Discover the best practices for automating and monitoring your network

TR-069 is the Technical Report published by the Broadband Forum that defines how providers of broadband services can deploy and remotely manage customer premises equipment (CPE) in home and business networks, using a centralized auto-configuration server (ACS) to configure the CPEs. TR-069 covers a wide range of home network devices and an unlimited number of network aware products through TR-069’s proxy function.

QA Cafe provides extensive resources to help you understand the interaction between the ACS and CPE and get you started developing your own TR-069 solutions.

Discover the best practices for automating and monitoring your network

TR-069 training resourcesPractical information for remote network configuration and management

TR-069 refers to the Technical Report published by the Broadband Forum that defines the CPE WAN Management Protocol, or CWMP. CWMP was developed to allow providers of broadband services to deploy and manage customer premises equipment in home and business networks.

Learn more

Every TR-069 session is initiated by a CWMP Endpoint on a CPE. These sessions always occur for a specific reason, called an “Event”. All of the Events that have yet to be delivered to the ACS are contained as arguments in the Inform RPC at the start of every TR-069 session.

Learn more

In TR-069, the CPE always initiates a session. When making first contact with an ACS, how does it know the ACS URL it is supposed to contact?

Learn more

Though every TR-069 session is initiated by the CPE endpoint, sometimes it’s necessary for the ACS to request that the CPE contact it immediately. To do this, TR-069 defines a Connection Request mechanism in CWMP, which allows the ACS to stimulate the CPE to begin a session.

Learn more

There’s one caveat to ConnectionRequests - they require that the CPE can be reached by the ACS over HTTP. For endpoints that may reside behind a Gateway, this is not the case, thanks to Network Address Translation or Firewall rules.

Learn more

While XML is used most often to define and describe information, TR-069 also uses it directly over the wire when transmitting messages. This means that the ACS and CPE pass XML documents back and forth over HTTP during a TR-069 session.

Learn more

In TR-069, the 4 Value Change event code is used when a parameter set for notification is changed by any mechanism other than the ACS. These conditions are set using the SetParameterAttributes RPC.

Learn more

Every TR-069 session is initiated by a CWMP endpoint that is looking to deliver an event. These events have different delivery requirements, using language such as “must not discard”, “must retry until reboot”, “may retry” and “must not retry”.

Learn more

TR-069 uses several remote procedure calls whose definition determine the types of TR-069 messages that are sent and received by an ACS or CPE. Every RPC is defined in the TR-069 base XML schema which can be found on the Broadband Forum website.

Learn more

The GetRPCMethods argument is used by both the CPE and the ACS to request a list of the RPCs supported by either endpoint to better understand the endpoint’s capabilities. It’s one of the simpler RPCs in that it contains no arguments.

Learn more

When an ACS wants to learn what objects exist on a CPE and what parameters they support, it can use the GetParameterNames RPC. Like other RPCs, GetParameterNames makes use of the ParameterPaths argument, so let’s take a minute to understand parameter paths.

Learn more

The fundamental purpose of TR-069 is to allow an ACS to interact with the CPE’s instantiated data model, that is, the representation of its current state. The RPCs that form the basis of this include the Get and Set Parameter Values methods.

Learn more

Every parameter a CPE’s CWMP data model contains metadata known as “attributes”. These attributes include the “Notification” attribute and “AccessList” attribute. The access attribute was defined early on in TR-069 to provide a method for assigning an access control rule identifier to each individual parameter.

Learn More

An “object” in a CPE data model is an element of functionality that can be configured by an ACS. While an object’s parameters are configured using the SetParameterValues RPC, Objects that are able to be created by the ACS can be added to a device using the AddObject RPC, and removed using the DeleteObject RPC.

Learn more

The Reboot RPC is used by the ACS to explicitly cause the device hardware to restart. This could be for any number of reasons, though should never be used as a means to force the CPE to upgrade itself.

Learn more

Perhaps the biggest use case for TR-069 is managing a CPE’s firmware, allowing service providers to remotely upgrade their install base without needing to send the firmware to the customer or send an engineer.

