OLT Management Module — Full Technical Development Guide
ISP CRM Integration Blueprint: CRM ↔ RADIUS ↔ OLT ↔ Mikrotik BRAS
Document Type: Software Requirements & Architecture Spec Audience: Backend, Frontend & Network Engineers v2.0 — EXPANDED
SECTION 1 — Overview & System Architecture
An ISP CRM's OLT Management Module acts as the central automation brain that connects three network entities: the CRM database, the
RADIUS (AAA) server, and the physical OLT hardware (plus the Mikrotik BRAS gateway). The goal is zero-touch provisioning — when an
admin saves a customer record, the system automatically configures the RADIUS database, logs into the OLT, registers the ONU, pushes
OMCI settings, and activates the subscriber's internet.
CRM Core (Admin UI + Database)
↓
Dynamic Vendor Driver Layer (translates input into vendor-specific CLI/SNMP)
↓ ↓
RADIUS Sync (FreeRADIUS DB) Physical OLT (SSH/Telnet/SNMP)
↓ ↓
radcheck + radreply tables ONU registration + OMCI config
↓
Mikrotik BRAS (PPPoE secret + Queue) — Customer Internet ON
SECTION 2 — RADIUS & OLT Sync Parameters (Local CRM Inventory)
When a new OLT is added to the CRM, the following parameters must be stored in the database. The table marks each as Compulsory or
Optional/Recommended.
Parameter Purpose Data Type Compulsory?
olt_name Human-readable identifier (e.g. Delhi-Zone1-OLT) String YES
vendor_type Brand — selects the correct driver (Syrotech/Netlink/VSOL/Huawei/C-Data/BDCOM) Enum YES
mgmt_ip IP address the CRM connects to IPv4 YES
ssh_port / telnet_port Connection port (22 for SSH, 23 for Telnet) Integer YES
username OLT login username String YES
password OLT login password (must be encrypted in DB) String YES
snmp_ro_community Read-only key to fetch live Rx/Tx power, counts String Recommended
snmp_rw_community Read-write key to push remote config String Recommended
snmp_version v2c or v3 (v3 recommended for security) Enum Recommended
total_pon_ports Physical PON port count (4 / 8 / 16) Integer Optional
max_onus_per_port ONU capacity per port (e.g. 64 / 128) Integer Optional
service_vlan (S-VLAN) Outer provider VLAN tag Integer Recommended
mgmt_vlan Management VLAN tag Integer Optional
Important: Each OLT requires separate IP, credentials, and port settings. However, Speed Profiles (DBA) and VLAN Schemes can be
created once as Global Templates and then assigned to any OLT.
SECTION 9 — OLT Inventory Database Schema (Full)
CREATE TABLE olt_inventory (
id INT AUTO_INCREMENT PRIMARY KEY,
olt_name VARCHAR(100) NOT NULL,
vendor_type ENUM('Syrotech','Netlink','VSOL','CData','Huawei','BDCOM','Generic') NOT NULL,
mgmt_ip VARCHAR(45) NOT NULL,
ssh_telnet_port INT DEFAULT 22,
username VARCHAR(50) NOT NULL,
password VARCHAR(255) NOT NULL, -- encrypted
snmp_ro VARCHAR(50),
snmp_rw VARCHAR(50),
total_pon_ports INT DEFAULT 8,
service_vlan INT DEFAULT 100,
status ENUM('Active','In-Active','Timeout') DEFAULT 'Active',
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);
Page 1 of 5 • OLT Management Module — Full Technical Guide • Confidential / Internal Use
SECTION 3 — RADIUS Attributes Reference (RFC 2865 / 2866 / VSAs)
During authentication, accounting, and authorization, the OLT/BRAS exchanges these attributes with the RADIUS server. The four marked
compulsory must always be present.
Attribute Field Description / Example Required?
User-Name (1) Customer ID PPPoE username or ONU Serial No. (e.g. SYRO12345678) YES
User-Password (2) Password Customer login password (Cleartext-Password in radcheck) YES
NAS-IP-Address (4) OLT/BRAS IP IP of the device sending the request YES
NAS-Port-Id (87) Physical Location Format Slot/Card/Port:ONU_ID (e.g. 0/1/3:12) YES
NAS-Identifier (32) OLT Name Used for billing log grouping Recommended
Mikrotik-Rate-Limit (VSA) Speed Up/Down rate (e.g. 50M/50M) in radreply Plan-based
Vendor-Specific (26) VLAN/Speed S-VLAN, C-VLAN, DBA rate injection Plan-based
Framed-IP-Address (8) Static IP Only for static-IP subscribers Optional
Session-Timeout (27) Session Length Forces re-auth after N seconds Optional
Acct-Status-Type (40) Session State 1=Start, 2=Stop, 3=Interim-Update Accounting
Acct-Session-Id (44) Session ID Unique tracking string for each connection Accounting
Acct-Input-Octets (42) Upload Bytes received upstream from customer Accounting
Acct-Output-Octets (47) Download Bytes sent downstream to customer Accounting
SECTION 4 — OLT Management UI Interface Requirements
When a network admin opens the OLT module in the CRM, the screen must contain at minimum the four sections below. Each section is a
distinct UI component.
1. Add / Edit OLT (Form) 2. Live Status Dashboard
• OLT Name & Vendor Type • ONLINE / OFFLINE indicator
• Management IP & Port • Uptime clock
• Username & Password • Total Active ONUs (e.g. 846/1024)
• Protocol: SSH or Telnet • CPU & Memory utilization
• SNMP RO / RW Strings • Critical Signal Alert count (≤-27 dBm)
• Total PON Ports & Capacity • Rogue ONU detection counter
• VLAN Assignment
3. Subscriber Data Grid (Table) 4. Action Buttons (per Subscriber)
• Customer ID / Name • ↻ Reboot ONU
• PON Port Number • ⛔ Deactivate / Block
• ONU ID & Serial Number • ⚙ Sync / Change Profile
• Live Rx / Tx Power (dBm) • 🔍 View Optical History Graph
• Health Status Badge (color) • ✉ Notify Customer (SMS/Email)
• Last-mile Status (Connected/Loss)
• IP Address & Session Uptime
SECTION 5 — Optical Signal Health Rules
Fiber optical power (measured in dBm) determines service quality. The UI must color-code each subscriber based on the following
thresholds.
RX Power Range Status Color Meaning & Action
> -25.0 dBm GOOD Green Healthy fiber — no action needed.
-25.1 to -26.9 dBm WARNING Amber Fiber bending or dirty connector — schedule field check.
≤ -27.0 dBm CRITICAL Red Imminent signal loss — immediate alert + technician dispatch.
Developer Note (Scale Factor): OLTs return raw SNMP integers where -215 means -21.5 dBm. Always divide the raw integer by
10 before displaying it in graphs or tables.
Page 2 of 5 • OLT Management Module — Full Technical Guide • Confidential / Internal Use
SECTION 6 — RADIUS Database Schema (FreeRADIUS)
FreeRADIUS uses two standard tables. The CRM backend must insert/update rows in both whenever a customer is added, modified, or
suspended.
6.1 Authentication Table (radcheck)
Column Value Notes
username SYRO12345678 or cust_101 ONU Serial No. or Subscriber ID
attribute Cleartext-Password Or MD5-Password
op := Assignment operator
value secure_pass Customer login password
6.2 Authorization / Profile Table (radreply)
CRM Data RADIUS Attribute Example Value
Speed / Bandwidth Mikrotik-Rate-Limit 51200k/51200k (up/down)
VLAN Allocation Egress-VLANID / Framed-Pool 100 or VLAN-100-INTERNET
Static IP Framed-IP-Address [Link]
Session Control Session-Timeout 86400 (re-auth every 24h)
SECTION 7 — Multi-Vendor Driver Layer Architecture
Every OLT vendor shares the same underlying PON logic, but their CLI command syntax differs. To avoid rewriting code for each brand,
build a Driver Abstraction Layer. The CRM detects the vendor and loads the matching driver, which translates generic operations into
vendor-specific commands.
Generic API Call (e.g. register_onu, reboot_onu, set_vlan)
↓
OLT Driver Router (reads vendor_type from DB)
↓ ↓ ↓
SyrotechDriver VSOLDriver HuaweiDriver
↓ ↓ ↓
Vendor-specific CLI commands pushed over SSH/Telnet
7.1 Driver Class Template (Python Reference)
# Base driver — every vendor driver inherits this interface
class BaseOLTDriver:
def connect(self, ip, user, pwd, port): pass
def register_onu(self, pon_port, serial_number): pass
def set_vlan(self, onu_id, vlan): pass
def reboot_onu(self, onu_id): pass
def deactivate_onu(self, onu_id): pass
def disconnect(self): pass
class SyrotechDriver(BaseOLTDriver):
def register_onu(self, pon_port, serial_number):
[Link](f"interface pon 0/{pon_port}")
[Link](f"onu bind sn {serial_number}")
response = [Link].read_until_prompt()
return parse_onu_id(response) # e.g. returns 14
# Router selects driver based on stored vendor_type
def get_driver(vendor_type):
drivers = {"Syrotech": SyrotechDriver, "VSOL": VSOLDriver, "Huawei": HuaweiDriver}
return [Link](vendor_type, GenericDriver)()
SECTION 8 — CLI Command Reference (Vendor Comparison)
The same logical operation is expressed differently per vendor. Below is a quick comparison table for the most common provisioning tasks.
Operation Syrotech / Netlink / VSOL Huawei BDCOM
Enter PON port interface pon 0/3 interface gpon 0/1 interface gpon-olt_0/1/3
Register ONU onu bind sn SYRO1234 ont add 3 sn-auth SYRO1234 onu 1 type sn SYRO1234
Set VLAN onu vlan 15 c-vlan 100 port vlan 100 0/1/3 vlan-mode tag vlan 100
Deactivate onu deactivate port 3 onu 15 ont deactivate 3 15 onu deactive 1
Reboot ONU onu reboot port 3 onu 15 ont reset 3 15 onu reset 1
Caution: Commands above are illustrative — exact syntax varies by firmware version. Always validate against the target OLT's CLI
reference manual before deployment.
Page 3 of 5 • OLT Management Module — Full Technical Guide • Confidential / Internal Use
SECTION 10 — Mikrotik Core Router (BRAS) API Integration
The Mikrotik router is the BRAS/Gateway where PPPoE sessions and bandwidth shaping (queues) are enforced. The CRM connects via the
RouterOS API (port 8728 plaintext, 8729 SSL). This enables real-time secret creation, profile assignment, and session disconnection.
10.1 Mikrotik Routers Database Schema
CREATE TABLE mikrotik_routers (
id INT AUTO_INCREMENT PRIMARY KEY,
router_name VARCHAR(100) NOT NULL,
ip_address VARCHAR(45) NOT NULL,
api_port INT DEFAULT 8728,
api_username VARCHAR(50) NOT NULL,
api_password VARCHAR(255) NOT NULL, -- encrypted
pppoe_pool VARCHAR(100) DEFAULT 'pppoe-pool',
status ENUM('Online','Offline') DEFAULT 'Offline'
);
10.2 PPPoE Secret & Profile Creation (Python Reference)
import routeros_api
pool = routeros_api.RouterOsApiPool('[Link]', username='crm_api_user',
password='secure_password', port=8728)
api = pool.get_api()
# 1. Create bandwidth profile (auto-generates dynamic queue)
api.get_resource('/ppp/profile').add(
name='Plan_100Mbps', local_address='[Link]',
remote_address='pppoe-pool', rate_limit='100M/100M', only_one='yes')
# 2. Add the PPPoE subscriber secret
api.get_resource('/ppp/secret').add(
name='IND_DEL_8849', password='customer_pass',
service='pppoe', profile='Plan_100Mbps', comment='CRM_ID:8849')
[Link]()
10.3 Plan Expiry — Force Active Session Drop
# Find active session and terminate it instantly
active = api.get_resource('/ppp/active').get(name='IND_DEL_8849')
if active:
api.get_resource('/ppp/active').remove(id=active[0]['id'])
# Then change profile to Expired_Plan (rate-limit 64k/64k)
SECTION 11 — SNMP Live Monitoring Engine
To fetch real-time metrics from the OLT, use SNMP v2c/v3 with standard OIDs (Object Identifiers). Never hit the OLT directly from the UI
— it overloads the OLT CPU. Use a caching layer instead.
