Question

A network engineer is configuring gNMI dial-out (target-initiated) telemetry on an IOS-XR router toward a collector that is reachable only across a fully trusted, isolated out-of-band management network. Management insists on the simplest possible transport configuration for a lab validation, so the engineer configures the gRPC session without any certificate trustpoint or TLS parameters. After committing, the router attempts to establish the session but the collector, which is listening for plaintext gRPC on port 57400, never receives a connection. What is the most likely reason the session fails to come up?

Accepted Answer

By default gRPC on IOS-XR enables TLS, so without explicitly disabling TLS (no-tls) the router presents a TLS handshake that the plaintext collector rejects

Answer

gNMI dial-out is only supported over UDP, so a TCP-listening collector on port 57400 can never accept the connection

Answer

gRPC requires mTLS in all deployments, so the missing client certificate causes the router to abort before sending any packets

Answer

The collector must initiate the connection in dial-out mode, so the router will never attempt to connect regardless of transport settings