Enabling ACL IN PBT ONT and push it from GenieACS

[kpuri1606]

I am looking to leverage ACL feature in my PBT ONT from GenieACS. Currently, it is in testing phase.

What i am attempting to accomplish here is to push ACL from TR server to onsite PBT ONT and this will populate following field in ACL above ACL page.

1. ACL Capacity → Enable ( Check box)
   

2. Enable → Checked
   

3. Interface to be auto selected based on LAN or WAN (parameter send)
   

Also, i am trying to create a script to just allow selected service that could be allowed while remotely managing ONT.

Example:

1. Source IP address / Subnet.
   e.g 0.0.0.0 will allow connection to ONT from all remote source IPs. But i need to just keep 1-2 source IPs for that location.

2. For services, I am planning to just select HTTPS, PING, TFTP.

Thanks,

[rudymartin]

does this trick help ?

Unable to Filter the device from router (ONT)

as a shortcut, in cases like this, I suggest to forget about ACS at first. Just configure the device using the management web to get the configuration you want (in your case, an ARP filter). Once you are happy with it, download the router configuration from the maintenance page and take a look at it: you should be able to find a specific key which does the trick at the ACS side. If not, try configuring the device with obvious values on the required section then download the xml config again and …

[kpuri1606]

Thanks @rudymartin

I will check and will post again.

[kpuri1606]

Value Name="CWMP_ACL_ENABLE" Value="0"/> chain chainName="OMCI_DM_MCAST_ACL_TBL">

I found following when i download router config as you suggested @rudymartin .

If i understand correctlt, we have to provision ACL parameters as well. But these config just gives me values. I assume i need correct parameter to place ACL.

May be i am little lost.

Thanks,

[rudymartin]

not going to ask you to post the entire config file, but posting the entire line/s where the parameter appear might help a bit. IOW what you posted is a just a section of the attributes of a XML element. What you are looking for is a hint for a propper parameter name inside ACS tree data model. That’s how HW store it’s parameters.

[kpuri1606]

[rudymartin]

text can be posted as is using the proper tag. Still not sure to understand but I would look for ACL_IP_TBL inside GenieACS ui. Perhaps you will have to manually refresh some paths until you find it.

if that does not work, another way would be to download two config files, one without the parameters you want and the other with obvious values. linux command diff might give you a clue where is it located.

on HW I can set it this way during boot:

function procesar_boot_call(){
    log( "boot call " );

    declare( "InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.AccessControlListEnable", {
        value: Date.now( )
    }, {
        value: true
    } );
    declare( "InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.List.*", null, {
        path: 0
    } );

    var cadena;

    /*
     * DynamicWanServiceType	
     Mode	0
     Priority	1
     ServicePort	TELNET,HTTP,SSH,FTP,ICMP,SAMBA
     SrcPortName	InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1
     SrcPortType	2
     
     */

    cadena = "InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.List.[";
    cadena += "Mode:0,";
    cadena += "Priority:1,";
    cadena += "ServicePort:\"TELNET,HTTP,SSH,FTP,ICMP,SAMBA\",";
    cadena += "SrcPortType:2,";
    cadena += "SrcPortName:InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1";
    cadena += "]";
    log( "cadena: " + cadena );

    declare( cadena, {
        path: Date.now()
    }, {
        path: 1
    } );
}

[kpuri1606]

Thanks @rudymartin

I have both Huawei and PBT in my enviornment. How do i specify this fuction and parameters to just run on a PBT router during boot. Do i set some provision and put the above javascvript code with some preset.

However, in my Huawei router, it have all those ACL proprietary parameter.

I guess i am still little confuse. I am trying to send my whole config.xml file as this is my test server, but somehow i am not able to share xml file in this section and jpg/jpeg/txt format are big in size.

Regards,

[rudymartin]

PSA: Please don't post images of text

create a preset with the proper event, pointing to the provision you want, then evaluate manufacturer/model to decide if you want to run it, based on the data model, ie DeviceID.ProductClass or DeviceID.Manufacturer (I think it could be done from a preset but I tend to put my trust in the code).

If you don’t have the skills of a programmer then I recommend hiring one with experience on JavaScript/NodeJS and Linux. If you do, then I suggest to invest some time into learn and test how GenieACS works.

In my case I had to dedicate some months until I got it working the way we need it. YMMV.

[kpuri1606]

@rudymartin

InternetGatewayDevice

Hi,

I have looked into you suggestion and trying to use Manufacturer in code. I have name my provision ‘ACL_TEST_PBT’ and have set preset with weight of 100.

const now = Date.now();
const Manufacturer = declare(‘DeviceID.Manufacturer’, {value: 1}).value;

if (typeof Manufacturer !== ‘undefined’ && Manufacturer[0] === ‘PBT’) {
function procesar_boot_call() {
log(“boot call”);

declare("InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.AccessControlListEnable", {
  value: Date.now()
}, {
  value: true
});
declare("InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.List.*", null, {
  path: 0
});

var cadena;

