What is TR-069? CWMP and the ACS explained
Updated
TR-069 in one paragraph
TR-069 is a Broadband Forum standard, also called CWMP (CPE WAN Management Protocol), for managing customer equipment remotely. Each device (the CPE) is given the address of an auto-configuration server (the ACS). The device calls the ACS over HTTP or HTTPS, and the ACS reads and writes its settings with SOAP messages.
The Inform
Every session starts with the device sending an Inform: its manufacturer, OUI, product class and serial number, why it is calling (0 BOOTSTRAP, 1 BOOT, 2 PERIODIC, 6 CONNECTION REQUEST and others), and a few parameters such as its firmware version. The ACS answers with an InformResponse.
Sessions and commands
After the Inform, the device sends an empty POST to ask for work. The ACS replies with one RPC, such as GetParameterValues, SetParameterValues, Reboot, FactoryReset or Download, and the device answers it. This repeats until the ACS replies with an empty 204, which ends the session.
Periodic Inform and Connection Requests
Devices call in on a schedule (the PeriodicInformInterval). To make a device call now, the ACS sends a Connection Request: an HTTP GET to a small server on the device, usually on port 7547, authenticated with a login the ACS set. Devices behind NAT often cannot be reached this way, so they collect commands at their next periodic Inform.
TR-098 and TR-181
Parameters live in a tree. Older gateways use TR-098, rooted at InternetGatewayDevice. (for example InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.SSID). Newer devices use TR-181, rooted at Device. (for example Device.WiFi.SSID.1.SSID). A good ACS detects which one a device speaks from its first Inform.
Security
The device authenticates to the ACS with HTTP Digest or Basic, ideally over HTTPS. The ACS authenticates its Connection Requests to the device the same way. FreeACS accepts Basic only over HTTPS, because Basic sends the password itself.
Get your ACS login
Start free