Find, reserve, and connect to a Cisco DevNet Sandbox Reserve your first Cisco DevNet Sandbox in five steps. Find the IOS XR Always On Sandbox, reserve it with your Cisco.com account, open it in Stack Automation, and call its NETCONF or gNMI interface.

Getting Started

Reserve your first Sandbox and call its API. Allow about 15 minutes, plus the time your chosen Sandbox needs to provision.

You need a Cisco.com account. See Introduction for the account types DevNet Sandbox accepts. You can hold one active reservation at a time, across every Sandbox.

Step 1: Find a Sandbox

Open the Sandbox catalog. Narrow the list with the Categories and Cisco product filters, or search by name.

The Reserve a Sandbox guide shows the catalog.

Each card shows the access type (On demand or Always on), the Sandbox name and a short description, its category and Cisco product, and its availability. An on demand Sandbox with every slot in use shows At capacity. A Sandbox that is offline shows Maintenance. Both states disable the Reserve button.

For this walkthrough, search for IOS XR Always On and select it. It is always available, needs no VPN, and ships with NETCONF and gNMI already enabled, which Step 5 uses to make a real API call.

Click Details, then read the Instructions section before you reserve. It confirms the same protocols and lists the Sandbox's session length.

Want a different Cisco product instead? The rest of this walkthrough still applies: reserve it, connect if it needs a VPN, then use the protocol and credentials from that Sandbox's Instructions section in place of Step 5's example. See Labs and Sample Code for product-specific tutorials.

Step 2: Reserve it

Click Reserve, or Launch on an always on Sandbox, which skips the duration step. Sign in with your Cisco.com account when prompted. You return to the same flow afterward.

Pick a duration if the Sandbox offers one, then confirm. You land on the Reservations page, where the reservation provisions. Wait until Open sandbox becomes active.

For duration options, capacity limits, extending, and canceling, see Reserve a Sandbox.

Step 3: Get your access details

Click Open sandbox on the Reservations page. That takes you to the environment in Stack Automation, where you find:

  • Your credentials, on the Access Details section. If the Sandbox needs a VPN, its endpoint, username, and password are on the same tab.
  • The Sandbox's instructions, under the Instructions panel. This is where the device IP addresses and API endpoints are listed.

The same details arrive in the "[Active] Access your sandbox now" email.

Step 4: Connect, if the Sandbox needs a VPN

IOS XR Always On needs no VPN. It is reachable directly at sandbox-iosxr-1.cisco.com, which Step 5 uses. Skip to Step 5.

With a different Sandbox, check its Instructions section: on demand Sandboxes usually need a VPN, always on Sandboxes usually do not. When yours does, see Connecting to Your Sandbox for client options and setup.

Step 5: Make your first API call

IOS XR does not support RESTCONF. It ships with NETCONF (port 830) and gNMI (port 57777) enabled instead. Pick either one; both reach the same router. Replace <USERNAME> and <PASSWORD> with the credentials from the Access Details section.

Option A: NETCONF, with ncclient. Requires uv, which fetches ncclient and runs the script in one step:

uv run --with ncclient python -c "
from ncclient import manager
import socket

# ncclient does not support hostnames. Resolve to an IP first.
hostname = 'sandbox-iosxr-1.cisco.com'
ip = socket.gethostbyname(hostname)
print(f'Connecting to {hostname} ({ip})...')

with manager.connect(
    host=ip,
    port=830,
    username='<USERNAME>',
    password='<PASSWORD>',
    hostkey_verify=False,
    device_params={'name': 'iosxr'},
) as session:
    config = session.get_config(source='running')
    print(config)
"

Option B: gNMI, with gnmic. Requires gnmic, a command-line gNMI client:

gnmic \
  --address sandbox-iosxr-1.cisco.com:57777 \
  --username <USERNAME> \
  --password <PASSWORD> \
  --encoding JSON_IETF \
  --insecure \
  get --path "openconfig-interfaces:interfaces"

Either command returns the router's interface data as structured output. That is your confirmation that the reservation, the credentials, and the network path all work.

hostkey_verify=False and --insecure both skip certificate and host key checks that Sandbox devices would otherwise fail, since they use self-signed certificates.

If you reserved a different Sandbox in Step 1, use the protocol, host, and port from its Instructions section instead of the values above.

If something goes wrong

Next steps