A YANG Data Model for Layer 2 Network Topologies
Extracted elements (21)
Optional Layer 2 technology-specific attributes (VLAN, QinQ, VXLAN) are gated behind YANG features rather than always present, reflecting that these attributes may be useful to expose to services/applications but are not universally applicable. This avoids bloating the base model.
The model is intentionally generic and applicable to L2 networks built with different technologies (Ethernet, VLAN, QinQ, PBB, TRILL, VPLS, VXLAN). Technology-specific advanced attributes are out of scope; dedicated YANG modules (e.g., TRILL-YANG) are recommended for deeper technology-specific configuration.
For non-NMDA-compliant implementations, a companion module 'ietf-l2-topology-state' mirrors 'ietf-l2-topology' but augments 'ietf-network-state' and 'ietf-network-topology-state' with read-only (config false) data nodes. Implementations supporting NMDA SHOULD NOT support this companion module.
The 'interface-name' leaf in l2-termination-point-attributes is explicitly noted as not usable as an interface-ref (RFC 8343 type), because interface-ref references interfaces within a single node's datastore, not across a network topology. The field is a plain string that may correspond to an interface name but is not a formal cross-node reference.
The companion module 'ietf-l2-topology-state' SHOULD NOT be supported by implementations that support NMDA (RFC 8342), as NMDA-capable implementations already expose operational state through the standard datastore architecture.
Readable data nodes such as MAC addresses and VLAN/VXLAN identifiers are sensitive. Unrestricted read access (via get, get-config, or notifications) can lead to privacy violations: MAC addresses enable monitoring of device movements and can be used to derive physical location information, bypassing OS-level location protections. Read access MUST be controlled via NACM.
Six Ethernet encapsulation type identities are defined, all derived from 'eth-encapsulation-type' (which itself bases on 'iana-interface-type'): ethernet, vlan, qinq, pbb (IEEE 802.1ah), trill, vpls, and vxlan (RFC 7348 MAC-in-UDP).
The 'ietf-l2-topology' YANG module augments the generic 'ietf-network' and 'ietf-network-topology' modules (RFC 8345) with L2-specific attributes for networks, nodes, links, and termination points. A new network type 'l2-topology' is introduced as a presence container under 'network-types' to identify L2 topology instances.
The 'l2-link-attributes' grouping provides link-level L2 data: name, flags, rate (uint64, Kbps), delay (uint32, microseconds, unidirectional), auto-nego (boolean, default true), and duplex (full-duplex or half-duplex enumeration).
The 'l2-network-event-type' enumeration defines three event values: addition (0), removal (1), and update (2), used in all L2 topology notification events.
The 'l2-node-attributes' grouping provides node-level L2 data including name, flags, bridge-id (hexadecimal 8-octet string with 4-bit priority, 12-bit MSTI-ID, and base bridge ID), management-address (IP), management-mac (MAC address), and management-vlan (string).
The 'l2-termination-point-attributes' grouping provides per-termination-point L2 attributes including interface-name, mac-address, port-number list, unnumbered-id list, encapsulation-type (identityref), outer/inner VLAN tags and TPIDs (feature-guarded), lag (boolean, default false), member-link-tp list (only when lag=true), and a VXLAN sub-container with vni-id.
The 'l2-topology-attributes' grouping adds a topology name (string) and a set of flags (leaf-list of l2-flag-type identityrefs) to the network level. These augment the 'network' list of 'ietf-network' when the l2-topology network type is present.
The 'member-link-tp' leaf-list under l2-termination-point-attributes is conditioned on 'lag = true' and holds leafrefs to termination-point tp-id values, enabling representation of Link Aggregation Group (LAG) bundles.
The 'vni' typedef defines the VXLAN Network Identifier as a uint32 in range 0..16777215, allowing up to 16M VXLAN segments within the same administrative domain. Use of value 0 is implementation-specific.
The 'vxlan' container under l2-termination-point-attributes is conditionally present only when the encapsulation-type is derived from 'l2t:vxlan' and requires the VXLAN feature. It contains a single vni-id leaf of type vni.
Three YANG notification types are defined: 'l2-node-event', 'l2-link-event', and 'l2-termination-point-event'. Each carries an event-type (addition=0, removal=1, update=2), a reference to the affected element, the l2-topology network type indicator, and the corresponding L2 attributes.
Two URIs are registered in the IETF XML Registry 'ns' subregistry (RFC 3688): 'urn:ietf:params:xml:ns:yang:ietf-l2-topology' and 'urn:ietf:params:xml:ns:yang:ietf-l2-topology-state'. Two YANG module names are registered in the 'YANG Module Names' subregistry: 'ietf-l2-topology' (prefix l2t) and 'ietf-l2-topology-state' (prefix l2t-s), both referencing RFC 8944.
NETCONF access to this module MUST use SSH (RFC 6242) as mandatory-to-implement secure transport; RESTCONF MUST use TLS 1.3 (RFC 8446). The Network Configuration Access Control Model (NACM, RFC 8341) MUST be vigorously applied to prevent unauthorized clients from adding, removing, or modifying topology elements, which could disrupt services in configured (intended) topologies.
Writable data nodes (l2-network-attributes, l2-node-attributes, l2-link-attributes, l2-termination-point-attributes) are sensitive: a malicious client could sabotage name, management-address, rate, delay, or termination-point attributes to disrupt network operations. For learned topologies the server prohibits misconfiguration; for configured topologies unauthorized writes can take effect in the operational datastore.
The bridge-id field is encoded as a hexadecimal 8-octet string matching the pattern '[0-9a-fA-F]{2}(:[0-9a-fA-F]{2}){7}'. It contains 4 bits of priority, 12 bits of MSTI-ID, and the base bridge identifier, and may appear multiple times (one per spanning tree instance).