11.1 Core OIDs Reference
Monitoring Metric OID Returns
System Uptime .[Link].[Link].0 Uptime string; failed query = OFFLINE alert
Active ONU Count .[Link].4.1.3320.[Link] Integer of registered ONUs
Optical RX Power .[Link].4.1.3320.[Link].5.[ONU_INDEX] Raw int ÷10 = dBm
Optical TX Power .[Link].4.1.3320.[Link].6.[ONU_INDEX] Raw int ÷10 = dBm
CPU Utilization .[Link].4.1.3320.[Link] Percentage integer
11.2 Caching Architecture (Redis ↔ UI)
Physical OLT
↓ polled every 5 min by backend cron worker (pysnmp / net-snmp)
Redis Cache (stores fast key-value JSON snapshots)
↓ instant API load (<10 ms)
CRM UI Dashboard (React / Vue frontend)
Telemetry Storage: Persist polled snapshots in a olt_telemetry_logs table (columns: olt_id, total_online_onus,
cpu_utilization, memory_utilization, logged_at) to power historical analytics charts.
Page 4 of 5 • OLT Management Module — Full Technical Guide • Confidential / Internal Use
SECTION 12 — Full Provisioning Workflow (Step by Step)
This is the end-to-end automated pipeline that runs when a new customer is saved in the CRM. The backend must execute these steps in an
async queue (Celery / Redis / RabbitMQ) so the UI does not freeze.
Step 1 Admin enters customer + ONU SN + Plan in CRM form
↓
Step 2 CRM inserts local DB record (status = Pending_Activation)
+ inserts radcheck (User-Name, Password) + radreply (speed, VLAN)
↓
Step 3 Async worker picks up the job from the queue
↓
Step 4 Worker logs into target OLT (SSH/Telnet) via vendor driver
→ registers ONU by Serial Number → captures assigned ONU ID
→ maps VLAN → OLT pushes OMCI config to home ONU
↓
Step 5 (Optional) Worker calls Mikrotik API → creates PPPoE secret + queue
↓
Step 6 Customer ONU comes online → PPPoE/DHCP request
→ BRAS asks RADIUS → ACCESS-ACCEPT + speed pushed
↓
Step 7 CRM status flips to ACTIVE → ACCOUNTING-START sent
SECTION 13 — Suspension / Plan Expiry Workflow
When a customer's plan expires or bill is unpaid, the CRM triggers automated actions via CRON jobs or event listeners.
Layer Action Effect
RADIUS Replace speed attribute with Mikrotik-Rate-Limit = 64k/64k or move Customer gets redirect to payment page / very
user to Expired profile slow speed
Mikrotik Drop active session + change secret profile to Expired_Plan Instant disconnect on next login
OLT Send onu deactivate command ONU physically unregisters — optical LOS, full
(Hardware) block
Best Practice: Always suspend at the RADIUS layer first, then optionally at the OLT. Re-enabling a deactivated ONU takes longer
than flipping a RADIUS profile.
SECTION 14 — Testing & Quality Assurance
Test How to Verify
DBA capacity Ensure sum of ASSURED_BW across all ONUs does not exceed line rate (2.488 Gbps GPON / 9.953 Gbps XGS-PON)
MIB consistency Dump OMCI MIB — verify gem_port IDs match assigned values
Driver fallback Send an unknown vendor — confirm GenericDriver loads without crash
SNMP scale factor Confirm raw -215 displays as -21.5 dBm in UI
Suspension rollback Recharge expired user — confirm speed restored & session re-enabled
✅ Compulsory Developer Checklist
• Each OLT stores its own IP, credentials, and port separately in the DB.
• Speed Profiles (DBA) and VLAN Schemes are created once as Global Templates and assigned per OLT.
• A Driver Abstraction Layer maps each vendor to its CLI syntax.
• All OLT commands run through an Async Queue (Redis / Celery) — UI never blocks.
• Connection Pooling is used so every request does not open a new SSH/Telnet session.
• CLI output is wrapped in try-catch error parsing (e.g. "SN already exists").
• RADIUS sync always sets the 4 compulsory attributes: User-Name, User-Password, NAS-IP-Address, NAS-Port-Id.
• SNMP data is cached in Redis and polled every ~5 min, never queried live from the UI.
• Expiry flow suspends at RADIUS first (64k/64k), then optionally deactivates at the OLT.
• All passwords (OLT, RADIUS, Mikrotik API) are encrypted at rest in the database.
Page 5 of 5 • OLT Management Module — Full Technical Guide • Confidential / Internal Use