Network Devices

Modern routers, switches, and firewalls are often managed programmatically rather than by typing commands one at a time. Two standards dominate: NETCONF and RESTCONF. The Bridge can broker both, giving you policy control and full recording over how network gear is configured.

Each can be offered two ways, and you can use either or both:

Native mode - users point their normal NETCONF or RESTCONF tooling at a port on the Bridge.
Browser mode - the session runs inside the Bridge web interface, with nothing to install.

Granting access. Settings here enable NETCONF/RESTCONF for the deployment. To grant a person access to a device, create a checkout - see the credentials and command filtering fields.

NETCONF

NETCONF is a configuration protocol that runs over SSH. Tools connect, exchange structured XML, and apply configuration changes to the device. Port 830 is its conventional port.

bridge.yaml

netconf:
  idle_timeout: 30m
  max_auth_tries: 3
  native:
    enabled: true
    listen: "830"
  browser:
    enabled: true

Because NETCONF rides on SSH, you can limit how many authentication attempts are allowed before the connection is dropped, just as with SSH.

A native NETCONF checkout can also set ldap_auth_passthrough to log in to the device with the user’s own directory password - useful for devices that authenticate against a directory rather than a local account. It is offered after any private_key or target_password on the checkout, so an explicit credential always wins.

NETCONF option reference

Option	Type	Default	Description
`netconf.idle_timeout`	duration	`30m`	Close a session after this much inactivity.
`netconf.native.enabled`	bool	`false`	Turn on native NETCONF (a listening port).
`netconf.native.listen`	string (port)	`830`	Port the Bridge listens on. Required when native is enabled.
`netconf.max_auth_tries`	int	`3`	Maximum authentication attempts before disconnect. Raised to a floor of 50 whenever password authentication is available, exactly as native SSH does, and logged when it happens.
`netconf.browser.enabled`	bool	`false`	Turn on the in-browser NETCONF session.

RESTCONF

RESTCONF does the same job as NETCONF but over ordinary web requests (HTTPS). The Bridge acts as a reverse proxy in front of the device: requests come to the Bridge, the Bridge forwards them to the device, and the responses come back through the Bridge so they can be recorded. Port 8443 is its conventional port.

NETCONF never verifies the target device’s host key. NETCONF runs over SSH, but unlike native SSH it has no allow_insecure_host_key setting: the backend connection always accepts whatever key the device presents. Treat the network between Bridge and your devices as part of the trust boundary.

RESTCONF and the HTTP proxy both default to port 8443. Enabling both natively on one Bridge leaves the second one unable to bind, and the process stops. Move one of them: the config files bundled in the published image put RESTCONF on 8444 for this reason. If you enable both, set a port for at least one of them yourself.

bridge.yaml

restconf:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "8444"   # 8443 is the HTTP proxy's default port
  browser:
    enabled: true

Response-body redaction applies to RESTCONF. Because the Bridge can see the data coming back from the device, it can mask secrets in the recorded response bodies. This is governed by the recording setting server.recording.redact_response_bodies (on by default) and can be overridden per checkout.

Recording keeps the first 64 KB of each request body and each response body, and marks a shortened one ...(truncated). The session itself is unaffected: the device receives and returns everything, and only the recorded copy stops at the limit.

RESTCONF option reference

Option	Type	Default	Description
`restconf.idle_timeout`	duration	`30m`	Close a session after this much inactivity.
`restconf.native.enabled`	bool	`false`	Turn on native RESTCONF (a listening port).
`restconf.native.listen`	string (port)	`8443`	Port the Bridge listens on. Required when native is enabled.
`restconf.browser.enabled`	bool	`false`	Turn on the in-browser RESTCONF session.

Last updated on August 18, 2026

Kubernetes Exec RDP