Network Device Programmability
Domain 3, Network Device Programmability, covers what the box itself can do: on-box Python in the IOS XE guestshell, EEM policies, model-driven interfaces, telemetry, and zero-touch onboarding. Questions usually ask which tool fits a constraint such as no external server, no interactive SSH, or no CLI scraping.
On-box automation with the guestshell
The guestshell is a Linux container on the router, enabled with guestshell enable and entered with guestshell run bash or guestshell run python3. Python inside it reaches the CLI through the cli module (from cli import cli, configure), so scripts can read show output where no YANG model exists. Its footprint is modest, roughly one vCPU and a gigabyte of RAM, and packages added to it are not guaranteed to survive a reload unless you provision them from configuration or a script.
EEM
EEM reacts to events without polling: event manager applet NAME, then an event clause (syslog pattern, timer, interface state, SNMP, track), then ordered action clauses such as cli command, syslog msg and reload. Applets live in running configuration, so they must be saved to remain after a reboot.
Model-driven interfaces
netconf-yang enables NETCONF over SSH; restconf needs the secure HTTP server (ip http secure-server) and is reached at /restconf. Verify with show netconf-yang sessions and show restconf. Paths come from YANG models, Cisco native (Cisco-IOS-XE-native), IETF or OpenConfig, and mixing namespaces in one request is a reliable way to get a 400.
Telemetry and onboarding
Model-driven telemetry pushes data to a collector instead of being polled. Dial-out has the device open the gRPC session; dial-in has the collector connect and create subscriptions. Firewalls usually decide this for you, because dial-out needs no inbound rule toward the router. Zero-touch onboarding, such as Plug and Play, uses DHCP options and a bootstrap call to the controller so day-0 and day-1 configuration arrives without an engineer on site.
Worked example
A collector sits behind a firewall that blocks inbound connections to 400 branch routers, and you need interface counters every 30 seconds. Choose dial-out with a sample-interval subscription. Reasoning: dial-in would require the collector to reach each router, which the firewall forbids; dial-out has each router open an outbound TLS session, and the subscription is written once in a template applied to all 400 devices. The trade-off is certificate trust, since each router's identity must be accepted by the collector.
Traps
- Assuming NETCONF or RESTCONF is enabled by default.
- Expecting guestshell packages and files to survive a reload unprovisioned.
- Writing an EEM applet without saving it to startup configuration.
- Confusing dial-in with dial-out when writing the firewall rule.