How to Restrict NETCONF Access Using an ACL on Cisco Routers?

350-401 By islever Editorial Last updated

Short answer

B R1(config)# netconf-yang ipv4 access-list name netconfacl

Question

Refer to the exhibit. An engineer must configure router R1 to allow only NETCONF connections from the management VLAN. Which command completes this configuration? - Exhibit: How to Restrict NETCONF Access Using an ACL on Cisco Routers?
  1. R1(config-if)# ip access-group netconfacl in
  2. R1(config)# netconf-yang ipv4 access-list name netconfacl Correct Answer
  3. R1(config)#ip http secure-server
  4. R1(config-if)#ip access-group netconfacl out

Key Takeaways

The question evaluates whether candidates understand service-level ACL binding versus traditional interface-based filtering, with the primary trap being the instinct to use ip access-group on physical interfaces.

This question tests the correct method for restricting NETCONF/YANG server access using an IPv4 access control list. The community overwhelmingly agrees that applying the ACL directly to the NETCONF service via the netconf-yang command is the standard Cisco-recommended approach.

Common mistake: Many candidates select options A or D, defaulting to familiar interface-level ip access-group commands. This fails because NETCONF operates at the transport/application layer, requiring explicit service-level authorization rather than generic interface traffic filtering.

Expert Analysis

Understanding Service-Level ACLs for NETCONF

To restrict NETCONF connections to a specific subnet (like a management VLAN), Cisco IOS XE requires you to bind an IPv4 or IPv6 access control list directly to the NETCONF/YANG service. The correct command structure is netconf-yang ssh ipv4 access-list name <acl-name>. Option B correctly implements this by referencing the pre-configured netconfacl. As noted by community experts, the exam option omits the ssh keyword for brevity, but the underlying service-binding mechanism remains identical and is the only valid method to enforce protocol-specific access.

Why Interface-Based Filtering Fails Here

Options A and D suggest applying the ACL using ip access-group on an interface. While this is standard practice for general traffic filtering, it does not guarantee NETCONF session restriction. NETCONF relies on TCP port 830, and interface ACLs can be bypassed by routing behaviors or hardware offloading. Cisco explicitly mandates service-level ACLs for NETCONF/RESTCONF to ensure proper authentication and authorization checks occur before the connection reaches the transport layer.

Evaluating Other Options

Option C (ip http secure-server) merely enables HTTPS for the HTTP server and has no relation to NETCONF access control. Community feedback consistently validates Option B, with multiple users cross-referencing Cisco’s official programmability documentation to confirm the exact syntax. This reinforces the importance of recognizing when a question requires daemon-level configuration rather than traditional network interface tuning.

Official Reference

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/prog/configuration/1612/b_1612_programmability_cg/netconf_and_restconf_service_level_acls.pdf

This link opens the official vendor documentation in a new tab.

Exam Strategy

When troubleshooting or configuring modern programmability features like NETCONF, RESTCONF, or BGP graceful restart, always look for service-specific configuration modes rather than falling back to legacy interface or global commands. Memorize the exact syntax for binding ACLs to these services, as exam questions frequently test this distinction to separate routine network engineers from automation-ready professionals.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. peugeotdude 👍 7 Answered B
    It's B see https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/prog/configuration/1612/b_1612_programmability_cg/netconf_and_restconf_service_level_acls.pdf
  2. gorillaenhanced 👍 7 Answered B
    B, but it is missing the 'ssh' keyword : netconf-yang ssh {{ipv4 | ipv6 }access-list name access-list-name} | port port-number}
  3. Tadese 👍 5 Answered B
    : Configuring an ACL for a NETCONF Session Device# enable Device# configure terminal Device(config)# ip access-list standard acl1_permit Device(config-std-nacl)# permit 192.168.255.0 0.0.0.255 Device(config-std-nacl)# deny any Device(config-std-nacl)# exit Device(config)# netconf-yang ssh ipv4 access-list name acl1_permit Device(config)# end
  4. Mizuchan 👍 1 Answered D
    In a typical scenario where the goal is to restrict NETCONF connections from a specific VLAN (such as the management VLAN), using an access control list (ACL) applied outbound on the interface connected to that VLAN is a common approach.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Configure VTY Lines for Idle Session Termination

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide