Overview

Configuring the TR-069 ACS URL on a customer-side ONT is the foundational step for enabling zero-touch provisioning and remote management in carrier-grade broadband deployments. This FAQ addresses the high-intent technical queries engineers and network architects raise during both pre-sales evaluation and post-sales integration, covering CLI syntax, DHCP option dependencies, and certificate-based authentication failures.

Frequently Asked Questions

Q1: What are the exact CLI parameters required to configure the TR-069 ACS URL on a customer-side ONT?

The essential CLI parameters are the ACS URL (e.g., http://acs.provider.com:7547), ACS username, ACS password, and the connection request credentials (CPE username/password). On Huawei and similar platforms, these are typically configured within the CWMP view or via an ONT management profile. For bulk deployments, the ACS URL is often delivered automatically through DHCP Option 43, containing sub-options for URL, username, and password . Manual CLI configuration requires entering the CWMP view and executing cwmp acs url <url> followed by the authentication parameters .

Q2: Why is DHCP Option 43 critical for ACS URL delivery, and how is it formatted?

DHCP Option 43 is the standard mechanism for zero-touch ACS URL provisioning to ONTs. It uses vendor-encapsulated sub-options: sub-option 01 for the ACS URL (ASCII to HEX), 02 for provisioning code, 03 for ACS username, and 04 for the ACS password . The ONT must include the string "dslforum.org" in DHCP Option 60 during the request for the DHCP server to recognize the device as TR-069 capable and return Option 43 in the DHCP ACK . Without this option, each ONT requires manual ACS URL entry, making large-scale deployment impractical.

Q3: What WAN interface prerequisites must be met before the ACS URL can function?

A dedicated WAN interface with the service list explicitly containing "TR069" must be created before ACS connectivity is possible. The ONT uses this interface to source the management traffic toward the ACS server, and the interface must have a valid IP address (via DHCP, PPPoE, or static configuration) . If the WAN interface is missing the TR069 service binding or lacks an IP address, the ONT will fail to initiate the Inform message regardless of correct ACS URL configuration.

Q4: How do I troubleshoot an ONT that has the correct ACS URL but fails to register?

First verify Layer 3 reachability by pinging the ACS server from the ONT management interface, then confirm that TCP port 7547 (the default CWMP port) is open bidirectionally . If connectivity exists, check the ONT clock: certificate validation will fail if the system time deviates beyond the TLS certificate validity window. Finally, capture packets on the ACS side to confirm the Inform message arrives; if no packets appear, the issue is upstream routing or DHCP Option 43 misconfiguration .

Q5: What causes "Invalid Certificate" errors during the TR-069 handshake, and how are they resolved?

Certificate errors occur when the ONT does not trust the ACS server's TLS certificate chain, typically because the root or intermediate CA is missing from the ONT trust store. Resolve this by importing the correct CA certificate into the ONT's certificate store or, for internal deployments, ensuring the self-signed certificate is added to the trusted list . Additionally, if mutual authentication is enabled, the ACS must be configured to accept the client certificate presented by the ONT.

Q6: How does the ACS URL configuration differ between HTTP and HTTPS schemes?

When using HTTPS, the ONT must establish an SSL/TLS connection before any CWMP SOAP messages are exchanged, requiring certificate authentication to be explicitly enabled and the private key password configured . HTTP configuration requires no certificate setup but exposes management traffic to interception. For production carrier networks, HTTPS with certificate validation is mandatory; the CLI syntax differs only by the URL prefix (https:// versus http://) and the additional certificate parameters.

Q7: What is the relationship between the ACS URL and Connection Request credentials?

The ACS URL tells the ONT where to send Inform messages; the Connection Request username and password authenticate the ACS when it initiates a reverse connection to the ONT. These are separate from the ACS username/password used for the ONT to authenticate to the ACS . A common misconfiguration is setting both credential pairs identically or omitting the Connection Request credentials entirely, which prevents the ACS from pushing configuration changes until the next periodic Inform interval.

Q8: What is the recommended Periodic Inform interval for production deployments?

The default Periodic Inform interval is typically 1800 seconds (30 minutes), but production carriers often reduce this to 300–600 seconds for responsive fault detection and configuration propagation . However, the interval must be coordinated with ACS server timeout settings: if the ONT Inform interval exceeds the ACS session timeout, stale sessions accumulate and ACS performance degrades. For high-density deployments exceeding 10,000 ONTs, a staggered Inform schedule (using the Period Inform Time parameter) prevents thundering-herd congestion on the ACS .