Question

A service provider is deploying model-driven telemetry from an IOS XR router to a collector. Security policy requires that both the router and the collector mutually authenticate each other using X.509 certificates before any telemetry data is streamed, and the router must initiate the connection to the collector. Which combination of gRPC/gNMI settings satisfies these requirements?

Accepted Answer

Configure a dial-out telemetry subscription over gRPC with TLS and mutual authentication (mTLS), installing a trustpoint on the router and requiring client certificate validation on the collector.

Answer

Configure a dial-in gNMI Subscribe session with TLS enabled, presenting only the server certificate on the router.

Answer

Configure a dial-out telemetry subscription over plain TCP and rely on an IPsec tunnel between the router and collector for authentication.

Answer

Configure a dial-in gRPC session with mTLS so the collector initiates the connection and both sides exchange certificates.