Learn more

Intrinsic to the operation of CWMP are the objects and parameters made available to an ACS by a CWMP endpoint. These maps of a CPE’s capabilities and state are referred to as “data models”.

Learn more

Every data model in TR-069 contains the objects and parameters that represent the functions of a broadband CPE or other device. This includes their addressable name, syntax, data types, and a normative description of how they are to be used.

Learn more

Most objects contain a set of elements containing sub-objects and parameters. Parameters are defined using the parameter element, and, like Objects, have a set of attributes and elements that describe how the parameter is to be used and its requirements.

Learn more

CDRouter is the official self-test platform of the certification program for TR-069, called BBF.069.

Looking to get certified?

Learn more

There’s many use cases for TR-069 from a service provider’s perspective. Beyond onboarding, firmware upgrades, and service configuration, however, is the ability to monitor various statistics on devices and network interfaces to help troubleshoot an end-user’s service.

Learn more

The widely deployed TR-069 protocol and its successor, the User Services Platform (TR-369) are complex and powerful technologies that have successfully brought real value to operators, application vendors, and CE manufacturers. The key to that success is the standardization that can be tested and validated through certification programs.

Learn more

TR-069 training resourcesPractical information for remote network configuration and management

Videos

AddObject and DeleteObject

February 02, 2021

An “object” in a CPE data model is an element of functionality that can be configured by an ACS. While an object’s parameters are configured using the SetParameterValues RPC, Objects that are able to be created by the ACS can be added to a device using the AddObject RPC, and removed using the DeleteObject RPC.

Videos

TR-069 Training - GetParameterNames and Parameter Paths

February 02, 2021

When an ACS wants to learn what objects exist on a CPE and what parameters they support, it can use the GetParameterNames RPC. Like other RPCs, GetParameterNames makes use of the ParameterPaths argument, so let’s take a minute to understand parameter paths.

Videos

TR-069 Training - The GetRPCMethods RPC

February 02, 2021

The GetRPCMethods argument is used by both the CPE and the ACS to request a list of the RPCs supported by either endpoint to better understand the endpoint’s capabilities. It’s one of the simpler RPCs in that it contains no arguments

Videos

XML and SOAP in TR-069

February 02, 2021

While XML is used most often to define and describe information, TR-069 also uses it directly over the wire when transmitting messages. This means that the ACS and CPE pass XML documents back and forth over HTTP during a TR-069 session.

Articles

What's new in the TR-181 Device 2.13 data model for TR-069 and USP

January 27, 2021 · 5 min read

Tied with the release of version 1.1 of the User Services Platform/TR-369, the Broadband Forum also released version 2.13 of the Device:2 data model for TR-069 endpoints and USP agents.

Articles

What is IR-181 and how does it apply to TR-069 testing?

January 28, 2021 · 4 min read

Critical to testing TR-069 implementations is the ability to demonstrate that the underlying code that configures settings on the device interacts correctly with the commands sent via CWMP.

Articles

Protecting Against Vulnerabilities in SSL

June 30, 2015 · 1 min read

The IETF deprecated SSL version 3.0 in 2015. This means that it is no longer be standard to fall back to SSL 3.0 in protocol negotiations, and for good reason: there have been a host of vulnerabilities in Secure Socket Layer, some of which are of particular concern to home networking devices that have web-based configuration tools or support TR-069.

Articles

Managed IoT, security, and the User Services Platform

January 27, 2021 · 2 min read

The team here at QA Cafe is deeply involved in networking standards, especially the Broadband Forum and the TR-069 protocol. The Broadband Forum is expanding the reach of TR-069 with its User Services Platform, representing an evolution of TR-069 to managed a more varied and greater number of connected devices

Articles

Using TR-143 performance diagnostics

January 28, 2021 · 5 min read

There’s many use cases for TR-069 from a service provider’s perspective. Beyond onboarding, firmware upgrades, and service configuration, however, is the ability to monitor various statistics on devices and network interfaces to help troubleshoot an end-user’s service.

