A data center engineer is deploying streaming telemetry on Cisco Nexus 9000 switches to feed a centralized collector. The security team requires that the switches never listen for inbound connection requests on any telemetry port, and the collector must reside behind a firewall that only permits outbound-initiated sessions from the switches. The engineer must also ensure the transport survives collector restarts by having the switch re-establish the session automatically. Which telemetry configuration approach meets these requirements?