This tutorial walks through cloning the OMCI/PON identity of a Vivo Brazil XGS-PON ASKEY ONT (RTF8316VW family) into a 8311 X-ONU-SFPP running the Community Firmware MOD by djGrrr. The result is a transparent SFP module that the OLT/BRAS treats as the original Askey, letting you bypass the ISP's modem entirely and use your own router/firewall.
Scope. This guide covers what to read from the Askey and what to set on the 8311. The host SFP+ cage and downstream router are deliberately not covered — pick whatever fits your topology (MikroTik, UniFi, OPNsense, pfSense, a managed switch with SFP+, etc.). The 8311 just bridges PON ↔ Ethernet; the host does PPPoE.
Companion docs: see claro-8311-clone-tutorial for the Claro/ZTE equivalent. The Vivo line uses PPPoE; Claro uses DHCP/IPoE — the cloning approach is similar but the failure modes and the critical "gotcha" differ.
- A Vivo Brazil XGS-PON line with an ASKEY ONT (RTF8316VW or similar). Other Vivo ONTs may need different fields; this guide is specific to the RTF8316VW family.
- An 8311 X-ONU-SFPP module flashed with the Community Firmware MOD by djGrrr (any recent version with the PON tab fields described below).
- A host with an SFP+ cage to power and bridge the 8311.
- A downstream router/firewall capable of PPPoE on its WAN. Your downstream port should be configured for either untagged or VLAN-10 tagged Internet traffic depending on what you set in the 8311's "Internet VLAN" field below.
- Network reachability to both:
- The Askey on its LAN (
192.168.15.1by default) - The 8311 on its management IP (
192.168.11.1by default)
- The Askey on its LAN (
- An SSH client.
ssh support@192.168.15.1
# (Get the support password from the Askey label or your ISP — it's not the admin web password.)
The Askey shell is a restricted CLI. Commands are nested: type a section name (e.g. sys_info) to enter a context, then show (or another subcommand) inside it. Use pop to go up one level, or pop_all to return to root. Use ? for help in any context.
Run each block below and record the bolded values. These are example outputs — your real numbers will differ.
> sys_info
sys_info > show
Look for:
Family = RTF83XX
Model = RTF8316VW ← Equipment ID
Bootloader version = 9
Current Version = g1.13_R8316_V2.13
=============================
Image[PART_0]
=============================
TEF Image Version = GL_g1.3_R8316_V2.3 ← Software Version A (truncate to 14 chars)
=============================
Image[PART_1] [Current]
=============================
TEF Image Version = GL_g1.13_R8316_V2.13 ← Software Version B (truncate to 14 chars)
Note: PART_1 is marked [Current] = active
###################################
# Gpon Configuration
###################################
gpon_sn = ASKY0099X123 ← PON Serial Number
gpon_pwd = 30303939383736353433 ← Logical Password (HEX)
gpon_reg_id = 30303939383736353433000000…0000 ← Registration ID HEX (72 hex chars total)
ethaddr = A0:8A:06:00:00:00 ← base eth MAC (informational)
> onu
onu > dev_info
onu/dev_info > show
Look for:
ONU ID: 62 ← assigned by OLT, NOT configurable
SN: ASKY0099X123 ← same as gpon_sn (confirm)
PASSWD:
ASCII: 0099876543 ← Logical Password (ASCII form)
HEX: 30303939383736353433
REGID:
ASCII: 0099876543..........................
HEX: 30303939383736353433000000…0000 ← same Reg ID HEX (confirm)
OMCC ID: 62
onu/dev_info > pop_all
> rg
rg > dev_info
rg/dev_info > show
Look for:
Manufacturer = ASKEY
ManufacturerOUI = A08A06
Model = RTF8316VW
SerialNumber = A08A0600000A ← This is the WAN MAC w/o colons.
→ format as MAC: A0:8A:06:00:00:0A
HardwareVersion = 1 ← TR-069 reports "1"; OMCI uses "REV4" — see below.
SoftwareVersion = GL_g1.13_R8316_V2.13
rg/dev_info > pop_all
> onu
onu > intf
onu/intf > veip
onu/intf/veip > show
Look for:
id = 0
name = veip0
mac_addr = 00:AD:EF:00:00:0A ← VEIP MAC
The "real" OMCI hardware version (the value the OLT sees in ME 256/257) is in the U-Boot environment, not the TR-069 view. The OMCC version is in /etc/config/gpon. Both are read via the engineering shell:
onu/intf/veip > pop_all
> diag
diag > engineering
diag/engineering > cat /etc/config/gpon
Look for:
config ONU 'ONU'
option OMCCVersion 'A0' ← OMCC Version → format as 0xA0 in 8311 UI
For the OMCI hardware version (you need root, but support can read it via the bootloader util):
diag/engineering > pop_all
> bootenv_util show
Look for:
hardwareVersion=REV4 ← OMCI Hardware Version (use this, not TR-069's "1")
Fill this in from your Askey's output. Example values shown.
| Field | Example value | From |
|---|---|---|
| PON Serial Number | ASKY0099X123 |
sys_info show → gpon_sn |
| Equipment ID | RTF8316VW |
sys_info show → Model |
| Vendor ID (4 chars, derived from serial) | ASKY |
first 4 chars of PON serial |
| Logical Password (ASCII) | 0099876543 |
onu/dev_info show → ASCII under PASSWD |
| Registration ID HEX (72 chars) | 30303939…0000 |
sys_info show → gpon_reg_id |
| Hardware Version (OMCI) | REV4 |
bootenv_util show → hardwareVersion |
| Software Version A (PART_0, 14-char truncation) | GL_g1.3_R8316_ |
PART_0 TEF Image, first 14 chars |
| Software Version B (PART_1, 14-char truncation) | GL_g1.13_R8316 |
PART_1 TEF Image, first 14 chars |
| Active firmware bank | B |
which PART is [Current] (PART_0=A, PART_1=B) |
| Committed firmware bank | B |
usually same as active |
| WAN MAC (IP-Host MAC) | A0:8A:06:00:00:0A |
rg/dev_info show → SerialNumber, formatted with colons |
| VEIP MAC (informational) | 00:AD:EF:00:00:0A |
onu/intf/veip show → mac_addr |
| OMCC Version | 0xA0 |
cat /etc/config/gpon → OMCCVersion |
Two flavors of "Hardware Version". TR-069 reports
1; OMCI usesREV4. UseREV4in the 8311 — that's what the OLT sees over OMCI.14-character truncation. The OMCI Software Image ME (ME 7) only carries 14 octets for the version string. Each Askey software version is longer than that. Truncate from the left. For
GL_g1.3_R8316_V2.3the 14-char prefix isGL_g1.3_R8316_(note the trailing underscore — that's the 14th character). ForGL_g1.13_R8316_V2.13it'sGL_g1.13_R8316.VEIP MAC. The 8311 doesn't have an explicit VEIP MAC field — the agent generates this from the configured IP-Host MAC. As long as IP-Host MAC matches the Askey's WAN MAC, the rest follows. This row is for reference only.
Open the 8311 web UI (typically http://192.168.11.1), log in, and go to the 8311 tab.
| 8311 UI Field | Value to set | Notes |
|---|---|---|
| PON Serial Number | ASKY0099X123 |
from your table |
| Vendor ID | (auto-derived from serial; leave default) | first 4 chars of serial |
| Equipment ID | RTF8316VW |
from your table |
| Hardware Version | REV4 |
OMCI hardware version (not TR-069's 1) |
| Software Version A | GL_g1.3_R8316_ |
14-char truncation of PART_0 |
| Software Version B | GL_g1.13_R8316 |
14-char truncation of PART_1 |
| Registration ID HEX | 30303939…0000 |
full 72-character hex string |
| Logical Password | 0099876543 |
ASCII form — the 8311 will hex-encode for you |
| IP Host MAC Address | A0:8A:06:00:00:0A |
the Askey's WAN MAC |
| OMCC Version | 0xA0 |
the Askey's value (default 8311 is 0xA3 — change it) |
| OMCI Mask | 18 |
bits 1+16, standard for PRX300 |
| MIB File | /etc/mibs/prx300_1V.ini |
HGU, not the default 1U (SFU) |
| Sync Circuit Pack Version | ENABLED | propagates Vendor/HW/Serial into Circuit Pack ME 6 inst 257 |
| Override active firmware bank | B |
match Askey's [Current] partition |
| Override committed firmware bank | B |
match Askey's committed partition |
Why MIB
prx300_1V.ini(HGU) and not the defaultprx300_1U.ini(SFU)? The Askey is an HGU — it uses a Virtual Ethernet Interface Point (VEIP, OMCI ME 329) at instance 257 instead of a physical Ethernet UNI port. Vivo's OLT pushes service config to the VEIP. Loading the HGU MIB ensures the agent has VEIP pre-instantiated at the right instance ID. Useprx300_1V.ini(plain HGU). Avoidprx300_1V_bell.iniandprx300_1V_32tcont.ini— those are vendor-specific and add MEs Vivo doesn't use.Why
Override active/committed firmware bank = B? The 8311 has its own A/B firmware partitions, and by default reports the bank it physically booted from as Active+Committed in OMCI ME 7. This is independent of what the Askey reports. The Askey's PART_1 (your "Software Version B") is its[Current]partition. The override decouples OMCI reporting from physical boot, so the OLT sees Bank B = active+committed (matching the Askey) regardless of which 8311 partition is actually running.Why "Sync Circuit Pack Version"? The OMCI Circuit Pack ME (ME 6 instance 257) carries Vendor/HW Version/Serial fields independently of ME 256 (ONU-G). Some OLTs query Circuit Pack as part of MIB upload. With this setting on, the 8311 propagates
ASKY/REV4/ASKY0099X123into ME 6/257 automatically — otherwise it would have placeholder defaults that don't match the Askey.
