🌐 IP Services & Protocol Ports

✅ MUST KNOW (Exam Critical):
SSH:      22   (Secure remote management)
Telnet:   23   (Insecure - avoid)
HTTP:     80   (APIs, web)
HTTPS:    443  (Secure APIs, RESTCONF)
NETCONF:  830  (Model-driven over SSH)
SNMP:     161/162 (Monitoring)
DNS:      53   (Name resolution)
DHCP:     67/68 (IP assignment)
NTP:      123  (Time sync)

🔧 Good to Know:
TFTP:     69   (IOS upgrades)
Syslog:   514  (Logging)
FTP:      20/21 (File transfer)
LDAP:     389  (Directory services)

💡 Memory Aid - "Security Trio"
22 = SSH (Secure Shell)
443 = HTTPS (Secure Web)
830 = NETCONF (Secure Config)

All use encryption! Remember: 22, 443, 830

# Python - REST API with Custom Ports
import requests
from requests.auth import HTTPBasicAuth

# HTTPS API (port 443 - standard)
response = requests.get(
    "https://192.168.1.1/restconf/data/ietf-interfaces:interfaces",
    auth=HTTPBasicAuth("admin", "password"),
    headers={"Accept": "application/yang-data+json"},
    verify=False
)
print(response.status_code)

# Custom port API (e.g., DNA Center on 443, Meraki on 443)
meraki_response = requests.get(
    "https://api.meraki.com/api/v1/organizations",
    headers={"X-Cisco-Meraki-API-Key": "your_api_key"}
)

# ACI APIC on port 9443
aci_response = requests.post(
    "https://apic-ip:9443/api/aaaLogin.json",
    json={"aaaUser": {"attributes": {"name": "admin", "pwd": "password"}}},
    verify=False
)

# Python - Socket Connection Examples
import socket

# Connect to SSH port (22)
def check_ssh(host):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(2)
    result = sock.connect_ex((host, 22))
    if result == 0:
        print(f"Port 22 (SSH) is OPEN on {host}")
    else:
        print(f"Port 22 (SSH) is CLOSED on {host}")
    sock.close()

# Port scanner for common services
def scan_common_ports(host):
    common_ports = {
        22: "SSH",
        23: "Telnet",
        80: "HTTP",
        443: "HTTPS",
        830: "NETCONF",
        161: "SNMP"
    }
    
    print(f"Scanning {host}...")
    for port, service in common_ports.items():
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(1)
        result = sock.connect_ex((host, port))
        if result == 0:
            print(f"  ✅ {service:10} (Port {port}) - OPEN")
        else:
            print(f"  ❌ {service:10} (Port {port}) - CLOSED")
        sock.close()

# Usage
scan_common_ports("192.168.1.1")

# Python - NETCONF over port 830
from ncclient import manager

# Connect to device via NETCONF (port 830)
with manager.connect(
    host="192.168.1.1",
    port=830,
    username="admin",
    password="password",
    hostkey_verify=False
) as m:
    # Get running configuration
    config = m.get_config(source="running")
    print(config)
    
    # Get operational data
    filter = '''
    
      
    
    '''
    result = m.get(filter=filter)
    print(result)

# Python - Explicit port specification
from urllib.parse import urlparse

# Construct URLs with custom ports
base_url_custom_port = "https://dna-center.example.com:8443/api/v1/network-device"
apic_url = "https://apic.example.com:9443/api/node/class/fvTenant.json"

# Parse URL to extract port
parsed = urlparse(base_url_custom_port)
print(f"Scheme: {parsed.scheme}")    # https
print(f"Host: {parsed.hostname}")    # dna-center.example.com
print(f"Port: {parsed.port}")        # 8443
print(f"Path: {parsed.path}")        # /api/v1/network-device

# Make request
response = requests.get(
    base_url_custom_port,
    auth=("admin", "password"),
    verify=False
)
print(f"Status: {response.status_code}")

PHASE 1: LOGIN AND GET TOKEN
Step 1: User enters username and password into Client App
Step 2: Client sends POST request to /api/v1/auth/login with credentials
Step 3: Auth API queries Database to verify username and password
Step 4: Database confirms user is valid
Step 5: Auth API returns 200 OK with JWT token (e.g., "abc123...")
Step 6: Client App stores the token locally (memory, localStorage, etc.)

