Cloud TR-069 ACS Server for ISPs — GenieACS CPE Management

Reviewed by the NowaCRM ISP operations team Last updated: May 18, 2026

Quick answer

With thousands of ONTs, routers, and set-top boxes deployed across subscriber homes, manual device management is a nightmare — a truck roll for every WiFi password reset, no idea a fiber is degrading until the subscriber calls. A TR-069 ACS (Auto Configuration Server) fixes this by talking to every CPE device over CWMP: auto-configure, diagnose, and update it remotely. Ask for a "cloud TR-069" setup and this is what you actually want: an auto configuration server you don't operate yourself, that already knows which subscriber owns which device. NowaCRM runs this as a cloud-hosted ACS — an isolated instance per ISP, built on GenieACS, wired directly into your subscriber and billing records — so there is no separate server to provision, patch, or scale yourself.

01

Cloud ACS vs Self-Hosted GenieACS — Why Most ISPs Don't Run Their Own

An ACS has to be reachable from every CPE on your network, 24 hours a day, over both TCP (for the device-initiated CWMP session) and UDP (for on-demand wake requests to devices sitting behind a customer's NAT router). Running that yourself means standing up GenieACS, a MongoDB instance, TLS certificates, a STUN server for NAT traversal, and someone on call when it falls over — real infrastructure work most ISP teams don't have spare hands for. Teams that go the DIY route usually spend weeks getting GenieACS, Mongo, and STUN production-ready before onboarding a single CPE, and if that self-hosted stack goes down at 2 AM, every device's periodic Inform is missed and any queued refresh or reboot job just sits there until someone notices. NowaCRM's ACS is cloud-hosted and multi-tenant: each ISP gets its own isolated device database and CWMP endpoint, reachable from your portal through a bearer-token API. You enable it from Settings → ACS, and the server, the database, the STUN keep-alive, and the uptime are managed for you.

02

What Happens When a New CPE Connects — Zero-Touch Provisioning

A technician installs a router or ONT, plugs it in, and walks away — no local admin page, no manual CWMP URL entry. The device sends its first CWMP Inform to the ACS and is accepted automatically; there is no allowlist of pre-registered serial numbers to maintain. First-contact provisioning immediately pushes the correct CWMP connection-request credentials, sets the periodic Inform interval, and enables the STUN client so the device stays reachable for on-demand refresh even behind a customer NAT — no port forwarding required on the subscriber's router. If the plan has PPPoE credentials, VLAN, or a WiFi SSID/password configured, those go out in the same first-contact push. Compare that to the old workflow: a technician manually punches in the WiFi SSID, PPPoE username/password, and VLAN tag on-site, then calls the NOC to confirm the account provisioned correctly — a process that easily eats 20-30 minutes per install and is where most day-one configuration mistakes happen. The device then appears under ACS → Unauthenticated in the portal until a staff member links it to a subscriber record — usually automatic, since NowaCRM matches by the serial number captured on the subscriber's CPE field at signup.

03

NowaCRM + GenieACS vs Running Raw GenieACS Yourself

GenieACS is a capable open-source CWMP engine, and it's the same engine NowaACS runs underneath — but on its own, GenieACS has no idea who your subscribers are or what plan they're on; it's a device console with a device ID, not a subscriber name. NowaCRM's integration is the layer most self-hosted GenieACS setups end up hand-rolling: a support agent troubleshooting a call sees the device's online/offline state, optical power, and last-contact time right on the subscriber's page, next to their invoices and plan — not in a separate tab with a different login. Access is RBAC-gated at an acs.view / acs.manage level, so a partner's staff only ever see devices linked to their own subscribers, never another partner's fleet, without your team building that scoping logic by hand. That single pane of glass is also what shortens support resolution time in practice — one login, one search box, one place to decide whether a truck roll is actually necessary before a technician is dispatched.

04

Cloud ACS vs Self-Hosted, Side by Side

The practical difference shows up mostly in what you have to build and maintain yourself before day one, and what stays connected to billing afterward.

	Self-hosted GenieACS / FreeACS	NowaCRM Cloud ACS
Setup	Provision a server, MongoDB, TLS, open inbound ports	Enable from Settings → ACS — no infrastructure to run
NAT traversal	Configure and operate your own STUN/coturn server	STUN pre-wired; on-demand refresh, no port forwarding
Subscriber link	Manual, or a custom script you maintain	Auto-linked by serial from the subscriber's CPE record
Billing tie-in	None — a separate system with a separate login	Device status lives on the subscriber page, next to invoices
Multi-tenant isolation	You design and build it	Each ISP gets an isolated device database by default
Upgrades / uptime	Your team's responsibility	Managed as part of the platform

05

Dashboard, Device List, and Fleet-Wide Filtering

Staff open ACS → Dashboard to stat cards showing total devices, how many are online right now, how many are offline, and how many refresh or firmware jobs are still pending, plus a feed of recently active devices — a ten-second morning check instead of logging into a separate CWMP console. The Devices list is a searchable table: serial number, model, linked subscriber, online status, last inform time, and optical RX power side by side, with row actions to view details, link an unlinked device to a subscriber, refresh its live parameters, or reboot it. Filtering by model, firmware version, or linked subscriber turns "every Syrotech unit still on the old firmware" into a worklist in seconds, instead of exporting a spreadsheet and cross-referencing it by hand. Partners and employees see the same dashboard scoped down to only the devices linked to their own subscribers, consistent with how the rest of the ISP portal enforces org-level visibility.

06

Remote Diagnostics and On-Demand Refresh — No Truck Roll

Most subscriber complaints — "internet is slow", "WiFi isn't working", "the box shows a red light" — can be checked from the device page before dispatching anyone. A support agent hits Refresh with scope checkboxes (status, WiFi, optics, or everything) and NowaCRM pulls fresh parameters on demand, reaching through the customer's NAT via the STUN wake path instead of waiting on whatever the device last reported at its 300-second periodic Inform. Reboot works the same way, behind a confirmation step since a live reboot drops the subscriber's connection, and both actions carry an idempotency key so a support agent re-clicking during a slow response can't trigger a duplicate reboot mid-flight. The telemetry cache behind these panels shows its own freshness per scope, so staff can tell "this optical reading is ten seconds old" from "this is what the device reported an hour ago" instead of guessing.

07

TR-069 vs TR-369: Which Protocol Actually Matters for ISPs in 2026

TR-369 (User Services Platform, USP) is the Broadband Forum's newer standard, positioned as TR-069's eventual successor with an MQTT/WebSocket transport and a more modern data model. USP also assumes an always-on message-bus transport rather than periodic HTTP polling, which is a deeper architecture change than a firmware update — not something a CPE quietly gains through an OTA push. In practice, the CPE vendors actually shipping GPON ONTs and WiFi routers at volume — the Syrotech, DBC/SaiNXT, ZTE, and ONPL/Realtek-based hardware most regional ISPs deploy — overwhelmingly ship TR-069/CWMP firmware, not USP agents. TR-369 adoption is real in a handful of high-end carrier deployments, but it hasn't reached the mass-market GPON and DSL hardware an Indian or Southeast Asian ISP actually buys. That's why NowaACS is built on CWMP: it's the protocol your current and next fleet of CPE actually speaks. If a vendor ever ships you USP-only firmware, treat it as a separate onboarding effort — the two protocols aren't interchangeable at the wire level, and a TR-069 ACS won't manage a TR-369-only device. For most Indian and Southeast Asian ISPs, that makes the TR-069 vs TR-369 question less "which is better" and more "which one your hardware vendor already ships" — and today, that's TR-069 for the overwhelming majority of deployed and newly-purchased CPE.

08

Supported CPE Matrix — What's Fully Wired vs In Progress

Every CPE model needs a vendor-specific parameter profile before its optical readings, WiFi controls, and firmware push are fully reliable — an unrecognized model still connects and shows online/offline from day one, but a profile is what unlocks the rest. New models get profiled in roughly half an hour once one comes into the fleet, and profiles are added as hardware actually shows up in a live deployment rather than pre-built for the whole market ahead of demand. The table below reflects what's mapped today across the OUI ranges seen in live ISP deployments, not a blanket universal-compatibility claim.

Vendor / model family	Optical (RX/TX/temp)	WiFi & VLAN control	Firmware push	Status
DBC / SaiNXT HGU-V210 series	Full	Full	Model-guarded	Reference profile — most complete
Syrotech GPON ONT range	Full	Full	Supported	Multiple firmware tags live
ONPL / OptiLink OP-XONT	Full	Full	Supported	Full parameter tree mapped
Realtek-family XPON ONTs	Full	Full	Supported	Full parameter tree mapped
ZTE C6xx family	Via OLT/SNMP, not TR-069	Full	In progress	Optical read through OLT poller instead
Unrecognized / generic TR-098 CPE	Basic (online/offline only)	Basic	Not guaranteed	Works day one; deepens once profiled

09

Optical Diagnostics and WiFi Visibility, Per Device

For GPON ONTs with a mapped profile, the ACS reads RX power, TX power, and module temperature straight from the device's TR-069 parameter tree, so a fading fiber shows up as a diagnostic before the subscriber calls in about slow speeds. VLAN assignment, connected WiFi and LAN client counts, and the current SSID/passphrase are on the same device page — a support agent can tell a subscriber "you have 14 devices connected right now" instead of asking them to count, and a sudden client-count spike is often the first sign of someone riding an unsecured WiFi network. Where a CPE doesn't expose optical parameters over TR-069 — some models only surface them on the OLT side — NowaCRM's separate OLT/ONU monitoring reads the same RX/TX/temperature numbers over SNMP from the OLT, so one vendor's thin TR-069 firmware doesn't leave that device blind.