| Field | Value | Notes |
|---|---|---|
| Fix VLANs | Enabled | Required so the 8311 strips OLT's VLAN 10 on ingress |
| Internet VLAN | 0 (untagged) |
Set to 0 if your downstream router expects untagged WAN. Set to a number (e.g. 10) if your router expects tagged. |
| Services VLAN | (leave empty) | Only needed for ISPs that bundle multiple service VLANs into one pmapper (e.g. Bell Canada). Vivo separates services per GEM, so this isn't useful. |
Save each tab. Then reboot the 8311 — either via the UI's reboot button or:
ssh root@192.168.11.1 reboot
The fwenv-based settings (PON tab, override fields, MIB file) are only applied at boot via _8311-poninit.sh. Without a reboot, your changes will sit in fwenv but won't be reflected in the live OMCI MIB.
Wait for the 8311 to come back up (~30 seconds), then SSH and verify the OMCI side. PLOAM will be at state 11 (O1.1, no fiber yet) — that's expected.
ssh root@192.168.11.1
Run each of these and check the bolded fields against your Askey table:
# ONU-G — should show your cloned vendor/version/serial
omci_pipe.sh meg 256 0
# 1 Vendor id = ASKY
# 2 Version = REV4
# 3 Serial number = ASKY 00 99 X1 23 (hex form of your serial)
# 4 Traffic mgmt opt = 2
# ONU2-G — equipment id and OMCC version
omci_pipe.sh meg 257 0
# 1 Equipment id = RTF8316VW
# 2 OMCC version = 0xa0
# Software image bank A (instance 0) — your truncated PART_0 string, marked Inactive
omci_pipe.sh meg 7 0
# 1 Version = GL_g1.3_R8316_
# 2 Is committed = 0
# 3 Is active = 0
# 4 Is valid = 1
# Software image bank B (instance 1) — your truncated PART_1 string, marked Active+Committed
omci_pipe.sh meg 7 1
# 1 Version = GL_g1.13_R8316
# 2 Is committed = 1 ← override active=B,commit=B working
# 3 Is active = 1
# 4 Is valid = 1
# VEIP — should exist at instance 257 (proves HGU MIB loaded correctly)
omci_pipe.sh meg 329 257
# Class ID = 329 (Virtual Eth i/f point)
# errorcode=0
# Circuit Pack — should show ASKY/REV4/serial (proves cp_hw_ver_sync working)
omci_pipe.sh meg 6 257
# 3 Serial number = ASKY 00 99 X1 23
# 4 Version = REV4
# 5 Vendor id = ASKYIf any field is wrong, fix it in the web UI and reboot again. Don't move the fiber until everything matches.
Bring down the WAN interface or admin-disable PPPoE. This prevents your router from blasting PADIs the moment the 8311 comes online — important for the next subsection's safety reason.
Unplug the fiber from the Askey ONT, plug it into the 8311.
In a terminal on the 8311:
while true; do printf "%s PLOAM: %s\n" "$(date +%T)" "$(pon psg 2>&1 | grep -oE 'current=[0-9]+')"; sleep 2; done
Expected progression (PRX300 firmware enum):
| State | Meaning |
|---|---|
| 11 | O1.1 — initial, searching for downstream signal |
| 12 | O1.2 — downstream sync acquired |
| 23 | O2.3 — serial number transmitted |
| 30 | O3 — serial number ack'd by OLT |
| 40 | O4 — ranging |
| 51 | O5.1 — fully ranged + associated (good!) |
It should reach 51 within ~30 seconds.