Articles

Does your device correctly configure Wi-Fi using TR-069?

January 27, 2021 · 4 min read

One of the most important use cases of TR-069 (and its evolution protocol, USP) is in the autoconfiguration, management, and troubleshooting of Wi-Fi networks. Often the source of the most customer service problems, being able to set up an end user’s Wi-Fi and make sure it’s working is critical for a satisfactory “carrier grade” home network.

Articles

Verifying TR-069 real-world scenarios with a native ACS

June 01, 2017 · 3 min read

CDRouter’s automation platform can make it very easy to do all of these, and do them repeatedly from firmware to firmware. However, this third point involves two things: verifying that your device makes the internal changes that were configured via CWMP, and testing in your actual production network.

Articles

Best Practices for Securing TR-069

January 28, 2021 · 4 min read

As one of the most largely deployed broadband management protocols in the world, TR-069 has quite a footprint, and a compromised system could potentially affect many broadband subscribers adversely.

Articles

TR-069 Connection Request Timing

January 19, 2017 · 2 min read

In CWMP, the CPE is always the initiator of sessions. It begins each session with a call to the Inform RPC, which contains EVENT codes that specify to the ACS the reason for the session.

Articles

Is your TR-069 implementation vulnerable to code injection attacks?

January 12, 2017 · 3 min read

The scenarios below are serious, and so we’ve added a series of tests to our tr69_conn_req.tcl module to cover your DUT’s TR-069 security and tests for code injection in TR-069 parameters.

Articles

Mirai attack on home routers and alleged TR-069 vulnerability

January 28, 2021 · 5 min read

The week of November 28 2016 saw a massive attack on certain home routers deployed by several European service providers. The attack was based on the Mirai Malware attack several weeks previous that affected the dynamic DNS services provided by Dyn, Inc..

Articles

Using XMPP for TR-069 Connection Requests

March 26, 2015 · 3 min read

Though one of the fundamental principles of CWMP (TR-069) is that the CPE endpoint is always the one to initiate a connection, Autoconfiguration Servers (ACS) can use the TR-069 Connection Request feature to stimulate a CPE to begin a session.

Articles

Is your device using valid TR-069 data models?

February 12, 2015 · 3 min read

The CPE WAN Management Protocol described by Broadband Forum TR-069 is a remote procedure call (RPC) based protocol. That is, it consists of two applications that interact directly with each other through a set of defined methods - in the case of TR-069, this includes device functions like Reboot, Download, etc., as well as operations that affect the device’s data model - a set of objects and parameters and the metadata surrounding them.

Webinars

How do I get TR-069 Certified?

February 01, 2021

CDRouter is the official self-test platform of the certification program for TR-069, called BBF.069. Looking to get certified? Reach out to us to get started!

Videos

Data Model Parameters

February 02, 2021

Most objects contain a set of elements containing sub-objects and parameters. Parameters are defined using the parameter element, and, like Objects, have a set of attributes and elements that describe how the parameter is to be used and its requirements.

Videos

Looking at Data Models and Objects

February 02, 2021

Every data model in TR-069 contains the objects and parameters that represent the functions of a broadband CPE or other device. This includes their addressable name, syntax, data types, and a normative description of how they are to be used.

Videos

Navigating Broadband Forum Data Models

February 02, 2021

Intrinsic to the operation of CWMP are the objects and parameters made available to an ACS by a CWMP endpoint. These maps of a CPE’s capabilities and state are referred to as “data models”.

Videos

Reboot and FactoryReset

February 02, 2021

The Reboot RPC is used by the ACS to explicitly cause the device hardware to restart. This could be for any number of reasons, though should never be used as a means to force the CPE to upgrade itself.

Videos

Upgrading CPE Firmware with the Download and TransferComplete RPCs

February 02, 2021

Perhaps the biggest use case for TR-069 is managing a CPE’s firmware, allowing service providers to remotely upgrade their install base without needing to send the firmware to the customer or send an engineer.

Videos

TR-069 Training - Parameter Attributes

February 02, 2021

Every parameter a CPE’s CWMP data model contains metadata known as “attributes”. These attributes include the “Notification” attribute and “AccessList” attribute. The access attribute was defined early on in TR-069 to provide a method for assigning an access control rule identifier to each individual parameter

Videos

Get/Set Parameter Values and the Status argument

February 02, 2021

The fundamental purpose of TR-069 is to allow an ACS to interact with the CPE’s instantiated data model, that is, the representation of its current state. The RPCs that form the basis of this include the Get and Set Parameter Values methods.

Videos

TR-069 Training - The Inform RPC

February 20, 2021

TR-069 uses several remote procedure calls whose definition determine the types of TR-069 messages that are sent and received by an ACS or CPE. Every RPC is defined in the TR-069 base XML schema which can be found on the Broadband Forum website.

Videos

Session Retry Mechanism

February 02, 2021

Every TR-069 session is initiated by a CWMP endpoint that is looking to deliver an event. These events have different delivery requirements, using language such as “must not discard”, “must retry until reboot”, “may retry” and “must not retry”.

Videos

Notifications

February 02, 2021

In TR-069, the 4 Value Change event code is used when a parameter set for notification is changed by any mechanism other than the ACS. These conditions are set using the SetParameterAttributes RPC.

Videos

XMPP Connection Request Mechanism

February 02, 2021

There’s one caveat to ConnectionRequests - they require that the CPE can be reached by the ACS over HTTP. For endpoints that may reside behind a Gateway, this is not the case, thanks to Network Address Translation or Firewall rules.

Videos

Connection Request Basics

February 02, 2021

Though every TR-069 session is initiated by the CPE endpoint, sometimes it’s necessary for the ACS to request that the CPE contact it immediately. To do this, TR-069 defines a Connection Request mechanism in CWMP, which allows the ACS to stimulate the CPE to begin a session.

Videos

ACS Discovery

February 02, 2021

In TR-069, the CPE is always initiates a session. When making first contact with an ACS, how does it know the ACS URL it is supposed to contact?

Videos

Event Basics

February 02, 2021

Every TR-069 session is initiated by a CWMP Endpoint on a CPE. These sessions always occur for a specific reason, called an “Event”. All of the Events that have yet to be delivered to the ACS are contained as arguments in the Inform RPC at the start of every TR-069 session.

Videos

Overview of a TR-069 Session

February 02, 2021

TR-069 refers to the Technical Report published by the Broadband Forum that defines the CPE WAN Management Protocol, or CWMP. CWMP was developed to allow providers of broadband services to deploy and manage customer premises equipment in home and business networks.

Articles, Webinars

Improving TR-069 and USP Interoperability Through Certification

March 19, 2021 · 1 min read

The widely deployed TR-069 protocol and its successor, the User Services Platform (TR-369) are complex and powerful technologies that have successfully brought real value to operators, application vendors, and CE manufacturers. The key to that success is the standardization that can be tested and validated through certification programs.

Articles

Testing your own TR-069/USP deployment scenarios

January 10, 2022

Learn how you can test your own TR-069 or USP deployment scenarios using CDRouter to automatically configure devices for testing, replicate your device onboarding process, reproduce field issues, and connect your device to a live TR-069 ACS or USP Controller and monitor traffic.

Articles

What's new in the TR-181 Device:2.15 data model for USP and TR-069

January 28, 2022

The data model that defines what can be managed, monitored, and manipulated by TR-069, and its successor, USP/TR-369, is frequently updated to include new capabilities and interfaces to enable service provider control of the home network. As new technologies emerge, Broadband Forum members contribute to the next version of TR-181 in a fairly fast revision cycle.

Articles

What's new in the TR-181 Device 2.16 data model for USP?

June 22, 2023

Here is a quick overview of the capabilities available in Device:2.16 for developers building USP products and applications, and for operators looking to deploy them.

Talk to an expert

Talk to an expert

Our team is happy to answer your questions or give you a demo. Drop us a line and we will get in touch!

Let's chat