# Enabling ACL IN PBT ONT and push it from GenieACS **URL:** \ **Category:** Uncategorized\ **Created:** [April 21, 2023, 12:18pm UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876 "2023-04-21T12:18:26Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![kpuri1606](https://avatars.discourse-cdn.com/v4/letter/k/5e9695/32.png) [@kpuri1606](https://forum.genieacs.com/u/kpuri1606)\ **Post date:** [April 21, 2023, 12:18pm UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/1 "2023-04-21T12:18:26Z")
I am looking to leverage ACL feature in my PBT ONT from GenieACS. Currently, it is in testing phase. ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/2/250980f265dbede098604fb83e384f4ee677ad76.png) What i am attempting to accomplish here is to push ACL from TR server to onsite PBT ONT and this will populate following field in ACL above ACL page. 1. ACL Capacity → Enable ( Check box) ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/a/a2df67f245d0b5a9183f9fd83422b2fd489bc795.png) 2. Enable → Checked ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/5/5c5410a77ab164ab7da167427816f2f3ec4e26b1.png) 3. Interface to be auto selected based on LAN or WAN (parameter send) ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/2/2ffafc3f633f18c887c5a2a37a4cdbfc6cc85033.png) Also, i am trying to create a script to just allow selected service that could be allowed while remotely managing ONT. Example: 1. Source IP address / Subnet. e.g 0.0.0.0 will allow connection to ONT from all remote source IPs. But i need to just keep 1-2 source IPs for that location. ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/7/77838a79aeea211a7dce31460b57ba1f95793e89.png) 1. For services, I am planning to just select HTTPS, PING, TFTP. ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/a/acad55810e5cacf4ddfd4d501493f44a82e3eb43.png) Thanks, ---
**Author:** ![rudymartin](https://avatars.discourse-cdn.com/v4/letter/r/919ad9/32.png) [@rudymartin](https://forum.genieacs.com/u/rudymartin)\ **Post date:** [April 21, 2023, 4:20pm UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/2 "2023-04-21T16:20:26Z")
does this trick help ? > [@Unable to Filter the device from router (ONT)](https://forum.genieacs.com/t/unable-to-filter-the-device-from-router-ont/2146/2): > > as a shortcut, in cases like this, I suggest to forget about ACS at first. Just configure the device using the management web to get the configuration you want (in your case, an ARP filter). Once you are happy with it, download the router configuration from the maintenance page and take a look at it: you should be able to find a specific key which does the trick at the ACS side. If not, try configuring the device with obvious values on the required section then download the xml config again and … ---
**Author:** ![kpuri1606](https://avatars.discourse-cdn.com/v4/letter/k/5e9695/32.png) [@kpuri1606](https://forum.genieacs.com/u/kpuri1606)\ **Post date:** [April 21, 2023, 4:47pm UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/3 "2023-04-21T16:47:41Z")
Thanks @rudymartin I will check and will post again. ---
**Author:** ![kpuri1606](https://avatars.discourse-cdn.com/v4/letter/k/5e9695/32.png) [@kpuri1606](https://forum.genieacs.com/u/kpuri1606)\ **Post date:** [April 24, 2023, 3:46am UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/4 "2023-04-24T03:46:10Z")
Value Name="CWMP\_ACL\_ENABLE" Value="0"/\> chain chainName="OMCI\_DM\_MCAST\_ACL\_TBL"\> I found following when i download router config as you suggested @rudymartin . If i understand correctlt, we have to provision ACL parameters as well. But these config just gives me values. I assume i need correct parameter to place ACL. May be i am little lost. Thanks, ---
**Author:** ![rudymartin](https://avatars.discourse-cdn.com/v4/letter/r/919ad9/32.png) [@rudymartin](https://forum.genieacs.com/u/rudymartin)\ **Post date:** [April 24, 2023, 5:06am UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/5 "2023-04-24T05:06:41Z")
not going to ask you to post the entire config file, but posting the entire line/s where the parameter appear might help a bit. IOW what you posted is a just a section of the attributes of a XML element. What you are looking for is a hint for a propper parameter name inside ACS tree data model. That’s how HW store it’s parameters. ---