If it gets stuck at 23 looping back to 12: OLT sees your serial but is rejecting it → identity mismatch. If it stalls at 40: ranging issue → optical or distance problem.
Check that the OLT pushed the service profile (these MEs are created at runtime, instance numbers vary):
omci_pipe.sh meg 268 1 # GEM Port Network CTP
omci_pipe.sh meg 266 1 # GEM Interworking TP
omci_pipe.sh meg 47 1 # MAC Bridge Port
omci_pipe.sh meg 171 1 # Extended VLAN Tagging OperationAll should return Class ID = … lines (not errorcode=-16). If they're populated, the OLT accepted you and built the service profile.
Bring up your WAN interface. Watch your router's PPPoE log.
Expected sequence (sub-second per step):
PADIsentPADOreceived from BRASPADRsentPADSreceived → PPPoE session establishedLCP ConfReq/ConfAckboth directionsPAP AuthReqwithcliente@cliente/cliente(or your ISP's actual credentials)PAP AuthAck "Authentication success, Welcome!"IPCP ConfReq/ConfAck→ public IP assignedIPV6CP ConfReq/ConfAck
If you see PAP AuthAck "Authentication success" and an IP — congratulations, you're online via the 8311.
If PAP fails (e.g. Client not found), stop pppd immediately — disable PPPoE or pull the WAN cable. Do not let pppd loop with the default maxfail 0 / persist.
Vivo's BRAS will tolerate a few failed PAP attempts. After 20–50 in quick succession, it locks the line's RADIUS state for multiple hours (we observed an overnight lockout from a few minutes of looping retries). Once locked, even your original Askey can't authenticate until the lockout clears.
If you trip this, the recovery path is:
- Disconnect the 8311 from fiber, power it down.
- Wait several hours (overnight is safe).
- Reconnect the Askey to fiber.
- Once Askey is back online, you can try the 8311 again — but only after a clean reset.
To make pppd safer during testing, edit /etc/ppp/peers/<your-peer> on your downstream router and set:
nopersist
maxfail 1
holdoff 60
This makes pppd give up after one failure instead of looping. Some routers regenerate the peer file from UI config, so re-edit after every config change.
Don't set both Software Version A and B to the same string. The Askey reports two distinct version strings (one per partition), and one is marked Active+Committed while the other is just Valid. Set A and B to the truncated PART_0 and PART_1 strings respectively, then use the Override active/committed firmware bank fields to mark Bank B as Active+Committed (assuming the Askey's PART_1 is [Current]).
The default prx300_1U.ini (SFU) doesn't pre-instantiate the VEIP ME at the right instance. Vivo's OLT pushes service configuration that targets the VEIP. Without prx300_1V.ini loaded, some OLT Set commands may end up unhandled.
The 8311 runs hot in tight SFP+ cages — CPU temps of 85–92 °C are typical. Improve airflow if you can (open-top cage, nearby fan, cooler placement). Not a blocker, just a longevity consideration.
Huawei OLTs (which Vivo uses) periodically deactivate and reactivate the data GEM port at ~900s intervals as part of bandwidth reallocation. This causes a brief PPPoE renegotiation every ~15 minutes. Reconnection takes ~5–10 seconds and is normal — your downstream router should handle it transparently.
If your ONT model differs from the RTF8316VW but you're still on Vivo Brazil, these are the fields most likely to matter:
- PON Serial Number (exact match)
- Logical Password (exact match)
- Registration ID HEX (exact match, full 36 bytes)
- Equipment ID (exact match)
- Hardware Version (OMCI value, not TR-069)
- Software Version A and B (per-partition, 14-char truncated)
- Active/Committed bank override (matching the cloned ONT's
[Current]) - OMCC Version
- IP-Host MAC (= cloned ONT's WAN MAC)
- MIB file matching the cloned ONT's class (HGU =
prx300_1V.ini, SFU =prx300_1U.ini) - Sync Circuit Pack Version enabled
- Internet VLAN matching what your downstream router expects (typically
0for untagged PPPoE)
Get those right, give the BRAS a clean test (one attempt at a time), and the OLT will treat the 8311 as if it were the original ONT.