Hardware Specifications

| | | |————–|———————————-| | Vendor/Brand | ZTE | | Model | F2801Sv2 | | ODM | ✅ | | CPU | | | CPU Clock | | | Chipset | | | Flash | | | RAM | | | System | | | 10GBaseT | Yes | | Optics | SC/APC | | IP address | 192.168.1.1 | | Web Gui | ✅ user admin, password admin | | SSH | | | Telnet | ✅ ¹ | | Serial | ✅ | | Form Factor | ONT |

List of software versions

HW V2.0

V2.0.10P7N1 (OpenFiber)
V2.0.10P7N2 (OpenFiber)

List of partitions

HW V2.0

dev	size	erasesize	name
mtd0	08000000	00020000	“whole flash”
mtd1	00200000	00020000	“u-boot”
mtd2	00400000	00020000	“others”
mtd3	00400000	00020000	“parameter tags”
mtd4	00400000	00020000	“wlan”
mtd5	00800000	00020000	“usercfg”
mtd6	00400000	00020000	“middle”
mtd7	02a00000	00020000	“kernel1”
mtd8	02a00000	00020000	“kernel2”
mtd9	029e0000	00020000	“rootfs”

This ONT supports dual boot, as visible from the presence of kernel1 and kernel2, which contain the rootfs. The boot image can be swapped with the following command:

upgradetest switchver X

Where X can be 0/1 based on the image you want to boot.

You can also clone the currently running image into other slot using this command:

syn_version

Use

Note Commands have been tested on V2 HW rev. on OpenFiber firmwares

Enable Telnet

Note This is an external script (ZTE Telnet enabled), so use it at your own risk! Credential doesn’t survive at reboot!

python3 zte_factroymode.py --user admin --pass admin --ip 192.168.1.1 --port 80 telnet open

You should get this output and credentials to login over telnet:

trying  user:"admin" pass:"admin"
reset facTelnetSteps:
reset OK!

facStep 1:
OK!

facStep 2:
OK!

facStep 3:
OK!

facStep 4:
OK!

facStep 5:
OK!

done
Username: 2W3iqFVt
Password: Eqb8X8Qt

Enable console redirection

To see omcidebug messages on Telnet you need to execute this command (just the first time of each connection):

redir printf

GPON ONU status

Get the operational status of the ONU

To see the connection state use the following command:

gpontest -gstate

[gpontest] gpon state is [O5] for O5 state

Get information of the OLT vendor

sendcmd 132 omcidebug showmedata 131

This command will print out the result like this one:

##################################
MIB INFO:
         ME CLASS: 131
         DB NAME: olt_g, DBHandle: 32
##################################

<-----MeID[ 0x0000,0 ], Addr[ 0x19a2b1]----->
         Vendorid:48 57 54 43
      EquipmentID:00 00 00 00 00 00 00 00 00 00
                    00 00 00 00 00 00 00 00 00 00
          Version:31 30 00 00 00 00 00 00 00 00
                    00 00 00 00
        TimeofDay:00 00 00 00 00 00 00 00 00 00
                    00 00 00 00
---------------------------------------------------------------------

Querying a particular OMCI ME

sendcmd 132 omcidebug showmedata ID_MIB (eg. 7 for Firmware version)

This command will print out a result like this one:

##################################
MIB INFO:
         ME CLASS: 7
         DB NAME: soft_image, DBHandle: 14
##################################

<-----MeID[ 0x0000,0 ], Addr[ 0x19a011]----->
          Version:V6.0.10N41
     Is committed:01
        Is active:01
         Is valid:01

<-----MeID[ 0x0001,1 ], Addr[ 0x19a031]----->
          Version:V6.0.10N39
     Is committed:00
        Is active:00
         Is valid:01
---------------------------------------------------------------------

GPON/OMCI settings

Setting ONU GPON Serial Number

Note You have to change S/N and the VID. 2176 is for the VID (first 4 letters of the S/N) and 2177 is for the last 8 digits of the S/N

setmac 1 2176 ZTEG
setmac 1 2177 AABBCCDD

Setting ONU GPON PLOAM password

Note The PLOAM password is stored in the ASCII format.

This can be done easily via web ui. If you prefer to do it via the shell use:

setmac 1 2181 1234567890
setmac 1 2178 1234567890

Advanced settings

Backup ONT Paritions for HW\SW Version Mod

This step is suggested if you want to replace firmware on your ONT to spoof HW and SW version:

Needed tools:

Linux VM or WSL with Python >3.3
ZTE Telnet enabled
TFTP server

First step is to login over telnet with zte_factroymode.py then execute ALL this command for a full backup:

Go to /tmp folder to create tmp files

cd /tmp

**Dump and transfer all mtd **

Here 192.168.1.2 is the IP of the machine running the TFTP server, change it as needed

cat /dev/mtd1 > u-boot.bin && tftp -l u-boot.bin -r u-boot.bin -p 192.168.1.2 && rm u-boot.bin
cat /dev/mtd2 > others.bin && tftp -l others.bin -r others.bin -p 192.168.1.2 && rm others.bin
cat /dev/mtd3 > parameter_tags.bin && tftp -l parameter_tags.bin -r parameter_tags.bin -p 192.168.1.2 && rm parameter_tags.bin
cat /dev/mtd4 > wlan.bin && tftp -l wlan.bin -r wlan.bin -p 192.168.1.2 && rm wlan.bin
cat /dev/mtd5 > usercfg.bin && tftp -l usercfg.bin -r usercfg.bin -p 192.168.1.2 && rm usercfg.bin
cat /dev/mtd6 > middle.bin && tftp -l middle.bin -r middle.bin -p 192.168.1.2 && rm middle.bin
cat /dev/mtd7 > kernel1.bin && tftp -l kernel1.bin -r kernel1.bin -p 192.168.1.2 && rm kernel1.bin
cat /dev/mtd8 > kernel2.bin && tftp -l kernel2.bin -r kernel2.bin -p 192.168.1.2 && rm kernel2.bin
cat /dev/mtd9 > rootfs.bin && tftp -l rootfs.bin -r rootfs.bin -p 192.168.1.2 && rm rootfs.bin

Change region code

Note Be aware that changing the region code may break features such as PPPoE depending on your ISP

ZTE has created various region codes that load default values based on the local ISP. This configuration can be changed using this command:

upgradetest sfactoryconf X

Where X is the number of supported regioncode into file /etc/init.d/regioncode, here is an example from OpenFiber V2.0.10P7N2 firmware:

# cat /etc/init.d/regioncode
Turkey
FTOrange
Tescali
Multilaser
HollandKpnSfu
Manufacture
Cetin

Random notes

F2801S reads the software version exposed thru gpon_omci deamon from each kernel partition’s header, so only way to spoof this parameter is to change the version in the header and recalculate CRC, otherwise bootloader refuse to load image

Miscellaneous Links

ZTE Telnet enabled

It may be possible to flash an alternative firmware to avoid running the zte_factory.py script each time. ↩