Overview

This FAQ answers the most common technical support questions about enabling and managing the SPI (Stateful Packet Inspection) firewall on a home ONT, including CLI configuration, throughput impact, ACL hardening, and basic troubleshooting for residential and small-business deployments.

Frequently Asked Questions

Q1: How do I enable the SPI firewall on my home ONT?

To enable the SPI firewall, log in to the ONT CLI via console or SSH and run the firewall enable command at the global configuration level, then commit the configuration. For example: configure terminal → firewall enable → write memory. After enabling, verify the state with show firewall status to confirm the stateful inspection engine is active on the WAN interface.

Q2: Does enabling SPI firewall reduce maximum throughput on the ONT?

Yes, enabling SPI inspection can reduce maximum forwarding throughput because each new session is tracked in the state table, but the impact is typically modest on modern ONTs. Throughput generally remains near line rate (e.g., 1 Gbps to 2.5 Gbps) for typical residential traffic, though deep inspection and large concurrent session counts may lower effective Gbps. Check the session table and CPU utilization with show firewall statistics to confirm headroom.

Q3: How is the SPI firewall on this ONT different from previous-generation ONTs?

The current generation adds hardware-accelerated stateful inspection and larger session tables compared with older ONTs that relied on software-only filtering. This means higher concurrent session capacity, lower latency overhead, and better support for modern NAT and ALG traffic. Older ONTs may need manual session limit tuning or cannot sustain inspection at full WAN speed.

Q4: What CLI commands configure ACLs and port security alongside the SPI firewall?

Use access-list rules to define permit/deny entries and bind them to WAN or LAN interfaces, then apply switchport port-security commands for MAC limiting on LAN ports. A typical sequence is access-list 100 permit tcp any any established, interface wan0, ip access-group 100 in, followed by port-security settings such as switchport port-security maximum 2. Always save with write memory.

Q5: What should I check if the SPI firewall blocks legitimate applications or causes failover issues?

If legitimate traffic is blocked, verify session timeouts and application-layer gateway (ALG) settings first, since stateful inspection may drop return traffic when ALGs are disabled. For failover issues on dual-WAN or redundant power ONT models, confirm the standby path re-establishes stateful sessions after switchover by checking show firewall sessions. Adjusting TCP/UDP timeout values or adding explicit ACL permits usually resolves false blocking.

Q6: How do I verify SPI firewall status and troubleshoot blocked sessions?

Use show firewall status and show firewall sessions detail to confirm the firewall is enabled and to inspect active session entries. Check counters for drops with show firewall statistics, and correlate dropped flows against ACL hit counters. If sessions are missing, ensure the correct interface is bound to the firewall zone and that NAT is applied before inspection.

Q7: Does the SPI firewall support IPv6 stateful inspection on the ONT?

Yes, supported firmware enables stateful inspection for both IPv4 and IPv6 flows, but IPv6 inspection must be enabled separately in some releases. Verify with show firewall ipv6 status and enable via firewall ipv6 enable if the output shows disabled. Ensure firmware is up to date before enabling, as older builds may lack IPv6 session tracking.