Overview

Managing the firewall level on an ONT is a critical B2B network hardening task that directly impacts service availability and security posture. The three-tier model (Low, Medium, High) provides graduated filtering policies, but incorrect configuration can silently break VoIP, TR-069 management, or port-forwarding-dependent applications. This FAQ addresses the most common engineering questions around enabling, disabling, and troubleshooting ONT firewall levels in enterprise and carrier-grade deployments.

Frequently Asked Questions

Q1: How do I enable or disable the ONT firewall level (Low, Medium, High) via CLI?

The firewall level is typically enabled or disabled through the CPE system common profile using a CLI command such as modify <profile-id> firewall enabled or firewall disabled on platforms like Intelbras ONTs. For ZTE-based ONTs, the level can be adjusted via Telnet using sendcmd 1 DB set FWLevel 0 Level <0|1|2>, where 0 typically corresponds to off/low and higher values map to medium or high filtering. Nokia ONTs expose the setting through the web GUI under Security > Firewall with a dropdown for Low, Medium, or High .

Q2: What is the actual security difference between Low, Medium, and High firewall levels on an ONT?

Low level permits pre-routing features (port forwarding, DMZ) and a broad set of application services including DDNS, SSH, Telnet, TFTP, and VoIP, making it suitable for managed CPE deployments requiring remote access. Medium level blocks most inbound ICMP types while permitting only echo request/reply, destination unreachable, and TTL exceeded, and restricts DNS proxy from WAN to LAN. High level disables pre-routing and application services entirely, blocks regular UDP, and only permits management access via UDP port 8000 (with FTP using 8021 and Telnet using 8023), effectively locking down the WAN-facing attack surface .

Q3: Does enabling the High firewall level reduce ONT throughput or packet forwarding performance?

Enabling High firewall level does not reduce line-rate forwarding capacity on hardware-accelerated ONTs, but it does disable hardware offload for certain pre-routing flows (port forwarding, DMZ), which can introduce CPU-bound processing for those specific traffic paths. For B2B deployments prioritizing maximum Gbps throughput on forwarded LAN-to-WAN traffic, Low or Medium is recommended, as High level restricts UDP and application-layer inspection may consume additional CPU cycles .

Q4: Which firewall level should I use for third-party optical module compatibility and management access?

Medium is the recommended default for deployments using third-party SFP/SFP+ optical modules, as it permits essential management protocols (TR-069, SNMP, SSH) while blocking unsolicited inbound ICMP and DNS proxy from WAN. Low level should only be used when port forwarding or DMZ is explicitly required for hosted services. High level may block the TR-069 ACS connection if the ACS uses standard HTTP/HTTPS on non-8000 ports, causing remote management failures .

Q5: My ONT firewall is set to High but port forwarding stopped working. What is the root cause?

High firewall level explicitly disables pre-routing support, which includes port forwarding, DMZ, and host application rules. This is by design, not a fault condition. To restore port forwarding while maintaining reasonable security, downgrade to Medium or Low level via the CPE common profile or Telnet command. On ZTE platforms, use sendcmd 1 DB set FWLevel 0 Level 1 to set the level to Low and re-apply the configuration .

Q6: How do I verify the current firewall level on an ONT without the web GUI?

On Nokia ONTs, Telnet or SSH access (if permitted by the current level) allows verification through the CLI command show firewall status or equivalent platform-specific syntax. On ZTE ONTs, the Telnet command sendcmd 1 DB p FWLevel 0 displays the current Level value and associated parameters including AntiAttack, DoS, and SPI status. For Intelbras ONTs, the show command on the CPE system common profile reveals whether firewall is enabled or disabled .

Q7: What happens to VoIP and TR-069 services when the firewall level is changed?

Changing the firewall level triggers a partial reconfiguration on the ONT, which can cause temporary service interruption for VoIP and TR-069 management sessions. On Intelbras platforms, the CLI explicitly warns that modifying a common profile will trigger partial reconfiguration on each dependent ONT and may cause service interruptions. Best practice is to schedule firewall level changes during maintenance windows and verify SIP registration and ACS connectivity post-change .