10

Model-Guarded Firmware Push — No Bricking the Wrong Router

Bulk firmware is the highest-risk ACS operation: flash the wrong image to the wrong model and you can brick a fleet, not one device. NowaCRM's firmware tab only ever lists images that match the exact product class of the device you're looking at — there's no dropdown of every firmware file in the system to pick the wrong one from. A mismatched model/firmware pair is rejected before it ever reaches the device, and every push carries an idempotency key, so a support agent's accidental double-click replays the same tracked job instead of firing a second flash attempt at a router that's mid-reboot. Firmware rollout stays a deliberate, staff-confirmed action rather than a silent background update — a technician picks the model-matched image and confirms the push, so an ISP controls exactly when a batch of routers goes through the reboot a flash requires, instead of devices updating themselves on an unpredictable schedule.

11

Turning ACS On for Your ISP

Enabling ACS is a Settings change, not a project. An ISP admin opens Settings → ACS, pastes the base URL and API token issued for their tenant, and flips the enabled toggle — the token is write-only in the UI (shown masked once saved, never re-displayed in plain text) so it isn't sitting exposed on a settings screen. Until ACS is enabled and configured, the ACS/TR-069 menu simply doesn't appear in the sidebar; there's nothing half-built for staff to stumble into. Once it's live, device visibility follows the same partner/employee scoping as the rest of the platform: ACS is gated behind two permissions, acs.view for read access and acs.manage for link/refresh/reboot/firmware actions, and an ISP can grant either to specific roles the same way they grant any other module permission. If the ACS backend is briefly unreachable, read pages show a plain "ACS unreachable" banner instead of an error page, and any action a staff member tries returns a clear toast message rather than failing silently — so a network blip on the ACS side never looks like a broken CRM.

FAQ

Frequently Asked Questions

What is a TR-069 ACS server?

TR-069 (CWMP — CPE WAN Management Protocol) is the protocol CPE devices use to talk to a management server. The ACS (Auto Configuration Server) is that server — it pushes configuration, firmware, and diagnostics to every device, and pulls back status like online/offline and optical power. It's the same standard that makes "zero-touch" routers and ONTs possible in the first place.

Do I need to host my own ACS server?

No. NowaCRM's ACS is cloud-hosted and multi-tenant — you enable it from Settings → ACS and get an isolated device database and CWMP endpoint, with no server, MongoDB, or STUN infrastructure for your team to run.

Does NowaCRM support zero-touch provisioning?

Yes. A new CPE is accepted automatically on first contact — no pre-registered serial list — and immediately receives its CWMP credentials, periodic Inform interval, STUN setup, and any WiFi/PPPoE/VLAN settings from the plan. A device reconnecting after a power cut goes through the same automatic re-provisioning, with no technician visit needed.

How is this different from just running GenieACS myself?

GenieACS is the engine underneath, but on its own it has no concept of your subscribers or plans. NowaCRM links every device to a subscriber record automatically and shows status next to their billing, with RBAC so partners only see their own fleet.

Should I care about TR-369 / USP instead of TR-069?

Not yet, for most ISPs. The GPON ONTs and routers actually shipping at volume from Syrotech, DBC/SaiNXT, ZTE, and similar vendors run TR-069/CWMP firmware, not TR-369/USP. TR-069 is what your real fleet speaks in 2026.

Which CPE brands does the ACS support?

DBC/SaiNXT, Syrotech, ONPL/OptiLink, and Realtek-family GPON ONTs have full optical, WiFi, and firmware profiles today. ZTE optical data currently comes via OLT/SNMP rather than TR-069. Unprofiled models still connect and report online/offline from day one, and coverage keeps expanding as new hardware is actually deployed in the field rather than being pre-built speculatively for every vendor on the market.

Can I see fiber optical power (RX/TX) per subscriber?

Yes, for profiled GPON ONTs — RX power, TX power, and module temperature are read from the device's TR-069 parameters. If a model doesn't expose them over TR-069, the same numbers are available via OLT/SNMP monitoring instead.

Is bulk firmware push safe to run?

The firmware tab only shows images matching the exact device model you're on, and a mismatched model/firmware pair is rejected before it reaches the device. Pushes also carry an idempotency key so a double-click can't trigger two flash attempts.

Join 200+ ISPs running on NOWA CRM. Schedule a free demo and see it in action.

Schedule Demo All Features

TR-069 ACS Server — Cloud CPE Management, Built On GenieACS