telemetry
• gRPC Dial-Out Telemetry receiver
Windows VM Details
Telemetry VS Code
• TIG stack in Docker Terraform @ folder
• Grafana dashboard for device health Ansible @ folder VLAN1
c9k-spine
Chrome browser IP: [Link]
Postman / RESTCONF YANG Suite, Grafana developer / C1sco12345
• EVPN fabric API calls Bash/PS/Cmd shells c9k-leaf1
SSH into C9K or Ubuntu IP: [Link]
Terraform/RESTCONF developer / C1sco12345
Postman c9k-leaf2
• Declarative EVPN fabric management Workspace for EVPN IP: [Link]
developer / C1sco12345
Ansible c9kvdd-1 - unconfigured
C9K VM’s
• EVPN solution enablement using CLI
c9kvdd-7 - unconfigured
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 41
Cisco IOS XE - Reservable Virtual Sandbox
This DevNet reservable sandbox has IOS XRv + N9Kv + IOS XE
The Catalyst 8000V within the DevBox is enabled for Day 0/ZTP usecases
[Link]
“IOS XE on Cat8kv”
[Link]
The “Enterprise Networking” Learning Labs contains guides for the supported usecases
[Link]
Sandbox Capabilities:
TIG_MDT Telemetry
YANG Suite API
Terraform + Ansible
ZTP & Guest Shell
… and more
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 42
Cisco IOS XE - Always On Virtual Sandbox
The “IOS XE on Cat8kv Always On” virtual sandbox requires no reservation
The c8kv can be accessed with SSH, NETCONF, and RESTCONF
Hostname: [Link]
Username: admin Password: C1sco12345
SSH port 22, NETCONF port 830, RESTCONF HTTPS
[Link]
[Link]
[Link]
The “Enterprise Networking” Learning Labs contains guides for the supported usecases
[Link]
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 43
Cisco University (Cisco U) part of L&D
[Link]
[Link]
Direct link to Tutorial, requires login to [Link] first:
1. [Link]
2. [Link]
3. [Link]
4. [Link]
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 44
Fill Out Your Session Surveys
Participants who fill out a minimum of 4 session
surveys and the overall event survey will get a
unique Cisco Live t-shirt.
(from 11:30 on Thursday, while supplies last)
All surveys can be taken in the Cisco Events
mobile app or by logging in to the Session Catalog
and clicking the ‘Participant Dashboard’
Content Catalog
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 45
• Visit the Cisco Showcase
for related demos
• Book your one-on-one
Meet the Engineer meeting
Continue • Attend the interactive education
your education with DevNet, Capture the Flag,
and Walk-in Labs
• Visit the On-Demand Library
for more sessions at
[Link]/on-demand.
Sessions from this event will be
available from March 3.
-
DEVNET-2385 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 46
Thank you
-
-