Dial-In with TLS

Configure XR1 to generate a self-signed cert and accept incoming dial-in MDT sessions on port 57400.

Transfer the self-signed cert to the NSO box in the ~/tig-stack-qos-interface-statistics directory. Do this by manually cating the file on the router, and pasting it into a file called ROUTER-CA.pem on the Ubuntu node.

Within the Ubuntu node, edit the telegraf_dial_in.conf file. Change the destination to ems.cisco.com.

Edit the docker-compose.yaml file. Set the CA cert line to point to ROUTER-CA.pem. Set the method to dial_in.

Edit the hosts file to include a line for ems.cisco.com resolving to the router’s Mgmt IP.

Stop and then launch the container

sudo docker compose down
sudo docker compose up -d

Answer/Explanation

When using dial-in, the roles are reversed. The router is now the server and the collector is the client. The router sends the collector its cert, so the collector must have the root CA installed to verify the cert.

First we must generate the self-signed cert on the router. This is done automatically when you enable gRPC server. The router generates a cert in the /misc/config/grpc directory.

grpc
 port 57400

Note that TLS is enabled by default because we did not specify no-tls.

The self-signed cert is now present:

The file we need is ems.pem. We can cat this file and copy and paste the contents to ROUTER-CA.pem on the Ubuntu server. Make sure you don’t copy any extra spaces.

Using openssl, we can view the details of the cert. Notice that the CN=ems.cisco.com and there are no alternative IPs. For this reason, we changed the connection in the telegraf_dial_in.conf file to use this name, and added the entry to the hosts file.

openssl x509 -noout -text -in ROUTER-CA.pem

We can also see that CA:TRUE is present on this cert:

When you stop and restart the docker container, Telegraf will load in this cert, and use it to connect to the router.

On the router, we see that a dialin session using gRPC-TLS is present:

The destination details show that TLS is used:

Everything else looks just like the no-TLS dial-in session we configured previously. The only difference is that TLS is used for encryption.

Note that the command show grpc trace ems can be used to view logs related to gRPC TLS.