Zyxel AX7501 with Opal-OS

Does anyone here have any experience with these cpe’s? We’re having some issues with TR-181 on these boxes and had to switch to TR-098 to make them work. When on TR-181 we where unable to write new paths to it, we could only edit existing instances.

I haven’t used that particular model, but I have used others. Try adding the cwmp.skipWritableCheck option and setting the value to true. Zyxel has issues following the spec, including marking object paths as <Writable>0</Writable> when it should be 1.

1 Like

Tried it, but no luck. I’m allowed to delete instances, though (been like that the whole time), and it’s weird that it works fine on TR-098 and not TR-181. We’ve contacted Zyxel(via their tech/sales partner) about this and we’re expecting some feedback this week. The techs weren’t familiar with GenieACS as Zyxel really wants to push their own acs, but we’ll see.

Sigh… If your experience is like mine, expect things to take much longer than they should. When you do battle with CPE vendors they always want to blame the ACS. No matter what the issue is.

I’ve found the best way to tackle this is have copious documentation, log entries, and then point them all the way back to the sub-section of the specification where they are failing.

What path are you trying to write to, and what is the output of the debug log for that CPE?

Trying to build firewall rules to allow access, but nothing works unless it’s already there. For instance:
I’ll try to path up “Device.X_ZYXEL_RemoteManagement.SPService.1”, but no go, neither by script or gui… It’s just not writable. I can edit or delete the existing ones, though. Go figure. On TR-098 it works just fine doing this:
declare(“InternetGatewayDevice.X_ZYXEL_RemoteManagement.SPTrustDomain.[Enable:true,IPAddress:,SubnetMask:28]”, {path: now}, { path: 1 });

I tried setting cwmp.skipWritableCheck to true (should it be true/false og 1/0?), but it didn’t make much of a difference. Will try to capture some debug today.
Adding insult to injury, Zyxel are really heavy on manufacturer-specific entries. A loooot of X_ZYXEL in there…

So much for standards.

I’ve been working at ISP’s for the past 10 years now, 2 years as an integrator and tech for multiple ISP’s and a vendor partner for Genexis, Huawei and more. It’s always a drag to make the vendors understand that there is a world outside…
Will be leaving the ISP (and consultant) world in two weeks and work as a network tech at our national broadcaster (NRK) so anything I get done is good, but after that it’s someone else’s headache… :smiley:

Okay, now I understand what you are trying to do. You are writing to the wrong param. You want Device.X_ZYXEL_RemoteManagement.TrustDomain. Try this: declare("Device.X_ZYXEL_RemoteManagement.TrustDomain.[Enable:true,IPAddress:,SubnetMask:28,Enable:true]", {path: 1}, { path: 1 });

That you can’t add instances to SPService makes sense (and it shouldn’t let you delete, but alas appears to allow that, but I haven’t tried). There are only a limited set number of services that actually exist on the CPE. You can’t add/remove the services. Only enable/disable them.

I have the same issue with the Zyxel Trust Domain
I tried the method you mention, but I can’t seem to get it to work. I have 1 Trust Domain and I’m trying to create instance number 2

declare("Device.X_ZYXEL_RemoteManagement.TrustDomain.2[Enable:true,IPAddress:,SubnetMask:24,Enable:true]", {path: 1}, { path: 1 });

@akcoder SpService is different, of course, I pasted the wrong line… We use both trustdomain and sptrustdomain and they work fine on TR-098. Unless there is already a path, nothing is editable in TR-181.

@martink, we “solved” it by switching to TR-098 with this:
This will reboot the device and re-read it, but it will be left unchanged.
After that you can do:
declare(“InternetGatewayDevice.X_ZYXEL_EXT.RemoteManagement.TrustDomain.[Enable:true,IPAddress:,SubnetMask:24]”, {path: now}, { path: 1 });

Thanks @gittela I’ll try that method, being new to genieacs and trying to learn “the Zyxel way” of configuring things isn’t always easy.

By the way, on another Zyxel I want to change a value from true to false and then send a reboot command for the change to take effect.
The value changes when I run my declare, but after that when the reboot runs I get “The TR-069 session was unsuccessfully terminated” and the reboot doesn’t happen.

This is not the full provision script but these are the last two lines:

const now = Date.now();
declare("Device.Ethernet.Interface.6.EEEEnable", {path: now, value: now}, {value: "false"});
declare("Reboot", null, {value: now});

And the log:

ACS request; acsRequestId="178498baaed0101" acsRequestName="SetParameterValues"
ACS request; acsRequestId="178498baaed0102" acsRequestName="Reboot"
Session timeout; sessionTimestamp=1616141593325
Channel has faulted; channel="Setup" retries=0 faultCode="session_terminated" faultMessage="The TR-069 session was unsuccessfully terminated"

Quite embarrassing, I got stuck in the matrix of scripts that log into the CPE, changes the value in the text configuration file and reboots the CPE for it to take effect.

When I push this value via ACS, the change happens on the fly in the running configuration. That’s why the reboot command fails, the WAN interface flaps when I push the change via ACS. So no need for reboot…

Well, it’s Zyxel, we have various issues with them… We’re still trying to get them on the ball with proper TR-181.
I made a small script that runs after bootstrap. It checks which version and sets it for stuff to work. That was the only way I managed to get them up and running out of the box.

Did you get anywhere with this? I have bokses that supports and uses TR-181 by default, but genieACS uses TR098 by default it seems.

TR-181 is an extension of TR-069. Same as TR-098, TR-143, etc.

I’ve had the VMG4927 running for over a year using GenieACS v1.1 with the VMG4927 in TR-181 mode.

Can i see your config-files?

What specifically do you want to see?

TR-181 mode, i can’t find this.

If that option is available on your CPE it will be on the TR-069 page. You have to login as supervisor to see that page. IIRC, the supervisor password is the admin password plus the last 5 of the mac (or is it the serial).

I did not have it inside the UI with my zyxel devices. Best option is to get in touch with zyxel, send them your config with the request to change to tr181.
They will also provide the supervisor password.