如何配置NETCONF（设备侧）

以华为设备为例，学习一下如何配置NETCONF，前提是设备支持配置NETCONF。

配置SSH

创建ssh用户

[~HUAWEI]ssh user client001
Info: Succeeded in adding a new SSH user.
[*HUAWEI]aaa
[*HUAWEI-aaa]local-user client001 password irreversible-cipher SetUserPasswd@123

Info: A new user is added.  
[*HUAWEI-aaa]local-user client001 service-type ssh
[*HUAWEI-aaa]local-user client001 level 3
[*HUAWEI-aaa]commit
[~HUAWEI-aaa]q

配置ssh服务器端的加密算法

[~HUAWEI]ssh server cipher 3des_cbc aes128_cbc aes128_ctr aes256_cbc aes256_ctr 
arcfour128 arcfour256 blowfish_cbc des_cbc 
Warning: Insecure encryption algorithms are enabled. Disabling them is recommend
ed.

配置ssh用户认证方式

[*HUAWEI]ssh user client001 authentication-type password

配置SSH用户服务方式

[*HUAWEI]ssh user client001 service-type snetconf

此项配置与传统的ssh用户配置区别不大，只有在service-type处指定为snetconf。

使能NETCONF功能

[*HUAWEI]snetconf server enable 
Info: Succeeded in starting the SNETCONF server on SSH port 22.
[*HUAWEI]commit

登录到NETCONF Agent

使用厂家NMS或者自己编写程序访问设备。

检查NETCONF配置结果

[~HUAWEI]display ssh user-information 

--------------------------------------------------------------------------------
User Name             : client001
Authentication-Type   : password
User-public-key-name  : 
User-public-key-type  : -
Sftp-directory        : 
Service-type          : snetconf
--------------------------------------------------------------------------------
Total 1, 1 printed
[~HUAWEI]dis ssh server status
SSH Version                                : 2.0
SSH authentication timeout (Seconds)       : 60
SSH authentication retries (Times)         : 3
SSH server key generating interval (Hours) : 0
SSH version 1.x compatibility              : Disable
SSH server keepalive                       : Enable
SFTP IPv4 server                           : Disable
SFTP IPv6 server                           : Disable
STELNET IPv4 server                        : Disable
STELNET IPv6 server                        : Disable
SNETCONF IPv4 server                       : Enable
SNETCONF IPv6 server                       : Enable
SNETCONF IPv4 server port(830)             : Disable
SNETCONF IPv6 server port(830)             : Disable
SCP IPv4 server                            : Disable
SCP IPv6 server                            : Disable
SSH server DES                             : Enable
SSH IPv4 server port                       : 22
SSH IPv6 server port                       : 22
SSH server source address                  : 0.0.0.0
SSH ipv6 server source address             : 0::0
SSH ipv6 server source vpnName             : 
ACL name                                   : 
ACL number                                 : 
ACL6 name                                  : 
ACL6 number                                : 
SSH server ip-block                        : Enable
[~HUAWEI]dis netconf cap    
[~HUAWEI]dis netconf capability 
--------------------------------------------------
Capability                                        
--------------------------------------------------
urn:ietf:params:netconf:base:1.0                  
urn:ietf:params:netconf:base:1.1                  
urn:ietf:params:netconf:capability:writable-running:1.0
urn:ietf:params:netconf:capability:candidate:1.0  
urn:ietf:params:netconf:capability:confirmed-commit:1.0
urn:ietf:params:netconf:capability:confirmed-commit:1.1
urn:ietf:params:netconf:capability:rollback-on-error:1.0
urn:ietf:params:netconf:capability:validate:1.0   
urn:ietf:params:netconf:capability:validate:1.1   
urn:ietf:params:netconf:capability:startup:1.0    
urn:ietf:params:netconf:capability:url:1.0?scheme=file,ftp,sftp
urn:ietf:params:netconf:capability:xpath:1.0      
urn:ietf:params:netconf:capability:notification:1.0
urn:ietf:params:netconf:capability:interleave:1.0 
urn:ietf:params:netconf:capability:with-defaults:1.0?basic-mode=report-all&also-
supported=report-all-tagged,trim
urn:ietf:params:netconf:capability:yang-library:1.0?revision=2016-06-21&module-s
et-id=4124716497
urn:ietf:params:netconf:capability:notification:2.0
http://www.huawei.com/netconf/capability/sync/1.0 
http://www.huawei.com/netconf/capability/sync/1.1 
http://www.huawei.com/netconf/capability/sync/1.2 
http://www.huawei.com/netconf/capability/sync/1.3 
http://www.huawei.com/netconf/capability/exchange/1.0
http://www.huawei.com/netconf/capability/exchange/1.2
http://www.huawei.com/netconf/capability/active/1.0
http://www.huawei.com/netconf/capability/action/1.0
http://www.huawei.com/netconf/capability/discard-commit/1.0
http://www.huawei.com/netconf/capability/execute-cli/1.0
http://www.huawei.com/netconf/capability/update/1.0
http://www.huawei.com/netconf/capability/commit-description/1.0
http://www.huawei.com/netconf/capability/sync-config/1.0
http://www.huawei.com/netconf/capability/sync-config/1.1
http://www.huawei.com/netconf/capability/schema/1.0
--------------------------------------------------