How to Restrict NETCONF Access Using an ACL on Cisco Routers?

Network Programmability & Automation

Refer to the exhibit. An engineer must configure router R1 to allow only NETCONF connections from the management VLAN. Which command completes this configuration? -

R1(config-if)# ip access-group netconfacl in
R1(config)# netconf-yang ipv4 access-list name netconfacl Source Reference Answer
R1(config)#ip http secure-server
R1(config-if)#ip access-group netconfacl out

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question evaluates whether candidates understand service-level ACL binding versus traditional interface-based filtering, with the primary trap being the instinct to use ip access-group on physical interfaces.

This question tests the correct method for restricting NETCONF/YANG server access using an IPv4 access control list. The community overwhelmingly agrees that applying the ACL directly to the NETCONF service via the netconf-yang command is the standard Cisco-recommended approach.

Many candidates select options A or D, defaulting to familiar interface-level ip access-group commands. This fails because NETCONF operates at the transport/application layer, requiring explicit service-level authorization rather than generic interface traffic filtering.

Community Discussion (4 comments)

gorillaenhanced 👍 7 Selected: B

B, but it is missing the 'ssh' keyword : netconf-yang ssh {{ipv4 | ipv6 }access-list name access-list-name} | port port-number}

peugeotdude 👍 7 Selected: B

It's B see https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/prog/configuration/1612/b_1612_programmability_cg/netconf_and_restconf_service_level_acls.pdf

Mizuchan 👍 1 Selected: D

In a typical scenario where the goal is to restrict NETCONF connections from a specific VLAN (such as the management VLAN), using an access control list (ACL) applied outbound on the interface connected to that VLAN is a common approach.

Tadese 👍 5 Selected: B

: Configuring an ACL for a NETCONF Session Device# enable Device# configure terminal Device(config)# ip access-list standard acl1_permit Device(config-std-nacl)# permit 192.168.255.0 0.0.0.255 Device(config-std-nacl)# deny any Device(config-std-nacl)# exit Device(config)# netconf-yang ssh ipv4 access-list name acl1_permit Device(config)# end

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Understanding Service-Level ACLs for NETCONF

To restrict NETCONF connections to a specific subnet (like a management VLAN), Cisco IOS XE requires you to bind an IPv4 or IPv6 access control list directly to the NETCONF/YANG service. The correct command structure is netconf-yang ssh ipv4 access-list name <acl-name>. Option B correctly implements this by referencing the pre-configured netconfacl. As noted by community experts, the exam option omits the ssh keyword for brevity, but the underlying service-binding mechanism remains identical and is the only valid method to enforce protocol-specific access.

Why Interface-Based Filtering Fails Here

Options A and D suggest applying the ACL using ip access-group on an interface. While this is standard practice for general traffic filtering, it does not guarantee NETCONF session restriction. NETCONF relies on TCP port 830, and interface ACLs can be bypassed by routing behaviors or hardware offloading. Cisco explicitly mandates service-level ACLs for NETCONF/RESTCONF to ensure proper authentication and authorization checks occur before the connection reaches the transport layer.

Evaluating Other Options

Option C (ip http secure-server) merely enables HTTPS for the HTTP server and has no relation to NETCONF access control. Community feedback consistently validates Option B, with multiple users cross-referencing Cisco’s official programmability documentation to confirm the exact syntax. This reinforces the importance of recognizing when a question requires daemon-level configuration rather than traditional network interface tuning.

Official Reference

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/prog/configuration/1612/b_1612_programmability_cg/netconf_and_restconf_service_level_acls.pdf

Exam Strategy

When troubleshooting or configuring modern programmability features like NETCONF, RESTCONF, or BGP graceful restart, always look for service-specific configuration modes rather than falling back to legacy interface or global commands. Memorize the exact syntax for binding ACLs to these services, as exam questions frequently test this distinction to separate routine network engineers from automation-ready professionals.

Related Analysis

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide