Skip to content
OLTPRIME

Step 2 of 3

Connect your first OLT

What to prepare, how the secure VPN works, and the one command that sets up your router.

Your OLT does not need to be exposed to the internet. It stays on your own network, and we reach it through a private VPN from your router to us.

Every step on this page is yours to do. Nothing here waits on us.

VPN Your router opens it, outgoing. No port forwarding. Nothing on the OLT is reachable from the internet. YOUR SITE OLT stays private Router MikroTik OLT PRIME Hub VPN Dashboard your account VPN Your router opens it, outgoing. No port forwarding. Nothing on the OLT is reachable from the internet.

What to have ready

Have these to hand before you start:

  • Your OLT — make and model, and the management address it uses today.
  • Whether that address can change. Some networks have it fixed in an NMS or a script. Either answer is fine — it decides which of the two methods below you use.
  • A MikroTik router — an RB951 is the minimum; anything above it is fine. Know whether it runs RouterOS 6 or 7; you pick that when you get the command.
  • Which port on the router the OLT is plugged into, for example ether2, and whether that port is free.

Logins you will need

  • Your router, with permission to change configuration. The setup command creates an interface and an address, so a read-only login will stop halfway.
  • Your OLT, at a level that can change configuration — the same one you would use to configure a card or a service. A monitor-only login cannot enable the management service.

The router password never leaves your hands. The OLT login is optional — you only need it for profile work later.

Two ways to connect

You choose this when you create the VPN. The difference is only whether your OLT's address changes.

RECOMMENDED — YOUR OLT MOVES TO AN ADDRESS WE GIVE YOU / ONLY IF IT CANNOT MOVE — YOUR OLT KEEPS ITS ADDRESS Router translates, 1-to-1, both directions. gateway 10.200.0.9. RECOMMENDED — YOUR OLT MOVES TO AN ADDRESS WE GIVE YOU OLT 10.200.0.10 Router gateway 10.200.0.9 We see 10.200.0.10 ONLY IF IT CANNOT MOVE — YOUR OLT KEEPS ITS ADDRESS OLT 192.168.100.1 Router translates 1-to-1, both directions We see 10.200.0.10

Your OLT moves to an allocated address — recommended. The OLT takes an address from a small range set aside for it, well clear of anything already on your network. Nothing to overlap, and nothing translating in the middle that can go wrong later. It does mean the OLT's management address changes, so anything pointing at the old one has to be updated.

Your OLT keeps its address. Your router translates between the address it has now and the one we use. Nothing on the OLT changes at all. Use this when the OLT genuinely cannot be re-addressed — it is fixed in an NMS you do not control, or the change would mean an outage you cannot schedule.

You pick this in the Set up VPN dialog, so nothing is decided until then.

The order of the steps

Each step needs the one before it. The OLT is added while it is still unreachable — it shows Offline until the VPN is up, which is expected, not a fault. There is no point probing or syncing before that.

Prepare → Sync Prepare, Add + VPN, Run it, VPN up, Sync. 1 Prepare the OLT 2 Add + VPN in the portal 3 Run it on the router 4 VPN up Offline → Alive 5 Sync

1. Prepare the OLT

Everything in this step is typed at the OLT's own terminal.

Getting to the terminal

Connect with SSH (or Telnet, if that is what your device has enabled) to the OLT's current management address, and sign in with an account that can change configuration. On a Huawei OLT that means an account which can reach privileged view — the same one you would use to configure a card or a service.

ssh <your-username>@<your-OLT-address>

If you have never changed them, the credentials are whatever your installer set. They stay on your device; the OLT login you enter later is stored encrypted and never shown again.

Switch on management access

In privileged view, enter configuration and set the two community strings we will use to read from and write to the device. Pick your own values and keep them — you enter the same two when you add the OLT.

enable
config
snmp-agent community read
<your read community>

snmp-agent community write
<your write community>

sysman service snmp enable
sysman firewall snmp disable

Three things about this block that catch people out:

  • The community is asked for on its own line. It is not typed on the end of the command. After you enter it the device asks once more; a plain Enter there accepts the default view, which is what you want. That is what the blank lines above are.
  • sysman firewall snmp disable is not optional. Enabling the service while the device firewall still blocks it is the single most common reason an OLT looks configured and still does not answer.
  • Nothing is saved yet. Do that at the end.

Keep the configuration across a reboot

Still in configuration view:

autosave interval on
autosave interval 1442
autosave interval configuration 60
autosave type all

If your OLT is moving to a new address

Skip this if you chose the first method — your OLT keeps its address and there is nothing to change here.

The management address lives on the meth 0 interface. You can see what it is now with display interface meth 0, which reports it as Internet Address.

The Set up VPN dialog shows you two values — an address for the OLT and a gateway. Set both:

config
interface meth 0
ip address <address from the dialog> <mask>
quit
ip route-static 0.0.0.0 0.0.0.0 <gateway from the dialog>

This is the step that disconnects you. The moment the address changes, the session you are typing in is talking to an address the OLT no longer has. Do this from the console port, or from somewhere that can reach the new address — not over a connection that depends on the old one.

Afterwards, display ip routing-table should show a Static default route (0.0.0.0/0) pointing at the gateway, out of meth0.

Save

Back out to privileged view and write the configuration to flash:

quit
save

save asks what to save. Press Enter on its own — a plain Enter saves everything. Typing y is rejected as "Too many parameters", which reads like an error in the command and is not.

If the device reboots before this, everything above is lost, and the symptom looks exactly like a network fault.

2. Add the OLT in the portal

Sign in and open OLTs → Add. What it asks for is what you set up in step 1:

  • Host — the OLT's management address
  • PON support — GPON, EPON or mixed
  • Read community and Write community — the two you chose
  • CLI username / password — optional, only needed for profile work later

Save it.

It will show as Offline, and that is correct. There is no path to the device yet — that is what the next step builds. Do not probe or sync now; both will fail for a reason that tells you nothing.

3. Create the VPN

On the OLT's page, press Set up VPN. The addresses are allocated for you; the two things to set are:

  • How the OLT is addressed — the choice from earlier in this page
  • Router port — which port on your MikroTik the OLT is plugged into

Press Create VPN and you are given one command.

You need a MikroTik router, and it has to be able to run an OVPN client. An RB951 is the practical minimum; anything above it is fine. RouterOS 6 and 7 are both supported — pick yours in the dialog and it hands you the matching command.

4. Run the command on your router

Open a terminal on the router and paste the line the dialog gave you. It looks like this:

/tool fetch url="https://…/p/…" dst-path=prime.rsc; /import file-name=prime.rsc

It downloads a small configuration file and applies it. That sets up the connection to us and, depending on the method above, either prepares the port your OLT is on or adds the translation rules.

A few notes:

  • It is safe to run twice. If something is already configured it is left alone rather than duplicated. If you generate a fresh command later, run it the same way and it will update what needs updating.
  • The link works once. It carries the credentials for your VPN, so it stops working after the first use. If it fails before it completes, generate a new link from the OLT's page — retrying the old one will not work.
  • If your router runs RouterOS 6 rather than 7, select that in the dialog before copying the command.

5. Check it worked

Wait for the VPN to come up — about half a minute. The OLT flips from Offline to Alive on its own; you do not have to press anything.

Only once it is up, run Probe, then Sync all. The OLT's Overview tab then looks like this:

North district — Alive STATUS: Alive. LAST SYNC: 2 min ago. ALARMS: 0, ALL CLEAR. STATUS Alive UPTIME 205d LATENCY 78 ms POLL ROUND-TRIP LAST SYNC 2 min ago AUTO-SYNC ON ALARMS 0 ALL CLEAR ONU health Online 402 Offline 88

Then use Probe, which sends one small request to the OLT and tells you what came back. It is much easier to read than a failed sync, because there are only a few things it can be:

Answers / Reads fine, writes do not / No answer at all No answer at all: There is no path to the device yet. Check the address and its gateway. Reads fine, writes do not: The write community does not match. The device stops answering rather than saying so. Answers: Ready to run the first sync. No answer at all There is no path to the device yet. Check the address and its gateway. Reads fine, writes do not The write community does not match. The device stops answering rather than saying so. Answers Ready to run the first sync.

There is a fourth answer worth knowing: answers, but slowly. Fix that now rather than later. A slow link is survivable; a link that drops packets is not.

Once the probe is clean, run Sync all. We read the cards, the ports and every subscriber attached to them. The first run on a busy device takes a few minutes; later runs are much faster because only what changed is written.

If you get stuck

Tell us what the probe said and we will take it from there. That one line usually identifies the problem straight away.