A production TR-069 and TR-369 ACS — on the same graph as the subscriber.
The Netxol ACS ships with NMM. It handles CWMP for legacy CPE, USP (TR-369) with MQTT and WebSocket for modern devices, TR-181 device modelling, TR-143 speed tests, zero-touch onboarding by service profile and a firmware repository with staged rollouts and rollback. And because it lives on the shared graph, a CPE change and a subscriber-plan change are the same conversation.
FTTH and WISP operators comparing a standalone ACS against a platform-integrated one — moving off GenieACS, Incognito, HDM or a vendor-locked ACS.
For years the ISP industry has treated the ACS as a separate application — a server on its own database, with its own login, standing next to the NMS, the CRM and the billing tool. That separation is why zero-touch is still hard: the ACS knows the CPE, but not who the customer is, not what plan they bought, not which OLT port they land on.
The Netxol ACS is a first-class part of NMM. It implements TR-069 (CWMP) and TR-369 (USP) at production quality, with MQTT and WebSocket transports so USP interactions are event-driven instead of polled. The TR-181 device model is honoured; vendor-specific extensions are handled through an adapter framework, so a new CPE model is a plugin, not a release.
The commercial payoff is zero-touch provisioning done right. A device shipped to a subscriber phones home to the ACS, authenticates, discovers its purchased service profile, downloads its configuration and is live — typically inside 15 minutes of unbox — without a truck roll. Firmware campaigns roll out canary → 1% → 100% with automatic rollback if the health signal degrades.
And because the CPE, the subscriber, the invoice and the OLT port all reference the same identity on the shared graph, an ACS action is contextual by default. A firmware campaign that finds a bad batch names the affected customers automatically. A subscriber calling care sees their CPE state instantly, without an integration bridge.
Four moves.
Turn on TR-069 and TR-369
CWMP for legacy CPE, USP (MQTT/WebSocket) for modern devices — both live in the same server.
Wire zero-touch to service profiles
CPE authenticates → CRM plan is read → templated configuration is applied → device is live. No manual step.
Stage firmware campaigns safely
Canary → 1% → 100% rollout with automated rollback on health regression. Every step is auditable.
Share the graph across care and billing
The CPE lives on the same subscriber record CRM and Billing see — no bridge, no export, no drift.
Every CPE, every protocol, every vendor.
The Netxol ACS is not a thin wrapper over an open-source ACS engine. It is a first-class module inside NMM with TR-069 and TR-369 co-implemented, TR-181 device modelling, TR-143 diagnostics, a vendor adapter framework, a firmware repository and staged rollout campaigns, and a multi-tenant model that runs several operator brands against the same server. The sections below break each of those pieces down.
TR-069 (CWMP) — every legacy CPE you already own
Netxol implements the Broadband Forum TR-069 / CWMP protocol (Client / Server), including all standard RPCs: Inform, GetParameterValues, SetParameterValues, GetParameterNames, GetParameterAttributes, SetParameterAttributes, AddObject, DeleteObject, Download, Upload, Reboot, FactoryReset, ScheduleInform, ChangeDUState, ScheduleDownload and Autonomous Transfer notifications. Session pooling handles the connection re-establishment traffic without hammering ACS bandwidth. Legacy CPE that only speaks CWMP works on day one with no code change.
- All standard CWMP RPCs implemented
- TR-069 amendments 1 to 6 supported
- Session pooling for very large estates
- HTTPS transport with TLS 1.3
- Connection request via TR-069 or STUN
TR-369 (USP) — the modern successor, event-driven
TR-369 (User Services Platform) is the successor to TR-069. Netxol implements the full USP Agent / Controller model with MQTT and WebSocket transports, so CPE can push events (subscription-based) rather than being polled — a materially better signal for a large estate where polling every CPE every minute is not viable. MQTT broker is embedded; WebSocket support for lightweight CPE. USP notifications feed the shared graph in real time.
- USP Agent + Controller full model
- MQTT broker embedded (Mosquitto-compatible)
- WebSocket transport for lightweight CPE
- Event-driven — no polling storms
- STOMP / CoAP support on roadmap
TR-181 device data model + vendor adapters
The TR-181 data model (Device:2 root object) is the standard vocabulary — LAN interfaces, WAN interfaces, Wi-Fi radios, Ethernet ports, IP forwarding tables, DNS resolvers, DHCP servers, QoS policies, VoIP. Netxol implements the full published tree and extends it via a vendor adapter framework: a Huawei-specific extension goes into a Huawei adapter plugin, not into the core ACS release. Adding a new CPE model that talks a proprietary parameter tree is a plugin drop, not a source patch.
- Full TR-181 (Device:2) implementation
- Vendor adapter plugin framework
- Ships with adapters for major vendors
- Custom adapters authored in TypeScript
- Adapter marketplace on roadmap
TR-143 diagnostics — speed and latency from the CPE
The TR-143 diagnostic RPCs give NMM the ability to run a speed test, a UDP echo test, a TCP throughput test and a ping test from any CPE, on demand or on a schedule. Combined with the OLT / edge measurements NMM already collects, this closes the loop on subscriber-experience diagnostics: when a subscriber calls saying "internet is slow", the diagnostic runs from their CPE against your edge — not against a random public server.
- Download / Upload throughput tests
- UDP echo & TCP throughput
- Ping / IP ping / traceroute
- Scheduled or on-demand
- Results land on subscriber record
Zero-touch provisioning — the operational payoff
A device shipped to a subscriber phones home to the ACS, authenticates against the pre-registered inventory (serial + MAC + manufacturer OUI), reads its purchased service profile from the CRM record on the shared graph, downloads its templated configuration (SSIDs, PSKs, VLANs, QoS, VoIP credentials, TR-069 URLs), and is live — typically inside 15 minutes of unbox, without a truck roll. In mature operators, zero-touch is the default install path; truck-roll installs are the exception.
