Skip to content
Britive Bridge
Protocols
Network Devices

Network Devices

Modern routers, switches, and firewalls are often managed programmatically rather than by typing commands one at a time. Two standards dominate: NETCONF and RESTCONF. The Bridge can broker both, giving you policy control and full recording over how network gear is configured.

Each can be offered two ways, and you can use either or both:

  • Native mode - users point their normal NETCONF or RESTCONF tooling at a port on the Bridge.
  • Browser mode - the session runs inside the Bridge web interface, with nothing to install.

Granting access. Settings here enable NETCONF/RESTCONF for the deployment. To grant a person access to a device, create a checkout - see the credentials and command filtering fields.

NETCONF

NETCONF is a configuration protocol that runs over SSH. Tools connect, exchange structured XML, and apply configuration changes to the device. Port 830 is its conventional port.

bridge.yaml
netconf:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "830"
    max_auth_tries: 3
  browser:
    enabled: true

Because NETCONF rides on SSH, you can limit how many authentication attempts are allowed before the connection is dropped, just as with SSH.

NETCONF option reference

OptionTypeDefaultDescription
netconf.idle_timeoutduration30mClose a session after this much inactivity.
netconf.native.enabledboolfalseTurn on native NETCONF (a listening port).
netconf.native.listenstring (port)830Port the Bridge listens on. Required when native is enabled.
netconf.native.max_auth_triesint3Maximum authentication attempts before disconnect.
netconf.browser.enabledboolfalseTurn on the in-browser NETCONF session.

RESTCONF

RESTCONF does the same job as NETCONF but over ordinary web requests (HTTPS). The Bridge acts as a reverse proxy in front of the device: requests come to the Bridge, the Bridge forwards them to the device, and the responses come back through the Bridge so they can be recorded. Port 8443 is its conventional port.

bridge.yaml
restconf:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "8443"
  browser:
    enabled: true

Response-body redaction applies to RESTCONF. Because the Bridge can see the data coming back from the device, it can mask secrets in the recorded response bodies. This is governed by the recording setting server.recording.redact_response_bodies (on by default) and can be overridden per checkout.

RESTCONF option reference

OptionTypeDefaultDescription
restconf.idle_timeoutduration30mClose a session after this much inactivity.
restconf.native.enabledboolfalseTurn on native RESTCONF (a listening port).
restconf.native.listenstring (port)8443Port the Bridge listens on. Required when native is enabled.
restconf.browser.enabledboolfalseTurn on the in-browser RESTCONF session.
Last updated on
Kubernetes ExecRDP