This page offers details on how the netconf connection works in Ansible and how to use it.
* all modules except
|Protocol||XML over SSH|
uses SSH keys / SSH-agent if present
|Indirect Access||via a bastion (jump host)|
For legacy playbooks, Ansible still supports
ansible_connection=local for the netconf_config module only. We recommend modernizing to use
ansible_connection=netconf as soon as possible.
Before you can use NETCONF to connect to a switch, you must:
ncclientPython package on your control node(s) with
pip install ncclient
To enable NETCONF on a new switch via Ansible, use the platform specific module via the CLI connection or set it manually. For example set up your platform-level variables just like in the CLI example above, then run a playbook task like this:
- name: Enable NETCONF connection: network_cli junos_netconf: when: ansible_network_os == 'junos'
Once NETCONF is enabled, change your variables to use the NETCONF connection.
[junos:vars] ansible_connection=netconf ansible_network_os=junos ansible_user=myuser ansible_password=!vault |
- name: Backup current switch config netconf_config: backup: yes register: backup_junos_location
- name: configure interface while providing different private key file path netconf_config: backup: yes register: backup_junos_location vars: ansible_private_key_file: /home/admin/.ssh/newprivatekeyfile
Note: For netconf connection plugin configurable variables see netconf.
To use a jump host to connect to a NETCONF enabled device you must set the
ANSIBLE_NETCONF_SSH_CONFIG environment variable.
ANSIBLE_NETCONF_SSH_CONFIGcan be set to either:
The SSH config file should look something like:
Host * proxycommand ssh -o StrictHostKeyChecking=no -W %h:%p [email protected] StrictHostKeyChecking no
Authentication for the jump host must use key based authentication.
You can either specify the private key used in the SSH config file:
Or you can use an ssh-agent.
ansible_network_os is not specified for a host, then Ansible will attempt to automatically detect what
network_os plugin to use.
ansible_network_os auto-detection can also be triggered by using
auto as the
ansible_network_os. (Note: Previously
default was used instead of
Never store passwords in plain text. We recommend using SSH keys to authenticate SSH connections. Ansible supports ssh-agent to manage your SSH keys. If you must use passwords to authenticate SSH connections, we recommend encrypting them with Ansible Vault.