1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
|
---
title: ZTE F2801S
has_children: false
layout: default
parent: ZTE
---
# Hardware Specifications
| | |
|--------------|----------------------------------|
| Vendor/Brand | ZTE |
| Model | F2801Sv2 |
| ODM | ✅ |
| CPU | |
| CPU Clock | |
| Chipset | |
| Flash | |
| RAM | |
| System | |
| 10GBaseT | Yes |
| Optics | SC/APC |
| IP address | 192.168.1.1 |
| Web Gui | ✅ user `admin`, password `admin` |
| SSH | |
| Telnet | ✅ [^1] |
| Serial | ✅ |
| Form Factor | ONT |
{% include image.html file="f2801s/front.jpg" alt="F2801S front plate" caption="F2801S front plate" %}
{% include image.html file="f2801s/internal.jpg" alt="F2801S internal" caption="F2801S internal layout" %}
## List of software versions
### HW V2.0
- V2.0.10P7N1 (OpenFiber)
- V2.0.10P7N2 (OpenFiber)
## List of partitions
### HW V2.0
| dev | size | erasesize | name |
| ---- | -------- | --------- | ---------------- |
| mtd0 | 08000000 | 00020000 | "whole flash" |
| mtd1 | 00200000 | 00020000 | "u-boot" |
| mtd2 | 00400000 | 00020000 | "others" |
| mtd3 | 00400000 | 00020000 | "parameter tags" |
| mtd4 | 00400000 | 00020000 | "wlan" |
| mtd5 | 00800000 | 00020000 | "usercfg" |
| mtd6 | 00400000 | 00020000 | "middle" |
| mtd7 | 02a00000 | 00020000 | "kernel1" |
| mtd8 | 02a00000 | 00020000 | "kernel2" |
| mtd9 | 029e0000 | 00020000 | "rootfs" |
This ONT supports dual boot, as visible from the presence of `kernel1` and `kernel2`, which contain the rootfs.
The boot image can be swapped with the following command:
```sh
upgradetest switchver X
```
Where `X` can be `0/1` based on the image you want to boot.
You can also clone the currently running image into other slot using this command:
```sh
syn_version
```
# Use
{% include alert.html content="Commands have been tested on V2 HW rev. on OpenFiber firmwares" alert="Note" icon="svg-info" color="blue" %}
## Enable Telnet
{% include alert.html content="This is an external script ([ZTE Telnet enabled](https://github.com/douniwan5788/zte_modem_tools)), so use it at your own risk! Credential doesn't survive at reboot!" alert="Note" icon="svg-info" color="blue" %}
```sh
python3 zte_factroymode.py --user admin --pass admin --ip 192.168.1.1 --port 80 telnet open
```
You should get this output and credentials to login over telnet:
```sh
trying user:"admin" pass:"admin"
reset facTelnetSteps:
reset OK!
facStep 1:
OK!
facStep 2:
OK!
facStep 3:
OK!
facStep 4:
OK!
facStep 5:
OK!
done
Username: 2W3iqFVt
Password: Eqb8X8Qt
```
## Enable console redirection
To see omcidebug messages on Telnet you need to execute this command (just the first time of each connection):
```sh
redir printf
```
# GPON ONU status
## Get the operational status of the ONU
To see the connection state use the following command:
```
gpontest -gstate
```
`[gpontest] gpon state is [O5]` for O5 state
## Get information of the OLT vendor
```sh
sendcmd 132 omcidebug showmedata 131
```
This command will print out the result like this one:
```sh
##################################
MIB INFO:
ME CLASS: 131
DB NAME: olt_g, DBHandle: 32
##################################
<-----MeID[ 0x0000,0 ], Addr[ 0x19a2b1]----->
Vendorid:48 57 54 43
EquipmentID:00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
Version:31 30 00 00 00 00 00 00 00 00
00 00 00 00
TimeofDay:00 00 00 00 00 00 00 00 00 00
00 00 00 00
---------------------------------------------------------------------
```
## Querying a particular OMCI ME
```sh
sendcmd 132 omcidebug showmedata ID_MIB (eg. 7 for Firmware version)
```
This command will print out a result like this one:
```sh
##################################
MIB INFO:
ME CLASS: 7
