NetConf Over Transport Layer Security

Transport Layer Security (TLS) is a cryptographic protocol that uses mutual certificate-based authentication to provide a secure and reliable connection between two devices. It is the successor to the Secure Sockets Layer (SSL) protocol.

When a NetConf session is established over TLS, the OcNOS NetConfF server acts as the TLS server, and the NETCONF client acts as the TLS client.

NetConf sessions over TLS provide several advantages over sessions that use SSH:

•

SSH authenticates a client using credentials (username/password) or keys.

•

TLS uses X.509 certificates to mutually authenticate the client and the server.

•

Certificates can carry additional information about the client and can be centrally issued and managed (for example, by a corporate PKI).

While NETCONF sessions over SSH work well for manually managing individual devices, NETCONF over TLS is typically preferred for secure device‑to‑device communication and for large‑scale automation.

TLS subsystem logs are integrated with the system logger (syslog) and appear (along with other OcNOS logs) in /var/log/message with the tag TLS_SUBSYS.

By default, the OcNOS NETCONF server listens for NETCONF over TLS connections on TCP port 6513.

A maximum of 3 NETCONF sessions over TLS are supported.

Topology

This topology depicts OcNOS device acts as NETCONF server over TLS.

NETCONF client (for example, netopeer2-cli running in a Docker container) connects over TCP port 6513 using mutual TLS.

The same TLS server certificate on OcNOS can be used both for NETCONF over TLS and for Streaming Telemetry over TLS.

Figure 2. Netconf over TLS Topology