System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

NETCONF access controls

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains how NETCONF access controls separate management requests from other SSH services by port and ACL while preserving SCP and SFTP access.

A NETCONF access control is an SSH security mechanism that

  • blocks NETCONF requests on the SSH port while allowing them on a designated NETCONF port

  • restricts NETCONF access with IPv4 or IPv6 ACLs, and

  • allows SSH services such as SCP and SFTP to continue on the SSH port.

SSH uses port 22 by default, and NETCONF uses port 830 by default. Without this control, a NETCONF session can be established on the SSH port.

Table 1. Feature History Table
Feature Name Release Information Description
NETCONF access controls Release 25.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: Q100, Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

When this feature is enabled, NETCONF sessions will be blocked on the SSH port. However, SCP and SFTP will continue to function on the SSH port.

The feature introduces these changes:

CLI:

YANG Data Models:

Benefits of NETCONF access control

  • Prevents unauthorized NETCONF requests on the SSH port.

  • Blocks NETCONF for selected addresses without blocking their SSH access.

  • Preserves SCP and SFTP access.

How NETCONF access controls work

The SSH server cannot identify the requested subsystem during the TCP handshake or user authentication. It identifies NETCONF when the client requests a channel.

Summary

The process uses these components:

  • SSH server: Establishes the connection and enforces subsystem access.

  • SSH and NETCONF ports: Separate general SSH and NETCONF services.

  • ACLs: Restrict addresses on the configured service port.

  • Client: Requests NETCONF, SCP, SFTP, or another permitted SSH service.

Workflow

These stages describe NETCONF access enforcement:

  1. An administrator disables NETCONF on the SSH port and configures any port ACLs.

  2. The server completes the TCP handshake and authenticates the SSH connection.

  3. At channel-request time, the server identifies the requested subsystem.

  4. The server rejects NETCONF on a disabled SSH port and continues to allow permitted services such as SCP and SFTP.

Result

NETCONF is available only through permitted ports and addresses while other allowed SSH services remain available.

Guidelines for NETCONF access control

Restrict NETCONF to approved addresses and ports

Disable NETCONF on the SSH port and apply ACLs to the designated NETCONF service.

The server cannot distinguish NETCONF from another SSH service until the client requests a channel. Port ACLs can reject disallowed addresses during connection establishment.

Apply this practice when NETCONF management must meet address-based or port-separation security requirements.

Approved clients use the NETCONF port while SCP, SFTP, and other permitted SSH services remain available on the SSH port.

NETCONF access control restrictions

Account for these restrictions when designing NETCONF access policy.

NETCONF access control has these restrictions:

  • The SSH protocol does not identify the requested service during the TCP handshake or authentication.

  • The server rejects NETCONF on the SSH port only after it receives the channel request.

  • An ACL on the NETCONF port rejects a blocked address during the TCP handshake.

  • Disabling NETCONF on the SSH port does not block SCP or SFTP for the same address.

Configure NETCONF access control

Prevent NETCONF management sessions from using the SSH service port.

Before you begin

  • Ensure that you have administrative access.

  • Confirm that NETCONF clients can use the designated NETCONF port before blocking NETCONF on the SSH port.

Procedure

  1. Disable NETCONF on every configured SSH port and commit the configuration.

    Example:

    Router# configure
Router(config)# ssh server netconf disable ssh-port
Router(config)# commit

  2. Attempt a NETCONF connection on the SSH port and inspect the router log.

    Example:

    Router# show logging
%SECURITY-SSHD_SYSLOG_PRX-3-ERR_GENERAL: On ssh port invalid netconf channel request received

The router rejects NETCONF channel requests on the SSH port and continues to accept permitted SSH, SCP, and SFTP requests.