Skip to content

Commit 7b36443

Browse files
nanomadnanomad
authored
Add ZTE F2801S (#213)
* Add ZTE F2801S * Cleanup table layout
1 parent 85d9e18 commit 7b36443

4 files changed

Lines changed: 277 additions & 0 deletions

File tree

‎_ont_xgs/ont-zte-f2801s.md‎

Lines changed: 272 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,272 @@
1+
---
2+
title: ZTE F2801S
3+
has_children: false
4+
layout: default
5+
parent: ZTE
6+
---
7+
8+
# Hardware Specifications
9+
| | |
10+
|--------------|----------------------------------|
11+
| Vendor/Brand | ZTE |
12+
| Model | F2801Sv2 |
13+
| ODM | ✅ |
14+
| CPU | |
15+
| CPU Clock | |
16+
| Chipset | |
17+
| Flash | |
18+
| RAM | |
19+
| System | |
20+
| 10GBaseT | Yes |
21+
| Optics | SC/APC |
22+
| IP address | 192.168.1.1 |
23+
| Web Gui | ✅ user `admin`, password `admin` |
24+
| SSH | |
25+
| Telnet | ✅ [^1] |
26+
| Serial | ✅ |
27+
| Form Factor | ONT |
28+
29+
{% include image.html file="f2801s/front.jpg" alt="F2801S front plate" caption="F2801S front plate" %}
30+
{% include image.html file="f2801s/internal.jpg" alt="F2801S internal" caption="F2801S internal layout" %}
31+
32+
33+
## List of software versions
34+
### HW V2.0
35+
- V2.0.10P7N1 (OpenFiber)
36+
- V2.0.10P7N2 (OpenFiber)
37+
38+
## List of partitions
39+
40+
### HW V2.0
41+
42+
| dev | size | erasesize | name |
43+
| ---- | -------- | --------- | ---------------- |
44+
| mtd0 | 08000000 | 00020000 | "whole flash" |
45+
| mtd1 | 00200000 | 00020000 | "u-boot" |
46+
| mtd2 | 00400000 | 00020000 | "others" |
47+
| mtd3 | 00400000 | 00020000 | "parameter tags" |
48+
| mtd4 | 00400000 | 00020000 | "wlan" |
49+
| mtd5 | 00800000 | 00020000 | "usercfg" |
50+
| mtd6 | 00400000 | 00020000 | "middle" |
51+
| mtd7 | 02a00000 | 00020000 | "kernel1" |
52+
| mtd8 | 02a00000 | 00020000 | "kernel2" |
53+
| mtd9 | 029e0000 | 00020000 | "rootfs" |
54+
55+
56+
This ONT supports dual boot, as visible from the presence of `kernel1` and `kernel2`, which contain the rootfs.
57+
The boot image can be swapped with the following command:
58+
59+
```sh
60+
upgradetest switchver X
61+
```
62+
63+
Where `X` can be `0/1` based on the image you want to boot.
64+
65+
66+
You can also clone the currently running image into other slot using this command:
67+
68+
```sh
69+
syn_version
70+
```
71+
72+
# Use
73+
{% include alert.html content="Commands have been tested on V2 HW rev. on OpenFiber firmwares" alert="Note" icon="svg-info" color="blue" %}
74+
75+
## Enable Telnet
76+
{% include alert.html content="This is an external script ([ZTE Telnet enabled](https://github.com/douniwan5788/zte_modem_tools)), so use it at your own risk! Credential doesn't survive at reboot!" alert="Note" icon="svg-info" color="blue" %}
77+
78+
```sh
79+
python3 zte_factroymode.py --user admin --pass admin --ip 192.168.1.1 --port 80 telnet open
80+
```
81+
82+
You should get this output and credentials to login over telnet:
83+
84+
```sh
85+
trying user:"admin" pass:"admin"
86+
reset facTelnetSteps:
87+
reset OK!
88+
89+
facStep 1:
90+
OK!
91+
92+
facStep 2:
93+
OK!
94+
95+
facStep 3:
96+
OK!
97+
98+
facStep 4:
99+
OK!
100+
101+
facStep 5:
102+
OK!
103+
104+
done
105+
Username: 2W3iqFVt
106+
Password: Eqb8X8Qt
107+
```
108+
109+
## Enable console redirection
110+
111+
To see omcidebug messages on Telnet you need to execute this command (just the first time of each connection):
112+
113+
```sh
114+
redir printf
115+
```
116+
117+
# GPON ONU status
118+
119+
## Get the operational status of the ONU
120+
121+
To see the connection state use the following command:
122+
```
123+
gpontest -gstate
124+
```
125+
`[gpontest] gpon state is [O5]` for O5 state
126+
127+
## Get information of the OLT vendor
128+
129+
```sh
130+
sendcmd 132 omcidebug showmedata 131
131+
```
132+
133+
This command will print out the result like this one:
134+
135+
```sh
136+
##################################
137+
MIB INFO:
138+
ME CLASS: 131
139+
DB NAME: olt_g, DBHandle: 32
140+
##################################
141+
142+
<-----MeID[ 0x0000,0 ], Addr[ 0x19a2b1]----->
143+
Vendorid:48 57 54 43
144+
EquipmentID:00 00 00 00 00 00 00 00 00 00
145+
00 00 00 00 00 00 00 00 00 00
146+
Version:31 30 00 00 00 00 00 00 00 00
147+
00 00 00 00
148+
TimeofDay:00 00 00 00 00 00 00 00 00 00
149+
00 00 00 00
150+
---------------------------------------------------------------------
151+
```
152+
153+
## Querying a particular OMCI ME
154+
155+
```sh
156+
sendcmd 132 omcidebug showmedata ID_MIB (eg. 7 for Firmware version)
157+
```
158+
159+
This command will print out a result like this one:
