When we are adopting the firewall devices in Security Director Cloud, Juniper recommends to provision devices with the below configuration.

set system services netconf rfc-compliant

The netconf rfc-compliant parameter prevents the use of the junipernetworks.junos.junos_config ansible module for junos systems.

In order to be able to continue to use Ansible and make configuration changes on our Juniper devices, can we update our firewall fleet to use only "system services netconf yang-compliant" and get rid of "netconf rfc-compliant" ?

N/A

To manage a device via SDC, it provides a set of commands which contains the "set system services netconf rfc-compliant" configuration. These commands need to be added to the existing device configuration for the device to be successfully discovered by SDC.

Once the device is up and running, SDC doesnt check if the rfc-compliant parameter exists in the configuration. You can also remove the rfc-compliant parameter and add the yang-compliant parameter to the configuration so that the device can be used with the ansible module.

The device will continue to be managed via SDC without any problems until the connection between SDC and the device goes down. Once the device connection is down, then SDC will once again check if the device configuration contains the rfc-compliant feature and it will continue to show the device as down until this parameter is present in the configuration.

The workaround that you can follow is as below.

• Onboard the device onto SDC using rfc-compliant
• Once the device is onboarded, remove rfc-compliant and add yang-compliant.
• Perform the changes using the Ansible junos model.
• In case, the device goes down due to some reason, then add rfc-compliant back to the configuration so that the device comes up.
• Once the device is up, then you can remove the rfc-compliant parameter from the configuration.