/*
 * DynamicWanServiceType	
 Mode	0
 Priority	1
 ServicePort	TELNET,HTTP,SSH,FTP,ICMP,SAMBA
 SrcPortName	InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1
 SrcPortType	2
 */

cadena = "InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.List.[";
cadena += "IPAddr:0.0.0.0,";
cadena += "NetMask:0,";
cadena += "State:1,";
cadena += "Interface:128,";
cadena += "any:0,";
cadena += "telnet:0,";
cadena += "ftp:0,";
cadena += "tftp:0,";
cadena += "web:0,";
cadena += "snmp:0,";
cadena += "ssh:0,";
cadena += "icmp:1,";
cadena += "telnet_port:0,";
cadena += "web_port:80,";
cadena += "ftp_port:21,";
cadena += "https:1,";
cadena += "https_port:443,";
cadena += "ssh_port:22,";
cadena += "tr069:1,";
cadena += "tr069_port:7547,";
cadena += "instNum:0";
cadena += "]";

log("cadena: " + cadena);

declare(cadena, {
  path: Date.now()
}, {
  path: 1
});

}
}

Howver, i am not able to create a new provision for the specified parameter.

If i am not mistaken, this code is declaring a function called “procesar_boot_call” that sets values for various parameters in the PBT router configuration.

When called, this function sets the “AccessControlListEnable” parameter to the current time, and sets the “InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.List.*” parameter to null with path “0”.

Then, the function builds a string called “cadena” with a specific format that includes settings for various access control list parameters, such as mode, priority, and service ports. Finally, the function calls declare() with the “cadena” string as the first parameter, the current time as the value, and path “1” as the options for this parameter.

I have tried to reboot the PBT router as well. However, i am not able to populate those proprietary parameter in PBT. Am i missing anything here.

[kpuri1606]

I found following differences config files,these are the different line in config with desirefd parmeter.

<Value Name="tr069_port" Value="7547"/>
<Value Name="instNum" Value="0"/>
</chain>
<chain chainName="ACL_IP_TBL">	
<!-- index=1 -->
<Value Name="IPAddr" Value="0.0.0.0"/>
<Value Name="NetMask" Value="0"/>
<Value Name="State" Value="1"/>
<Value Name="Interface" Value="128"/>
<Value Name="any" Value="0"/>
<Value Name="telnet" Value="0"/>
<Value Name="ftp" Value="0"/>
<Value Name="tftp" Value="0"/>
<Value Name="web" Value="0"/>
<Value Name="snmp" Value="0"/>
<Value Name="ssh" Value="0"/>
<Value Name="icmp" Value="1"/>
<Value Name="telnet_port" Value="0"/>
<Value Name="web_port" Value="80"/>
<Value Name="ftp_port" Value="21"/>
<Value Name="https" Value="1"/>
<Value Name="https_port" Value="443"/>
<Value Name="ssh_port" Value="22"/>
<Value Name="tr069" Value="1"/>

[kpuri1606]

@rudymartin

I have created a parent parameter as well:

const now = Date.now();
const Manufacturer = declare('DeviceID.Manufacturer', {value: 1}).value;

if (typeof Manufacturer !== 'undefined' && Manufacturer[0] === 'PBTG') {
  function procesar_boot_call() {
    log("boot call");

    declare("InternetGatewayDevice.X_PBT_Security", null, {
      path: 0
    });

    declare("InternetGatewayDevice.X_PBT_Security.AclServices", null, {
      path: 0
    });

    declare("InternetGatewayDevice.X_PBT_Security.AclServices.AccessControl", null, {
      path: 0
    });
	
    declare("InternetGatewayDevice.X_PBT_Security.AclServices.AccessControl.AccessControlListEnable", {
      value: Date.now()
    }, {
      value: true
    });
    
    declare("InternetGatewayDevice.X_PBT_Security.AclServices.AccessControl.List.*", null, {
      path: 0
    });

    var cadena;

    /*
     * DynamicWanServiceType	
     Mode	0
     Priority	1
     ServicePort	TELNET,HTTP,SSH,FTP,ICMP,SAMBA
     SrcPortName	InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1
     SrcPortType	2
     */

    cadena = "InternetGatewayDevice.X_PBT_Security.AclServices.AccessControl.List.[";
    cadena += "IPAddr:0.0.0.0,";
    cadena += "NetMask:0,";
    cadena += "State:1,";
    cadena += "Interface:128,";
    cadena += "any:0,";
    cadena += "telnet:0,";
    cadena += "ftp:0,";
    cadena += "tftp:0,";
    cadena += "web:0,";
    cadena += "snmp:0,";
    cadena += "ssh:0,";
    cadena += "icmp:1,";
    cadena += "telnet_port:0,";
    cadena += "web_port:80,";
    cadena += "ftp_port:21,";
    cadena += "https:1,";
    cadena += "https_port:443,";
    cadena += "ssh_port:22,";
    cadena += "tr069:1,";
    cadena += "tr069_port:7547,";
    cadena += "instNum:0";
    cadena += "]";

    log("cadena: " + cadena);

    declare(cadena, {
      path: Date.now()
    }, {
      path: 1
    });
  }
}