Overview

In B2B telecom deployments, the ONT (Optical Network Terminal) is the critical demarcation point between the carrier's PON infrastructure and the enterprise network. When the PON LED is solid green but the Internet LED is off, it typically indicates that the physical layer is established but a higher-layer service issue exists. This FAQ addresses the most common pre-sales and post-sales technical queries from network architects, procurement teams, and field engineers, providing direct, actionable answers to resolve connectivity issues and optimize network integration.

Frequently Asked Questions

Q1: Why is the Internet LED off while the PON light is solid green on my ONT?

The Internet LED is off while the PON light is solid green because the ONT has successfully registered with the OLT at the physical layer but has failed to obtain an IP address or establish a PPPoE/DHCP session for internet access. This indicates a Layer 3 or service provisioning issue, not a fiber optic link problem. Common causes include incorrect VLAN settings, missing PPPoE credentials, ISP service suspension, or a misconfigured WAN profile in the ONT.

Q2: What optical module compatibility guidelines should I follow for my ONT's PON interface?

ONT PON interfaces require Class B+ or Class C+ optical modules that comply with ITU-T G.984 (GPON) or G.987 (XG-PON) standards, with specific wavelength and power budget matching the OLT. Third-party module compatibility depends on the ONT chipset and firmware; always verify the module's optical budget (e.g., 28 dB for Class B+) and temperature range. For B2B deployments, use carrier-grade modules with DDM (Digital Diagnostic Monitoring) to ensure real-time power level visibility.

Q3: What is the maximum throughput in Gbps supported by current-generation ONTs for enterprise use?

Current enterprise-grade ONTs support maximum throughput of 2.5 Gbps downstream and 1.25 Gbps upstream for GPON, or 10 Gbps symmetrical for XGS-PON. High-end models with 10G/25G PON interfaces can deliver up to 25 Gbps line-rate forwarding. Throughput is also limited by the backplane capacity and the number of active subscriber ports; always check the datasheet for the specific forwarding performance in Mpps.

Q4: How does the backplane capacity of a next-gen ONT differ from previous generations?

The backplane capacity of next-gen ONTs has increased from 1-2 Gbps in legacy GPON models to 10-40 Gbps in XGS-PON and NG-PON2 platforms, enabling non-blocking multi-service delivery. This improvement supports higher port densities, advanced QoS, and simultaneous triple-play services without contention. Previous generations often shared a lower-capacity bus, while modern ONTs use a switched fabric for full line-rate performance.

Q5: What is the basic CLI configuration to enable internet access on a new ONT?

The basic CLI configuration involves accessing the console port, entering privileged EXEC mode, and configuring the WAN interface with the correct VLAN ID and PPPoE credentials. Typical commands include interface wan 1, encapsulation pppoe, pppoe username <user> password <pass>, and vlan 100 before saving and reloading. Always consult the vendor's CLI reference for exact syntax, as commands vary by model.

Q6: How do I troubleshoot stacking interface errors on an ONT or access switch?

Stacking interface errors are typically resolved by verifying physical cable integrity, checking that all units run the same firmware version, and confirming the stacking ports are configured in the correct mode (e.g., stack-port 1/1). Common causes include mismatched speeds, faulty DAC cables, or incorrect priority settings. Use show stack status and show stack-port commands to diagnose link state and topology errors.

Q7: What should I do if redundant power failover fails on my ONT?

If redundant power failover fails, first verify that both power supplies are connected to independent AC/DC sources and that the secondary PSU LED is green. Check for blown fuses, loose connectors, or a faulty PSU by swapping it with a known-good unit. In CLI, use show power to confirm both inputs are detected; if not, the issue may be a backplane power controller fault requiring RMA.

Q8: How can I secure my ONT against unauthorized access and DDoS attacks?

Secure your ONT by disabling unused services (Telnet, HTTP), enabling SSH with strong passwords, configuring ACLs to restrict management access to trusted subnets, and applying rate-limiting on WAN interfaces. For advanced protection, enable MACsec on the PON link and use dynamic ACLs to mitigate DDoS. Regularly update firmware to patch vulnerabilities and audit logs for suspicious activity.