Automation and Assurance · Topic 4 of 7

gRPC and gNMI Telemetry with TLS and mTLS

Configure model driven telemetry with gRPC and gNMI, compare dial-in and dial-out, and secure the session with plain TCP, TLS and mutual TLS certificates.

6 min
Includes a diagram

In a nutshell

gRPC uses HTTP/2 and protocol buffers. gNMI is built on gRPC.
gNMI has Capabilities, Get, Set and Subscribe.
Subscription modes are stream, once and poll.

What it is

gRPC and gNMI let a device stream its operational data to a collector, and let a client read or change its configuration.

gRPC is a remote call framework that runs over HTTP/2 and uses protocol buffers. gNMI is a set of operations defined on top of gRPC for network devices. Together they replace slow polling with fast, structured streaming.

How it works

First the protocol, then the two connection directions, then the security choices.

gNMI operations

gNMI defines four main operations.

Operation	Purpose
Capabilities	Ask the device which models and encodings it supports
Get	Read configuration or state once
Set	Change configuration, with update, replace or delete
Subscribe	Ask for a stream of data

A subscription has a mode. In stream mode the device keeps sending, either at a sample interval, or only when a value changes (on change).

In once mode it sends one answer. In poll mode the client asks each time it wants data.

The data is identified by paths in the YANG model, and the device returns the values in an encoding such as JSON or protocol buffers.

Dial-in and dial-out

The two directions differ in who opens the connection.

Mode	Who connects	Device role	Typical use
Dial-in	The collector connects to the device	gRPC server	gNMI Subscribe, Get and Set
Dial-out	The device connects to the collector	gRPC client	Configured, device pushed telemetry

Dial-in needs the collector to reach the device, and the device must run a gRPC server. Dial-out works well when a firewall or NAT blocks inbound connections, because the device makes the outgoing connection.

Dial-in on IOS XR

In dial-in, the collector opens the connection to R1, which acts as the gRPC server on port 57400 with mutual TLS, and uses gNMI Subscribe, Get and Set. The device is enabled as a gRPC server.

RP/0/RP0/CPU0:R1(config)# grpc
RP/0/RP0/CPU0:R1(config-grpc)# port 57400
RP/0/RP0/CPU0:R1(config-grpc)# tls-mutual
RP/0/RP0/CPU0:R1(config-grpc)# commit
RP/0/RP0/CPU0:R1# show grpc status

The tls-mutual line makes the server require client certificates, so certificates must be in place first. IOS XE has its own gNMI settings, entered with the gnxi command family. Check the release for exact options.

Dial-out on IOS XR

In dial-out, R1 acts as the gRPC client, opens the connection to the collector at 192.0.2.50 port 57500, and pushes subscription SUB1 every 30 seconds. The device is told where to send the data, what to send, and how often. Three objects do this: a destination group, a sensor group and a subscription.

RP/0/RP0/CPU0:R1(config)# telemetry model-driven
RP/0/RP0/CPU0:R1(config-model-driven)# destination-group DG1
RP/0/RP0/CPU0:R1(config-model-driven-dest)# address-family ipv4 192.0.2.50 port 57500
RP/0/RP0/CPU0:R1(config-model-driven-dest-addr)# encoding self-describing-gpb
RP/0/RP0/CPU0:R1(config-model-driven-dest-addr)# protocol grpc no-tls
RP/0/RP0/CPU0:R1(config-model-driven-dest-addr)# exit
RP/0/RP0/CPU0:R1(config-model-driven-dest)# exit
RP/0/RP0/CPU0:R1(config-model-driven)# sensor-group SG1
RP/0/RP0/CPU0:R1(config-model-driven-snsr-grp)# sensor-path Cisco-IOS-XR-infra-statsd-oper:infra-statistics/interfaces/interface/latest/generic-counters
RP/0/RP0/CPU0:R1(config-model-driven-snsr-grp)# exit
RP/0/RP0/CPU0:R1(config-model-driven)# subscription SUB1
RP/0/RP0/CPU0:R1(config-model-driven-subs)# sensor-group-id SG1 sample-interval 30000
RP/0/RP0/CPU0:R1(config-model-driven-subs)# destination-id DG1
RP/0/RP0/CPU0:R1(config-model-driven-subs)# commit

The no-tls option sends the data in clear text and is for a lab only.

The sample interval is in milliseconds, so 30000 is every 30 seconds. The sensor path must exist in the model, or no data is returned. Check the result with show telemetry model-driven subscription and show telemetry model-driven destination.

TCP, TLS and mTLS

The transport can be protected in three ways.

Option	What is protected	Certificates
Plain TCP or gRPC with no TLS	Nothing, data is in clear text	None
TLS	The channel is encrypted, and the client checks the server	Server certificate
Mutual TLS (mTLS)	The channel is encrypted, and both sides check each other	Server and client certificates

Plain TCP is for a lab. TLS encrypts the traffic, and the client verifies the server certificate against a trusted certificate authority. The device usually still checks a user name and password.

With mTLS, the client also sends a certificate, which the device checks against a trusted CA. A client without a valid certificate is refused. This gives strong identity on both ends.

Certificates must be valid and not expired, they must be signed by a CA that the other side trusts, and the name in the server certificate must match the name that the client uses.

What to remember for the exam

Seven facts cover most questions on this topic.

gRPC uses HTTP/2 and protocol buffers. gNMI is built on gRPC.
gNMI has Capabilities, Get, Set and Subscribe.
Subscription modes are stream, once and poll.
In dial-in the collector connects, and in dial-out the device connects.
Dial-out suits networks where inbound connections are blocked.
TLS gives encryption and server verification, and mTLS adds client verification.
IOS XR dial-out uses a destination group, a sensor group and a subscription.

Exam tip

If the question says the device initiates the session, it is dial-out. If the collector initiates it, it is dial-in.

Common mistakes

These four mistakes appear often.

Confusing dial-in and dial-out. The direction is defined by who opens the connection.

Leaving a sensor path wrong. A path that does not exist in the model returns no data.

Using plain TCP outside a lab. Data and sometimes credentials cross the network in clear text.

Using an expired or untrusted certificate. The TLS handshake fails, and no telemetry flows.

Watch out

A very short sample interval on many paths can load the device. Start with a longer interval and reduce it only when needed.

Check yourself

Work through these three questions.

Who opens the connection in dial-out telemetry?
The device connects to the collector, so it acts as the gRPC client.
What does mTLS add compared with TLS?
The client also presents a certificate, so both sides are verified.
What three objects configure IOS XR dial-out telemetry?
A destination group, a sensor group and a subscription.

Topic 4 of 7 in Automation and Assurance

Test yourself on Automation and Assurance

The full Cisco CCNP 350-501 SPCOR question bank has 738 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.