> For the complete documentation index, see [llms.txt](https://ccie-sp.gitbook.io/ccie-spv5.1-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ccie-sp.gitbook.io/ccie-spv5.1-labs/labs/mdt/dial-in-with-tls.md).
# Dial-In with TLS
Configure XR1 to generate a self-signed cert and accept incoming dial-in MDT sessions on port 57400.
Transfer the self-signed cert to the NSO box in the \~/tig-stack-qos-interface-statistics directory. Do this by manually **cat**ing the file on the router, and pasting it into a file called **ROUTER-CA.pem** on the Ubuntu node.
Within the Ubuntu node, edit the **telegraf\_dial\_in.conf** file. Change the destination to **ems.cisco.com.**
Edit the **docker-compose.yaml** file. Set the CA cert line to point to ROUTER-CA.pem. Set the method to dial\_in.
Edit the hosts file to include a line for **ems.cisco.com** resolving to the router’s Mgmt IP.
Stop and then launch the container
```
sudo docker compose down
sudo docker compose up -d
```
## Answer/Explanation
When using dial-in, the roles are reversed. The router is now the server and the collector is the client. The router sends the collector its cert, so the collector must have the root CA installed to verify the cert.
First we must generate the self-signed cert on the router. This is done automatically when you enable gRPC server. The router generates a cert in the /misc/config/grpc directory.
```
grpc
port 57400
```
Note that TLS is enabled by default because we did not specify **no-tls**.
The self-signed cert is now present:
The file we need is **ems.pem**. We can **cat** this file and copy and paste the contents to **ROUTER-CA.pem** on the Ubuntu server. Make sure you don’t copy any extra spaces.
Using **openssl**, we can view the details of the cert. Notice that the CN=ems.cisco.com and there are no alternative IPs. For this reason, we changed the connection in the telegraf\_dial\_in.conf file to use this name, and added the entry to the hosts file.
```
openssl x509 -noout -text -in ROUTER-CA.pem
```
We can also see that CA:TRUE is present on this cert:
When you stop and restart the docker container, Telegraf will load in this cert, and use it to connect to the router.
On the router, we see that a dialin session using gRPC-TLS is present:
The destination details show that TLS is used:
Everything else looks just like the no-TLS dial-in session we configured previously. The only difference is that TLS is used for encryption.
Note that the command **show grpc trace ems** can be used to view logs related to gRPC TLS.