- Serial + MAC + OUI pre-registration
- Service profile pulled from CRM
- Templated configuration by tier
- Auto Wi-Fi SSID / PSK generation
- VoIP credentials provisioned in the same flow
Firmware campaigns — canary, ramp, rollback
Every operator has been burned by a bad firmware release. Netxol treats firmware distribution as a campaign: pick a candidate build; ring 0 is 10 test devices in the lab; ring 1 is 1% of the estate; ring 2 is 10%; ring 3 is 100%. Between rings, the health signal (CPE crash counter, PON drop rate, session churn, subscriber complaint tickets) is watched. A regression triggers automatic rollback of the not-yet-completed rings. Every step, every device, every rollback is audited.
- Ring-based canary rollout
- Automatic rollback on health regression
- Full audit trail per device
- Grouped by CPE model / firmware family
- Rollback per subscriber, per model, or estate-wide
Supported CPE catalog
Netxol ACS ships with tested adapters for the CPE brands operators actually run: Huawei (HG series, EG series, Optixstar), ZTE (F600, F660, F670L, F680, F6600), FiberHome (HG6145, HG6543, AN5506), Nokia (G-140W, G-1425G, G-2425G), Genexis (Pulse, Live), Tenda (HG9), TP-Link (HX510, XC220), Zyxel (PMG5622), Cambium (cnPilot, ePMP), Ubiquiti (UniFi UAP, EdgeRouter), MikroTik (RouterOS with TR-069 client), and the reference USP-Agent open implementations. New models are added continuously.
- Huawei HG / EG / Optixstar
- ZTE F600 / F660 / F670L / F680 / F6600
- FiberHome HG6145 / HG6543 / AN5506
- Nokia G-140W / G-1425G / G-2425G
- Genexis, Tenda, TP-Link, Zyxel
- Cambium, Ubiquiti, MikroTik
- Reference USP-Agent implementations
Migrating off GenieACS, Incognito or HDM
Most operators land at Netxol from one of three predecessors: GenieACS (open source, community-maintained, no commercial support), Incognito Broadband Command Center (heavy, expensive, dated), or Nokia HDM (locked to Nokia CPE). Netxol provides migration tooling: bulk import of CPE inventory (CSV, GenieACS DB dump, HDM export), state re-conciliation on first ACS session (an inform is answered with a merge, not a factory reset), and a dry-run mode that shows exactly what will change before the migration is committed.
- CSV / GenieACS DB / HDM export importers
- State reconciliation on first Inform
- Dry-run mode with change preview
- Historic firmware campaigns imported
- Zero subscriber-visible interruption
Multi-tenant ACS — MVNO, wholesale, subsidiary brands
The Netxol ACS supports isolated tenants sharing the same server: an MVNO parent that resells to child brands, a wholesale operator that sells transport to smaller ISPs, or a group that runs regional brands each with their own care team. Every CPE, every service profile, every firmware campaign is scoped to a tenant. Cross-tenant queries are only permitted for group-admin identities. See /solutions/national-carrier for the operational context.
- Tenant isolation at CPE / profile / campaign level
- MVNO parent + child brand support
- Wholesale operator resell of Netxol capacity
- Per-tenant SLAs and rate limits
- Cross-tenant admin view for group operators
Security, scale and audit
The ACS handles the security-critical operation of pushing configuration onto customer devices — a compromise here becomes a compromise of every subscriber. Netxol implements TLS 1.3 with certificate pinning, mutual TLS on connection requests, HMAC-signed provisioning payloads, per-CPE credentials rotated on a schedule, and a full audit log that names every parameter change, every firmware push, every reboot. Scale-wise the ACS handles hundreds of thousands of active CPE per cluster; see /blog/tr-369-usp-adoption-2026 for capacity planning.
- TLS 1.3 + certificate pinning
- Mutual TLS on connection requests
- HMAC-signed provisioning payloads
- Per-CPE credential rotation
- Full audit log — every parameter change
- Hundreds of thousands of active CPE per cluster
Everything you get with this playbook.
We usually pair this playbook with Netxol Core X5.
The X5 is where most operators land after their first 10,000 subscribers. Double the compute, redundant power, and enough headroom for the entire subscriber lifecycle — from onboarding an ONT to closing the accounting month.
Operators already running this play.
Questions we get on the first call.
How long does it take to go live?
Small deployments complete in under a week from unboxing the Core to first paying subscriber; larger rollouts scoped in weeks not months.
Do we need to change our existing hardware?
No. NOS ships adapters for every mainstream OLT and router. You keep the gear you own; we replace the tooling above it.
What happens to our data?
Everything stays on your Core appliance by default. Backups go to your object store of choice. No subscriber data leaves your rack unless you turn on an opt-in telemetry channel.
Can we migrate from another platform?
Yes — we run a scoped migration project with matching data mappings and cut-over windows. Standard editions include the first migration.
Other stories in this shape.
Ship an ONT to a subscriber. When they plug it in, NOS provisions it, binds it to their record, and lights up their plan — without a technician touching a config file.
ReadOutcomeHuawei, ZTE, FiberHome, CDATA, V-SOL, HSGQ, BDCOM, Nokia and more — abstracted behind one vendor-neutral interface. Cards, ports and environment are monitored continuously. ONTs are auto-discovered (including unauthorised ones), provisioned in seconds and reclaimed cleanly. Optical Tx/Rx power thresholds catch a degrading splice weeks before the subscriber does.
ReadOutcomeMost of what a NOC does at 3 a.m. is small, boring and repeatable. NOS is built to notice those patterns, act on them safely, and keep humans in the loop for anything that isn’t routine.
Read