{"id":237,"date":"2026-04-28T00:00:00","date_gmt":"2026-04-27T20:30:00","guid":{"rendered":"https:\/\/www.anynet.ir\/blog\/%d9%85%d8%b9%d8%b1%d9%81%db%8c-gnsi-%d8%a7%d8%ad%d8%b1%d8%a7%d8%b2-%d9%87%d9%88%db%8c%d8%aa-%d9%85%d8%ac%d9%88%d8%b2-%d9%88-%d8%ad%d8%b3%d8%a7%d8%a8%d8%b1%d8%b3%db%8c-aaa-%d9%85%d8%a8%d8%aa%d9%86-en\/"},"modified":"2026-10-19T16:16:55","modified_gmt":"2026-10-19T12:46:55","slug":"%d9%85%d8%b9%d8%b1%d9%81%db%8c-gnsi-%d8%a7%d8%ad%d8%b1%d8%a7%d8%b2-%d9%87%d9%88%db%8c%d8%aa-%d9%85%d8%ac%d9%88%d8%b2-%d9%88-%d8%ad%d8%b3%d8%a7%d8%a8%d8%b1%d8%b3%db%8c-aaa-%d9%85%d8%a8%d8%aa%d9%86-en","status":"publish","type":"post","link":"https:\/\/www.anynet.ir\/blog\/en\/%d9%85%d8%b9%d8%b1%d9%81%db%8c-gnsi-%d8%a7%d8%ad%d8%b1%d8%a7%d8%b2-%d9%87%d9%88%db%8c%d8%aa-%d9%85%d8%ac%d9%88%d8%b2-%d9%88-%d8%ad%d8%b3%d8%a7%d8%a8%d8%b1%d8%b3%db%8c-aaa-%d9%85%d8%a8%d8%aa%d9%86-en\/","title":{"rendered":"Introducing gNSI: gRPC-native AAA for Cisco IOS XR"},"content":{"rendered":"
<\/div>\n
\n
<\/div>\n<\/div>\n
\n
\n
\n

The Problem<\/h2>\n

For CLI, NETCONF, and SNMP, security is a solved problem. AAA (A<\/strong>uthentication, A<\/strong>uthorization, and A<\/strong>ccounting) with TACACS+ and Syslog takes care of all three pillars. But when the Management Plane moved to gRPC and gNMI, that same security story did not come along for the ride.<\/p>\n

TLS handles Authentication, but nobody standardized how to actually “manage” the Certificates \u2014 issuing them, renewing them, revoking them, rotating Trust Bundles and CRLs. Most operators end up copying PEM files around or using vendor-specific tools.<\/p>\n

Authorization got worse, not better. gRPC needs Service-level control (“can this client call gNMI Set?”) while gNMI needs Path-level control (“can this client write to \/system\/<\/code>?”). A single broad role does not cover either case well.<\/p>\n

Accounting \u2014 the “A” that tells what actually happened \u2014 works fine for CLI and NETCONF sessions but does not automatically cover gRPC traffic.<\/p>\n

And then there is Credential Rotation. gRPC TLS Certificates and SSH<\/strong> Host Keys live on completely different tracks. One can go stale without anyone noticing the other is fine.<\/p>\n

Put it all together: inconsistent Security Posture and automation that breaks in ways that are hard to debug.<\/p>\n

What is gNSI<\/h2>\n

gNSI<\/strong> stands for gRPC Network Security Interface<\/strong>. It is a set of gRPC Services defined by OpenConfig \u2014 the same community behind gNMI, gNOI, and gRIBI. Where those focus on config, operations, and routing, gNSI focuses on Security<\/strong>:<\/p>\n

The five services map directly to the AAA model \u2014 Authentication, Authorization, and Accounting \u2014 in that order:<\/p>\n