DB NAME: soft_image, DBHandle: 14
##################################
<-----MeID[ 0x0000,0 ], Addr[ 0x19a011]----->
Version:V6.0.10N41
Is committed:01
Is active:01
Is valid:01
<-----MeID[ 0x0001,1 ], Addr[ 0x19a031]----->
Version:V6.0.10N39
Is committed:00
Is active:00
Is valid:01
---------------------------------------------------------------------
```
# GPON/OMCI settings
## Setting ONU GPON Serial Number
{% include alert.html content="You have to change S/N and the VID. 2176 is for the VID (first 4 letters of the S/N) and 2177 is for the last 8 digits of the S/N" alert="Note" icon="svg-info" color="blue" %}
```sh
setmac 1 2176 ZTEG
setmac 1 2177 AABBCCDD
```
## Setting ONU GPON PLOAM password
{% include alert.html content="The PLOAM password is stored in the ASCII format." alert="Note" icon="svg-info" color="blue" %}
This can be done easily via web ui. If you prefer to do it via the shell use:
```sh
setmac 1 2181 1234567890
setmac 1 2178 1234567890
```
# Advanced settings
## Backup ONT Paritions for HW\SW Version Mod
This step is suggested if you want to replace firmware on your ONT to spoof HW and SW version:
Needed tools:
- Linux VM or WSL with Python >3.3
- [ZTE Telnet enabled](https://github.com/douniwan5788/zte_modem_tools)
- TFTP server
First step is to login over telnet with `zte_factroymode.py` then execute ALL this command for a full backup:
**Go to `/tmp` folder to create tmp files**
```sh
cd /tmp
```
**Dump and transfer all mtd **
Here 192.168.1.2 is the IP of the machine running the TFTP server, change it as needed
```sh
cat /dev/mtd1 > u-boot.bin && tftp -l u-boot.bin -r u-boot.bin -p 192.168.1.2 && rm u-boot.bin
cat /dev/mtd2 > others.bin && tftp -l others.bin -r others.bin -p 192.168.1.2 && rm others.bin
cat /dev/mtd3 > parameter_tags.bin && tftp -l parameter_tags.bin -r parameter_tags.bin -p 192.168.1.2 && rm parameter_tags.bin
cat /dev/mtd4 > wlan.bin && tftp -l wlan.bin -r wlan.bin -p 192.168.1.2 && rm wlan.bin
cat /dev/mtd5 > usercfg.bin && tftp -l usercfg.bin -r usercfg.bin -p 192.168.1.2 && rm usercfg.bin
cat /dev/mtd6 > middle.bin && tftp -l middle.bin -r middle.bin -p 192.168.1.2 && rm middle.bin
cat /dev/mtd7 > kernel1.bin && tftp -l kernel1.bin -r kernel1.bin -p 192.168.1.2 && rm kernel1.bin
cat /dev/mtd8 > kernel2.bin && tftp -l kernel2.bin -r kernel2.bin -p 192.168.1.2 && rm kernel2.bin
cat /dev/mtd9 > rootfs.bin && tftp -l rootfs.bin -r rootfs.bin -p 192.168.1.2 && rm rootfs.bin
```
## Change region code
{% include alert.html content="Be aware that changing the region code may break features such as PPPoE depending on your ISP" alert="Note" icon="svg-info" color="blue" %}
ZTE has created various region codes that load default values based on the local ISP. This configuration can be changed using this command:
```sh
upgradetest sfactoryconf X
```
Where X is the number of supported regioncode into file `/etc/init.d/regioncode`, here is an example from OpenFiber `V2.0.10P7N2` firmware:
```sh
# cat /etc/init.d/regioncode
19:Turkey
65:FTOrange
116:Tescali
139:Multilaser
188:HollandKpnSfu
198:Manufacture
2010:Cetin
```
# Random notes
- F2801S reads the software version exposed thru gpon_omci deamon from each kernel partition's header, so only way to spoof this parameter is to change the version in the header and recalculate CRC, otherwise bootloader refuse to load image
# Miscellaneous Links
- [ZTE Telnet enabled](https://github.com/douniwan5788/zte_modem_tools)
---
[^1]: It may be possible to flash an alternative firmware to avoid running the `zte_factory.py` script each time.
[^2]: Credentials are randomly generated by zte_factroymode.py. They don't survive at reboot
|
