Overview

For B2B network architects and telecom hardware support engineers, a constantly changing public IP address on an Optical Network Terminal (ONT) WAN interface is a critical issue that disrupts VPN tunnels, inbound mail servers, and site-to-site connectivity. This behavior is rarely random; it is typically a symptom of configuration mismatches, upstream DHCP lease policies, or physical layer impairments on the fiber link. This comprehensive FAQ addresses the root causes and provides definitive engineering-level solutions to stabilize your ONT WAN connection.

Frequently Asked Questions

Q1: Why does the public IP address on my ONT WAN interface change every few hours even though the link is stable?

The primary cause is a short DHCP lease time assigned by the Internet Service Provider (ISP). Most ISPs configure DHCP lease times (e.g., 300 seconds) to facilitate network management and IP address reclamation. If your ONT is not set to renew the lease before it expires, the interface will drop the IP and request a new one, causing the WAN IP to change. To fix this, ensure your ONT or connected router is configured to request a lease renewal when the T1 timer (50% of lease time) expires, not when the lease fully expires.

Q2: Can the optical module (SFP) compatibility or signal quality cause WAN IP address fluctuations?

Yes, but indirectly. An incompatible or failing SFP/optical transceiver that causes sporadic link flapping will force the ONT to re-establish the PPPoE or DHCP session, which often results in a new public IP address being assigned. Check the ONT logs for "link down/up" events. The digital diagnostic monitoring (DDM) values should show receive optical power between -8 dBm and -26 dBm (depending on standard) and a stable transmit power. Marginal optical signal-to-noise ratio (OSNR) is a frequent, overlooked culprit for flapping links and IP renewal cycles.

Q3: Does my ISP assign a static IP if I use a specific VLAN ID on the ONT WAN port?

No, configuring an 802.1Q VLAN ID on the WAN port is required for service identification (e.g., Internet, VoIP, IPTV) and does not determine whether the IP is static or dynamic. The IP assignment method (Static vs. DHCP vs. PPPoE) is configured separately in the WAN service profile. If your service is a dynamic IP product, the ISP will always use DHCP or PPPoE to assign a public IP, regardless of the VLAN tag used.

Q4: How do I definitively verify if the IP change is caused by the ONT or the upstream OLT (Optical Line Terminal)?

To isolate the fault, monitor the ONT's system log for interface state changes. If the log shows the WAN interface staying physically up but the IP address is renewed, the issue is at the service/network layer and is likely ISP DHCP policy. If the log shows "WAN link down" followed by "link up" before each IP change, the issue is with the physical fiber path, the ONT hardware, or the SFP. Furthermore, check the ONT's registered serial number status on the OLT; if the OLT is de-registering and re-registering the ONT due to poor optical return loss, a new IP will be requested.

Q5: What CLI commands can I use on my enterprise router to reduce the frequency of WAN IP changes?

You cannot alter ISP DHCP lease times from your customer premises equipment (CPE). However, you can configure your router's DHCP client to aggressively renew the lease before it expires. On most Cisco or Juniper gear, this is handled automatically. For MikroTik RouterOS, use the '/ip dhcp-client' configuration to set 'add-default-route' and ensure the client is not set to 'renew' only after timeout. More importantly, configure a static default route with a higher distance to maintain routing stability if the primary WAN IP changes briefly during a lease renewal process.
Example check on Linux-based routers:
# dhclient -v -nw eth0
This will show the lease time and renewal timers provided by the ISP.

Q6: Does a constant IP change affect my site-to-site VPN or SSL VPN services, and how can I mitigate it?

Absolutely. A dynamic WAN IP is devastating to site-to-site VPNs that rely on a fixed peer IP address. When the IP changes, the IPSec tunnel will drop immediately until the endpoint's FQDN (Fully Qualified Domain Name) resolves to the new IP. The long-term mitigation strategy is to use a Dynamic DNS (DDNS) service on your router. Configure the router to update the DDNS record whenever the WAN IP changes. Set the VPN peer ID to the DDNS hostname instead of the IP address. For SSL VPN portals, the public DNS A record must be updated by the DDNS client.

Q7: How do I determine if the issue is a DHCP starvation attack on the ISP network causing my IP to be dropped?

While rare on carrier-grade networks, DHCP starvation can occur. If your ONT receives a DHCP NAK (Negative Acknowledgment) from the DHCP server, it will force the interface to restart the DHCP discovery process. Check your ONT logs for "DHCP NAK" packets. A genuine NAK means the IP is no longer valid or is blocked. A simple verification is to assign a static private IP to your LAN PC and ping a stable public IP (like 8.8.8.8) continuously. If the ping drops simultaneously with the WAN IP change, it indicates a carrier-side routing or DHCP failure, not your equipment.