**Author:** ![kpuri1606](https://avatars.discourse-cdn.com/v4/letter/k/5e9695/32.png) [@kpuri1606](https://forum.genieacs.com/u/kpuri1606)\ **Post date:** [April 24, 2023, 5:46am UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/6 "2023-04-24T05:46:52Z")
![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/f/ffe4bd06fede22197b8452a1ab8c9ffb5adc06ff.png) ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/a/a2247ac51b2e532a5d6eaf76729654a42747b090.png) ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/5/53c82a0447730ec8871d5262b8a5ab6d3035c327.png) ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/e/e46509d830a2e5d5640b5fa099402b5126e37190.png) ---
**Author:** ![rudymartin](https://avatars.discourse-cdn.com/v4/letter/r/919ad9/32.png) [@rudymartin](https://forum.genieacs.com/u/rudymartin)\ **Post date:** [April 24, 2023, 4:58pm UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/7 "2023-04-24T16:58:46Z")
text can be posted as is using the proper tag. Still not sure to understand but I would look for ACL\_IP\_TBL inside GenieACS ui. Perhaps you will have to manually refresh some paths until you find it. if that does not work, another way would be to download two config files, one without the parameters you want and the other with obvious values. linux command `diff` might give you a clue where is it located. on HW I can set it this way during boot: ```auto function procesar_boot_call(){ log( "boot call " ); declare( "InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.AccessControlListEnable", { value: Date.now( ) }, { value: true } ); declare( "InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.List.*", null, { path: 0 } ); var cadena; /* * DynamicWanServiceType Mode 0 Priority 1 ServicePort TELNET,HTTP,SSH,FTP,ICMP,SAMBA SrcPortName InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1 SrcPortType 2 */ cadena = "InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.List.["; cadena += "Mode:0,"; cadena += "Priority:1,"; cadena += "ServicePort:\"TELNET,HTTP,SSH,FTP,ICMP,SAMBA\","; cadena += "SrcPortType:2,"; cadena += "SrcPortName:InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1"; cadena += "]"; log( "cadena: " + cadena ); declare( cadena, { path: Date.now() }, { path: 1 } ); } ``` ---
**Author:** ![kpuri1606](https://avatars.discourse-cdn.com/v4/letter/k/5e9695/32.png) [@kpuri1606](https://forum.genieacs.com/u/kpuri1606)\ **Post date:** [May 2, 2023, 11:31am UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/8 "2023-05-02T11:31:55Z")
Thanks @rudymartin I have both Huawei and PBT in my enviornment. How do i specify this fuction and parameters to just run on a PBT router during boot. Do i set some provision and put the above javascvript code with some preset. However, in my Huawei router, it have all those ACL proprietary parameter. I guess i am still little confuse. I am trying to send my whole config.xml file as this is my test server, but somehow i am not able to share xml file in this section and jpg/jpeg/txt format are big in size. Regards, ---
**Author:** ![rudymartin](https://avatars.discourse-cdn.com/v4/letter/r/919ad9/32.png) [@rudymartin](https://forum.genieacs.com/u/rudymartin)\ **Post date:** [May 2, 2023, 5:44pm UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/10 "2023-05-02T17:44:29Z")
> create a preset with the proper event, pointing to the provision you want, then evaluate manufacturer/model to decide if you want to run it, based on the data model, ie `DeviceID.ProductClass` or `DeviceID.Manufacturer` (I think it could be done from a preset but I tend to put my trust in the code). If you don’t have the skills of a programmer then I recommend hiring one with experience on JavaScript/NodeJS and Linux. If you do, then I suggest to invest some time into learn and test how GenieACS works. In my case I had to dedicate some months until I got it working the way we need it. YMMV. ---
**Author:** ![kpuri1606](https://avatars.discourse-cdn.com/v4/letter/k/5e9695/32.png) [@kpuri1606](https://forum.genieacs.com/u/kpuri1606)\ **Post date:** [May 5, 2023, 7:58am UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/11 "2023-05-05T07:58:11Z")
> [@rudymartin](#): > > `InternetGatewayDevice` Hi, I have looked into you suggestion and trying to use Manufacturer in code. I have name my provision ‘ACL\_TEST\_PBT’ and have set preset with weight of 100. const now = Date.now(); const Manufacturer = declare(‘DeviceID.Manufacturer’, {value: 1}).value; if (typeof Manufacturer !== ‘undefined’ && Manufacturer[0] === ‘PBT’) { function procesar\_boot\_call() { log(“boot call”); ``` declare("InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.AccessControlListEnable", { value: Date.now() }, { value: true }); declare("InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.List.