! ============================================================================
! 00-netconf.cfg  --  IOS-XR NETCONF/SSH enablement (prerequisite)
! ============================================================================
! The stack's automation (rib-poller, RR diff pipeline, any
! ncclient-based configurator) connects to routers on TCP/830 using the
! IOS-XR NETCONF device dialect. If NETCONF is not enabled, none of that
! works and the BMP ingest path is the only thing that can succeed.
!
! Apply once per router before any of the other fragments. Substitute
! <NETCONF_USER> and its password with values that match your stack's
! .env (IOSXR_NETCONF_USER / IOSXR_NETCONF_PASS).
! ============================================================================

! --- SSH server (NETCONF-over-SSH transport) --------------------------------
ssh server v2
ssh server netconf vrf default
!

! --- NETCONF-YANG agent -----------------------------------------------------
netconf-yang agent
 ssh
!

! --- Local user for NETCONF (skip if you use AAA/TACACS+) -------------------
username <NETCONF_USER>
 group root-lr
 group cisco-support
 secret <PLAINTEXT_OR_HASHED_PASSWORD>
!

! --- Verify -----------------------------------------------------------------
!   show netconf-yang statistics
!   show ssh
!   show run formal ssh
!
! From the stack host, quick sanity check:
!   ssh -p 830 <NETCONF_USER>@<ROUTER_MGMT_IP> -s netconf
! (should return an <hello> capability exchange, not a shell prompt)