Calix CMS - Setup an AE ONT Boot Server in Rocky Linux

This article is to show how to setup a standalone AE ONT boot server for AE ONTs. This may be necessary after migrating to DHCP+ server software..

Install Rocky Linux. Do NOT use a standard N-Com password for root!

Install software

We will want to install and setup some software as part of the setup.

First, make sure to enable the epel repo

dnf install epel-release

Next we need to enable the CRB repo

dnf config-manager --set-enabled crb

Now install all of the desired packages for this server

dnf install bash-completion net-snmp tftp-server proftpd vim -y

Create user

Next we will create a user for the FTP home directory and TFTP boot files. Traditionally, we call this user something like "cmsftp". When you create the user be sure you document the username and password in Bitwarden.

Run the useradd command to create the user, we will create the user with default settings so this is straightforward

useradd cmsftp

Next we need to set the password. This is done with the passwd command:

passwd cmsftp

you will need to enter the new password twice to set it

Setup FTP

We will setup FTP to use a directory called "tftpboot" in the cmsftp user home directory (absolute path /home/user/cmsftp/tftpboot)

First become the user, the create the directory, then use exit to go back to being root

su - cmsftp
mkdir tftpboot
chmod 777 tftpboot
exit

Next, we will setup some firewall rules

firewall-cmd --add-service=tftp --permanent
firewall-cmd --add-service=ftp --permanent
firewall-cmd --add-service=snmp --permanent
firewall-cmd --reload

The basic configuration for proftpd works fine and needs no tweaking for the server to work, so now we only need to enable it

systemctl enable --now proftpd

Setup TFTP

Setup selinux to allow the TFTP and FTP daemons access to various things

setsebool -P tftp_home_dir 1
setsebool -P ftp_home_dir=1
setsebool -P allow_ftpd_full_access=1

Next, we need to setup the TFTP daemon configuration. Using vim or nano edit the systemd unit file as follows:

Filename: /usr/lib/systemd/system/tftp.service

[Unit]
Description=Tftp Server
Requires=tftp.socket
Documentation=man:in.tftpd

[Service]
ExecStart=/usr/sbin/in.tftpd -vvv -s /home/cmsftp/tftpboot
StandardInput=socket
User=root

[Install]
Also=tftp.socket

reload the unit files and start the service

systemctl daemon-reload
systemctl enable --now tftp.service

Setup CMS

Now we need to setup CMS with the details of our new server. Login to CMS and go to SYSTEM->AE SETTINGS.

Fill in as follows:

Disable FTP Server #2
FTP Server #1
- Protocol: FTP
- IP Address: Address of new server
- User Name: As setup in server
- Password: As Setup in server
- Folder: tftpboot (this is a subdirectory in the cmsftp user directory)
- TFTP Server #1: Address of new Server
- TFTP Server #2: Usually blank

Click the TEST button and make sure everything works.

After you change the settings click APPLY

Next we need to get the config files on the new server. Go to SYSTEM-> SCHEDULED TASKS-> AE ONT

Click Create and fill in the form as follows:

Make sure you select Sync All. This will sync the files to the new server without rebooting the ONTs.

Setup the DHCP Server

NOTE in this setup we are defaulting to a single server, so secondary server will be left blank most of the time.

Go to the DHCP server and enter the CLI.

First setup the option 43 config. Put in the CMS IP as the cms and syslog option.

dhcpv4
 option43-calix-ont-settings 
       cms 192.168.0.62
       syslog 192.168.0.62
     exit-option43-calix-ont-settings

We then need to configure the pool itself. Note that we add the following at the pool level

server-name -> IP address of our new boot server

include-option43 calix-ont-settings

pool Vlan85_AE_ONT_MGMT
      server-name 69.55.16.40
      include-option43 calix-ont-settings
      network 192.168.18.0/23
        default-gateway 192.168.18.1
        range 192.168.18.2 192.168.18.254
        range 192.168.19.2 192.168.19.254
      exit-network
    exit-pool

When you are done with the settings commit the config

Other Important Steps

Make sure the following is true!

Server has been added to Nakivo or other appropriate backup jobs
SNMP has been setup and server has been added to monitoring in LogicMonitor