*", null, { path: 0 }); var cadena; /* * DynamicWanServiceType Mode 0 Priority 1 ServicePort TELNET,HTTP,SSH,FTP,ICMP,SAMBA SrcPortName InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1 SrcPortType 2 */ cadena = "InternetGatewayDevice.X_HW_Security.AclServices.AccessControl.List.["; cadena += "IPAddr:0.0.0.0,"; cadena += "NetMask:0,"; cadena += "State:1,"; cadena += "Interface:128,"; cadena += "any:0,"; cadena += "telnet:0,"; cadena += "ftp:0,"; cadena += "tftp:0,"; cadena += "web:0,"; cadena += "snmp:0,"; cadena += "ssh:0,"; cadena += "icmp:1,"; cadena += "telnet_port:0,"; cadena += "web_port:80,"; cadena += "ftp_port:21,"; cadena += "https:1,"; cadena += "https_port:443,"; cadena += "ssh_port:22,"; cadena += "tr069:1,"; cadena += "tr069_port:7547,"; cadena += "instNum:0"; cadena += "]"; log("cadena: " + cadena); declare(cadena, { path: Date.now() }, { path: 1 }); ``` } } ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/c/ce9285be6acc7a426d721238d7e36c7382076ac6.png) ![image](https://canada1.discourse-cdn.com/flex035/uploads/genieacs/original/2X/4/4ea6ec916330a6a7c02d94f83d8059c83fee2052.png) Howver, i am not able to create a new provision for the specified parameter. If i am not mistaken, this code is declaring a function called “procesar\_boot\_call” that sets values for various parameters in the PBT router configuration. When called, this function sets the “AccessControlListEnable” parameter to the current time, and sets the “InternetGatewayDevice.X\_HW\_Security.AclServices.AccessControl.List.\*” parameter to null with path “0”. Then, the function builds a string called “cadena” with a specific format that includes settings for various access control list parameters, such as mode, priority, and service ports. Finally, the function calls declare() with the “cadena” string as the first parameter, the current time as the value, and path “1” as the options for this parameter. I have tried to reboot the PBT router as well. However, i am not able to populate those proprietary parameter in PBT. Am i missing anything here. ---
**Author:** ![kpuri1606](https://avatars.discourse-cdn.com/v4/letter/k/5e9695/32.png) [@kpuri1606](https://forum.genieacs.com/u/kpuri1606)\ **Post date:** [May 5, 2023, 8:05am UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/12 "2023-05-05T08:05:47Z")
I found following differences config files,these are the different line in config with desirefd parmeter. ```auto ``` ---
**Author:** ![kpuri1606](https://avatars.discourse-cdn.com/v4/letter/k/5e9695/32.png) [@kpuri1606](https://forum.genieacs.com/u/kpuri1606)\ **Post date:** [May 7, 2023, 5:01am UTC](https://forum.genieacs.com/t/enabling-acl-in-pbt-ont-and-push-it-from-genieacs/3876/13 "2023-05-07T05:01:58Z")
@rudymartin I have created a parent parameter as well: ```auto const now = Date.now(); const Manufacturer = declare('DeviceID.Manufacturer', {value: 1}).value; if (typeof Manufacturer !== 'undefined' && Manufacturer[0] === 'PBTG') { function procesar_boot_call() { log("boot call"); declare("InternetGatewayDevice.X_PBT_Security", null, { path: 0 }); declare("InternetGatewayDevice.X_PBT_Security.AclServices", null, { path: 0 }); declare("InternetGatewayDevice.X_PBT_Security.AclServices.AccessControl", null, { path: 0 }); declare("InternetGatewayDevice.X_PBT_Security.AclServices.AccessControl.AccessControlListEnable", { value: Date.now() }, { value: true }); declare("InternetGatewayDevice.X_PBT_Security.AclServices.AccessControl.List.*", null, { path: 0 }); var cadena; /* * DynamicWanServiceType Mode 0 Priority 1 ServicePort TELNET,HTTP,SSH,FTP,ICMP,SAMBA SrcPortName InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1 SrcPortType 2 */ cadena = "InternetGatewayDevice.X_PBT_Security.AclServices.AccessControl.List.["; cadena += "IPAddr:0.0.0.0,"; cadena += "NetMask:0,"; cadena += "State:1,"; cadena += "Interface:128,"; cadena += "any:0,"; cadena += "telnet:0,"; cadena += "ftp:0,"; cadena += "tftp:0,"; cadena += "web:0,"; cadena += "snmp:0,"; cadena += "ssh:0,"; cadena += "icmp:1,"; cadena += "telnet_port:0,"; cadena += "web_port:80,"; cadena += "ftp_port:21,"; cadena += "https:1,"; cadena += "https_port:443,"; cadena += "ssh_port:22,"; cadena += "tr069:1,"; cadena += "tr069_port:7547,"; cadena += "instNum:0"; cadena += "]"; log("cadena: " + cadena); declare(cadena, { path: Date.now() }, { path: 1 }); } } ```