160+
161+
```sh
162+
163+
##################################
164+
MIB INFO:
165+
ME CLASS: 7
166+
DB NAME: soft_image, DBHandle: 14
167+
##################################
168+
169+
<-----MeID[ 0x0000,0 ], Addr[ 0x19a011]----->
170+
Version:V6.0.10N41
171+
Is committed:01
172+
Is active:01
173+
Is valid:01
174+
175+
<-----MeID[ 0x0001,1 ], Addr[ 0x19a031]----->
176+
Version:V6.0.10N39
177+
Is committed:00
178+
Is active:00
179+
Is valid:01
180+
---------------------------------------------------------------------
181+
```
182+
183+
# GPON/OMCI settings
184+
185+
## Setting ONU GPON Serial Number
186+
187+
{% include alert.html content="You have to change S/N and the VID. 2176 is for the VID (first 4 letters of the S/N) and 2177 is for the last 8 digits of the S/N" alert="Note" icon="svg-info" color="blue" %}
188+
```sh
189+
setmac 1 2176 ZTEG
190+
setmac 1 2177 AABBCCDD
191+
```
192+
193+
## Setting ONU GPON PLOAM password
194+
195+
{% include alert.html content="The PLOAM password is stored in the ASCII format." alert="Note" icon="svg-info" color="blue" %}
196+
This can be done easily via web ui. If you prefer to do it via the shell use:
197+
```sh
198+
setmac 1 2181 1234567890
199+
setmac 1 2178 1234567890
200+
```
201+
202+
# Advanced settings
203+
204+
## Backup ONT Paritions for HW\SW Version Mod
205+
206+
This step is suggested if you want to replace firmware on your ONT to spoof HW and SW version:
207+
208+
Needed tools:
209+
210+
- Linux VM or WSL with Python >3.3
211+
- [ZTE Telnet enabled](https://github.com/douniwan5788/zte_modem_tools)
212+
- TFTP server
213+
214+
First step is to login over telnet with `zte_factroymode.py` then execute ALL this command for a full backup:
215+
216+
**Go to `/tmp` folder to create tmp files**
217+
218+
```sh
219+
cd /tmp
220+
```
221+
222+
**Dump and transfer all mtd **
223+
224+
Here 192.168.1.2 is the IP of the machine running the TFTP server, change it as needed
225+
226+
```sh
227+
cat /dev/mtd1 > u-boot.bin && tftp -l u-boot.bin -r u-boot.bin -p 192.168.1.2 && rm u-boot.bin
228+
cat /dev/mtd2 > others.bin && tftp -l others.bin -r others.bin -p 192.168.1.2 && rm others.bin
229+
cat /dev/mtd3 > parameter_tags.bin && tftp -l parameter_tags.bin -r parameter_tags.bin -p 192.168.1.2 && rm parameter_tags.bin
230+
cat /dev/mtd4 > wlan.bin && tftp -l wlan.bin -r wlan.bin -p 192.168.1.2 && rm wlan.bin
231+
cat /dev/mtd5 > usercfg.bin && tftp -l usercfg.bin -r usercfg.bin -p 192.168.1.2 && rm usercfg.bin
232+
cat /dev/mtd6 > middle.bin && tftp -l middle.bin -r middle.bin -p 192.168.1.2 && rm middle.bin
233+
cat /dev/mtd7 > kernel1.bin && tftp -l kernel1.bin -r kernel1.bin -p 192.168.1.2 && rm kernel1.bin
234+
cat /dev/mtd8 > kernel2.bin && tftp -l kernel2.bin -r kernel2.bin -p 192.168.1.2 && rm kernel2.bin
235+
cat /dev/mtd9 > rootfs.bin && tftp -l rootfs.bin -r rootfs.bin -p 192.168.1.2 && rm rootfs.bin
236+
237+
```
238+
239+
## Change region code
240+
241+
{% include alert.html content="Be aware that changing the region code may break features such as PPPoE depending on your ISP" alert="Note" icon="svg-info" color="blue" %}
242+
243+
ZTE has created various region codes that load default values based on the local ISP. This configuration can be changed using this command:
244+
245+
```sh
246+
upgradetest sfactoryconf X
247+
```
248+
249+
Where X is the number of supported regioncode into file `/etc/init.d/regioncode`, here is an example from OpenFiber `V2.0.10P7N2` firmware:
250+
251+
```sh
252+
# cat /etc/init.d/regioncode
253+
19:Turkey
254+
65:FTOrange
255+
116:Tescali
256+
139:Multilaser
257+
188:HollandKpnSfu
258+
198:Manufacture
259+
2010:Cetin
260+
```
261+
262+
# Random notes
263+
- F2801S reads the software version exposed thru gpon_omci deamon from each kernel partition's header, so only way to spoof this parameter is to change the version in the header and recalculate CRC, otherwise bootloader refuse to load image
264+
265+
# Miscellaneous Links
266+
267+
- [ZTE Telnet enabled](https://github.com/douniwan5788/zte_modem_tools)
268+
269+
---
270+
271+
[^1]: It may be possible to flash an alternative firmware to avoid running the `zte_factory.py` script each time.
272+
[^2]: Credentials are randomly generated by zte_factroymode.py. They don't survive at reboot

‎_ont_xgs/ont-zte.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
title: ZTE
3+
has_children: true
4+
layout: default
5+
---

‎assets/img/f2801s/front.jpg‎

150 KB
Loading

‎assets/img/f2801s/internal.jpg‎

96.9 KB
Loading

0 commit comments

Comments
 (0)