Network Devices

Native only, for routers, switches, and firewalls. See the Network Devices reference, command filtering, and How users connect.

NETCONF

NETCONF authenticates with a key or password (default port 830).

Use bsh for Unix-backed NETCONF

For a NETCONF server that uses Unix accounts, configure the common bsh settings and the administrative SSH connection:

BSH_TRANSPORT=ssh
BSH_TARGET_HOST=netconf-linux.example.com
BSH_TARGET_PORT=830
BSH_TRANSPORT_PORT=22
BSH_TRANSPORT_USER=britivebroker
BSH_TRANSPORT_KEY_FILE=/run/secrets/ssh-admin-key
BSH_TRANSPORT_SUDO=true
BSH_TARGET_SSH_HOST_KEY=<verified-target-public-host-key>

#!/bin/sh
exec bsh checkout netconf --method ephemeral-password --mode bridge

#!/bin/sh
exec bsh checkin netconf --method ephemeral-password --mode bridge

bsh creates a Unix account and supplies its generated password to Bridge. Checkin locks the account by default. If SSH administration and NETCONF use different host keys, use a custom provisioning script with the correct key for each connection.

Use the API for vendor devices

bsh does not provision vendor-specific router or switch accounts. Provision the device credential with the vendor’s supported tooling, then register it with Bridge using the checkout API:

{
  "transaction_id": "txn-netconf-012",
  "protocol": "netconf",
  "native_auth": "bridge_credentials",
  "bridge_auth_password": "<separate-Bridge-password>",
  "username": "dana@corp",
  "target_host": "router1.corp.local",
  "target_ssh_host_key": "<verified-target-public-host-key>",
  "target_port": 830,
  "target_username": "netadmin",
  "private_key": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----",
  "record_session": true,
  "expires_at": 2000000000
}

Submit netconf.json to POST /api/transactions. The API returns 201 Created when it registers the checkout.

RESTCONF

bsh has no RESTCONF provisioning method. Use a custom provisioning script and submit the resulting credential through the checkout API.

RESTCONF authenticates with a target_password. Omit target_port and Bridge dials the device on 443. Set it when the device listens elsewhere, as this example does.

Do not confuse it with 8444, which is where Bridge’s own native RESTCONF listener binds. NETCONF has no such split: 830 is both the listener port and the backend default.

{
  "transaction_id": "txn-restconf-014",
  "protocol": "restconf",
  "native_auth": "bridge_credentials",
  "bridge_auth_password": "<separate-Bridge-password>",
  "username": "dana@corp",
  "target_host": "router2.corp.local",
  "target_port": 8443,
  "target_username": "netadmin",
  "target_password": "S3cr3t!",
  "record_session": true,
  "expires_at": 2000000000
}

Submit restconf.json to POST /api/transactions using checkout-management authentication. The API returns 201 Created when it registers the checkout.

Both support native access through the device’s tooling. Neither has a browser client.