If the user configured the telemetry GRPC tunnel over the routing-instance as below, the service won't be enabled unless the internal TCP connection to port 40031 within the device is permitted in lo0.0 filter.

user@router-RE0> show configuration system services grpc-tunnel

servers {

  server remote_collector {

    address 10.1.1.1;

    port 40031;

    targets gnmi-gnoi;

    routing-instance VRF1;

    source-address 10.1.1.2;    ## the lo0.1 address in VRF1

    credentials {

      clear-text;

    }

  }

}

interfaces {

  lo0 {

    unit 0 {

      family inet {

        filter {

          input RE-FIREWALL;

        }

        address 1.2.3.4/32 {

          primary;

          preferred;

        }

        address 127.0.0.1/32;

      }

    }

    unit 1 {

      description "VRF1 Management lo0.1";

      family inet {

        filter {

          VRF1-FIREWALL;

        }

        address 10.1.1.2/32;

      }

    }

  }

}

The related GRPC tunnel traffic between 10.1.1.1 and 10.1.1.2 had been accepted in VRF1-FIREWALL under VRF1 lo0.1 interface, however, the service is not up.

Based on the firewall filter log in lo0.0 in the default instance, there is the internal TCP connection to port 40031 within the device using lo0.0 primary and prefer address (1.2.3.4) should be permitted:

user@router-RE0> show firewall log detail

Time of Log: 2023-11-22 10:19:24 AEDT, Filter: RE-FIREWALL, Filter action: discard, Name of interface: local

Name of protocol: TCP, Packet Length: 64, Source address: 1.2.3.4:64739, Destination address: 1.2.3.4:40031

Time of Log: 2023-11-22 10:19:11 AEDT, Filter: RE-FIREWALL, Filter action: discard, Name of interface: local

Name of protocol: TCP, Packet Length: 64, Source address: 1.2.3.4:64739, Destination address: 1.2.3.4:40031

Time of Log: 2023-11-22 10:19:05 AEDT, Filter: RE-FIREWALL, Filter action: discard, Name of interface: local

Name of protocol: TCP, Packet Length: 64, Source address: 1.2.3.4:64739, Destination address: 1.2.3.4:40031

Time of Log: 2023-11-22 10:19:02 AEDT, Filter: RE-FIREWALL, Filter action: discard, Name of interface: local

Name of protocol: TCP, Packet Length: 64, Source address: 1.2.3.4:64739, Destination address: 1.2.3.4:40031

Time of Log: 2023-11-22 10:18:59 AEDT, Filter: RE-FIREWALL, Filter action: discard, Name of interface: local

Name of protocol: TCP, Packet Length: 64, Source address: 1.2.3.4:64739, Destination address: 1.2.3.4:40031

Time of Log: 2023-11-22 10:18:56 AEDT, Filter: RE-FIREWALL, Filter action: discard, Name of interface: local

The following configuration MUST be added to make the service up:

user@router-RE0> show configuration firewall family inet filter RE-FIREWALL term telemetry    <<<<<<< RE-FIREWALL is the inet input filter on lo0.0

from {

  source-prefix-list {

    internal-telemerty-session;

  }

  protocol tcp;

  port 40031;

}

then accept;

user@router-RE0> show configuration policy-options prefix-list internal-telemerty-session        

1.2.3.4/32;

This is the grpctunnel pictorial representation:

https://github.com/openconfig/reference/blob/master/rpc/gnmi/img/grpctunnelclient_standalone.png