PHASE 2: USE TOKEN FOR API CALLS
Step 7: User requests to see device list
Step 8: Client sends GET /api/v1/devices with "Authorization: Bearer abc123" header
Step 9: Device API validates the token is authentic and not expired
Step 10: Device API queries Database for device records
Step 11: Database returns list of devices
Step 12: Device API returns 200 OK with JSON array of devices
Step 13: Client App displays devices to User

KEY INSIGHTS:
✅ Password is only sent ONCE during login (Step 2)
✅ Token is used for ALL subsequent API calls (Step 8, etc.)
✅ Token can expire and requires re-authentication
✅ More secure than sending password with every request

Step 1-2: Script retrieves organization list using API key authentication
  → Response: Organization ID 123 named "Corp"

Step 3-6: Script creates new wireless network in organization 123
  → POST request with network name and type
  → Meraki provisions network in cloud
  → Response: Network ID "net-456" created (HTTP 201)

Step 7-12: Script configures WiFi SSID on the new network
  → PUT request to update SSID 0
  → Cloud controller receives config update
  → Config is pushed to physical Access Point
  → AP applies the configuration
  → Success confirmation flows back through cloud to API
  → Response: 200 OK

WORKFLOW PATTERN:
1. GET (retrieve org ID)
2. POST (create new resource)
3. PUT/PATCH (configure resource)

KEY INSIGHT:
• Cloud-managed: Changes go through API → Cloud → Device
• No direct device access needed
• Centralized management

AUTHENTICATION:
Step 1-4: Script authenticates to DNA Center
  → POST to /auth/token with credentials
  → DNAC validates user in database
  → Returns authentication token (xyz789)

DEVICE DISCOVERY:
Step 5-9: Script initiates device discovery
  → POST device IP address (10.1.1.1)
  → DNAC uses CDP/LLDP to discover device
  → Router responds with device information
  → DNAC stores device in inventory database
  → Returns task ID (202 Accepted - async operation)

TASK MONITORING:
Step 10-11: Script polls for task completion
  → GET /task/{taskId} to check status
  → Returns progress update

TEMPLATE DEPLOYMENT:
Step 12-15: Script deploys configuration template
  → POST with device ID and template ID
  → DNAC pushes config to router via NETCONF
  → Router applies configuration
  → Returns 200 OK (success)

PATTERN:
• Asynchronous operations (discovery returns task ID)
• Polling required for long-running tasks
• Uses NETCONF for device configuration

SUCCESSFUL CONFIGURATION (Steps 1-8):
Step 1-4: Script reads current interface configuration
  → GET interface Gi1 current state
  → Device OS retrieves config
  → Returns interface is disabled (enabled: false)

Step 5-8: Script updates interface configuration
  → PATCH to enable interface and add description
  → Device OS applies the changes
  → Returns 204 No Content (successful, no body needed)

ERROR SCENARIO (Steps 9-13):
Step 9-12: Script attempts to configure non-existent interface
  → PATCH interface Gi99 (which doesn't exist)
  → Device OS checks interface existence
  → Interface not found in configuration
  → Returns 404 Not Found with error message

Step 13: Script handles error gracefully
  → Logs the error for troubleshooting
  → Continues with next operation (doesn't crash)

KEY INSIGHTS:
✅ Always GET before PATCH to verify resource exists
✅ Handle HTTP error codes (404, 400, 500)
✅ Implement try/except in scripts
✅ Log errors for debugging