Chapter 19: Model-Driven Telemetry and Webhook Monitoring

1.1 Telemetry vs. SNMP: A Paradigm Shift

SNMP's request-response model creates three deep structural problems that MDT solves by reversing the data flow entirely — devices push data to collectors rather than waiting to be polled.

1.2 The Five Components of an MDT Subscription

1.3 Encoding Options

KV-GPB is the only encoding permitted with gRPC transport. This is a hard constraint on IOS XE — not a recommendation.

2.1 Dial-In vs. Dial-Out

2.2 CLI Dial-Out Configuration

The CLI writes the subscription to running-config. IOS XE 16.10+ and netconf-yang must be enabled (the DMI subsystem requires it).

! Periodic memory stats, gRPC every 60 seconds
telemetry ietf subscription 101
 encoding encode-kvgpb
 filter xpath /memory-ios-xe-oper:memory-statistics/memory-statistic
 stream yang-push
 update-policy periodic 6000
 source-vrf Mgmt-intf
 receiver ip address 10.28.35.45 57555 protocol grpc-tcp

! On-change: only fires when interface oper-status changes
telemetry ietf subscription 102
 encoding encode-kvgpb
 filter xpath /if:interfaces/interface/oper-status
 stream yang-push
 update-policy on-change
 receiver ip address 10.28.35.45 57555 protocol grpc-tcp

2.3 NETCONF RPC Configuration

<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="1">
  <edit-config>
    <target><running/></target>
    <config>
      <mdt-config-data xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-cfg">
        <mdt-subscription>
          <subscription-id>201</subscription-id>
          <base>
            <stream>yang-push</stream>
            <encoding>encode-kvgpb</encoding>
            <period>3000</period>  <!-- 30 seconds -->
            <xpath>/if:interfaces-state/interface/statistics</xpath>
          </base>
          <mdt-receivers>
            <address>192.168.1.100</address>
            <port>57000</port>
            <protocol>grpc-tcp</protocol>
          </mdt-receivers>
        </mdt-subscription>
      </mdt-config-data>
    </config>
  </edit-config>
</rpc>

2.4 Common XPath Reference

2.5 Verification

show telemetry ietf subscription all
show telemetry ietf subscription 101 detail
show telemetry ietf subscription 101 receiver   ! Look for State = Connected
show telemetry internal connection
debug telemetry all                              ! Caution in production

3.1 The TIG Stack

Telegraf, InfluxDB, and Grafana form the industry-standard open-source pipeline for MDT collection, storage, and visualization.

3.2 Component Roles

3.3 Telegraf Configuration Snippet

[[inputs.cisco_telemetry_mdt]]
  transport       = "grpc"
  service_address = ":57000"
  # For TLS: tls_cert / tls_key paths here

[[outputs.influxdb]]
  urls     = ["http://influxdb:8086"]
  database = "mdt_db"
  username = "admin"
  password = "admin"

Telegraf auto-names InfluxDB measurements from the YANG XPath. Interface statistics from /if:interfaces/interface/statistics become the measurement Cisco-IOS-XE-interfaces-oper:interfaces/interface/statistics. YANG leaf names (in-octets, out-octets) become fields; device hostname becomes a tag.

4.1 What Is a Webhook?

Webhooks are HTTP POST callbacks. A platform sends a structured JSON body to your registered URL the instant a network event occurs — no polling, no wasted API quota, no latency.

4.2 Platform Comparison

4.3 Catalyst Center Webhook Event Flow

4.4 Meraki Signature Validation

Always validate the X-Cisco-Meraki-Signature header before acting on a Meraki webhook payload:

import hmac, hashlib

def validate_meraki_webhook(secret: str, body: bytes, signature: str) -> bool:
    computed = hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(computed, signature)

4.5 Unified Webhook Receiver Routing Logic

4.6 MDT vs. Webhooks — Choosing the Right Tool