OLT SNMP: field guide

ISPMan monitors OLTs (Optical Line Terminals) over SNMP. An OLT usually sits on the local network behind one of your managed routers. This guide covers the official ISPMan workflow for adding and monitoring an OLT, plus general SNMP background and a worked example.

⚠️ Nothing here is universal. The community string, OLT LAN IP, SNMP port, and monitoring server IP are all generated or assigned per OLT on the ISPMan side — they are not fixed values you can reuse across devices. Always pull the actual values from that specific OLT’s page in ISPMan rather than copying values from another OLT or from this document.

Prerequisites

The router the OLT sits behind is added to ISPMan and online.
You know the OLT’s local IP address (the address it has on the router’s LAN, e.g. x.x.x.x).
You can log into the OLT’s web or CLI to enable SNMP.

Step 1 — Add the OLT in ISPMan

Go to Devices → OLTs → Add OLT and fill in:

Parent router — the router the OLT is connected behind.
Name and Brand (e.g. V.SOL).
OLT LAN IP — the OLT’s address on the router’s local network.
OLT SNMP port — the port the OLT listens on for SNMP. Defaults to 161.
SNMP community — a memorable value is generated for you (e.g. shimmeringbrain). You’ll configure the same value on the OLT. Use “Generate a new community” to change it.
Public IP (optional) — only if the OLT is directly reachable on a public address. Add :port if it’s published on a non-standard port.

This community string, port, and IP are specific to this OLT record — a different OLT you add later will get its own generated community and may use a different port.

Step 2 — Allow ISPMan to reach the OLT

When the OLT sits behind a managed router, ISPMan needs the router to forward monitoring traffic to it. Open the OLT’s page in ISPMan — under “Router command” you’ll find a ready-to-run command tailored to this specific OLT.

Copy the command from the OLT page.
Paste it into the router’s terminal.
The command is safe to run more than once — it only adds the rule if it isn’t already present.

What’s set up manually vs. what ISPMan provides

On a MikroTik router, getting an OLT monitored splits into two categories of config:

Configured manually, once, when the OLT is first connected (management VLAN and addressing — not provided by ISPMan, and not on the WireGuard/ISPMan-assigned network — this is your own local addressing):

/interface vlan
add interface=ether2 name=OLT-mgnt vlan-id=7

/ip address
add address=x.x.x.x/24 interface=OLT-mgnt network=x.x.x.0

(Interface, VLAN ID, and subnet will differ per deployment — this is just an example of the shape of the config.)

Pasted from the ISPMan dashboard — the SNMP and web forwarding rules under “Router command” on the OLT’s page. These are generated per-OLT and look like this:

/ip firewall nat
add action=dst-nat chain=dstnat comment=olt-snmp:<olt-id> dst-port=<external-port> \
    in-interface=wg-ispman-v4 protocol=udp to-addresses=<olt-lan-ip> to-ports=161

add action=dst-nat chain=dstnat comment=olt-web:<olt-id> dst-port=<external-port> \
    in-interface=wg-ispman-v4 protocol=tcp to-addresses=<olt-lan-ip> to-ports=443

The dst-port (external, on the ISPMan VPN side), olt-id, and to-addresses (the OLT’s LAN IP, e.g. x.x.x.x — this is your local network, not a WireGuard-assigned address) are unique to each OLT and each ISP’s deployment — always use the exact command shown on that OLT’s page rather than reusing one from another OLT or router.

Step 3 — Enable SNMP on the OLT

Log into the OLT’s web/CLI and open the SNMP settings.

Enable SNMP v1/v2c and make sure the agent listens on the SNMP port you set in ISPMan (default 161).
Under the Community table, add a Read-Only community whose name exactly matches the ISPMan community (e.g. shimmeringbrain).
Permit SNMP access from the router’s subnet. Most OLTs have an access-control/firewall list that limits who may query SNMP. Add a rule that permits SNMP from the /24 subnet of your router’s management IP (shown on the OLT’s page in ISPMan). Router management IPs come from the ISPMan-assigned WireGuard network, so they’ll follow a 10.x.x.x pattern — for a router whose management IP is 10.x.x.x, permit the whole 10.x.x.0/24.

Example SNMP access rule on the OLT

Action	Type	Service	Source subnet
Permit	IPv4	SNMP	10.x.x.0/24

Match the source subnet to your router’s management IP (always a 10.x.x.x address, since it’s assigned over the ISPMan WireGuard network): e.g. 10.x.x.x → 10.x.x.0/24. This subnet is different for every deployment — always read it off the OLT’s page in ISPMan rather than assuming a value.

⚠️ The community is a shared secret — it must be identical on ISPMan and the OLT. If you regenerate it in ISPMan, update the OLT too, or monitoring will stop working.

Step 4 — Verify

On the OLT’s page, click Poll now.
On success you’ll see system info, PON ports (with ONU counts), the ONU list, VLANs, and metric charts populate.
If it fails, the message tells you why — most often the community doesn’t match, the router command hasn’t been applied, or SNMP isn’t enabled/allowed on the OLT.

💡 Once verified, ISPMan keeps the OLT’s dashboard and charts up to date automatically.

Background — How SNMP Monitoring Works (General, Any Vendor)

The steps above are the ISPMan-specific workflow. Underneath, every SNMP-capable OLT (V-SOL, Huawei, ZTE, FiberHome, BDCOM, etc.) follows the same protocol mechanics:

Component	Role
Manager	The NMS/monitoring server that sends requests — in this case, ISPMan
Agent	The SNMP service running on the OLT
MIB	The schema describing everything the OLT can report
OID	A specific data point inside that schema (e.g. optical RX power)
Community string	The “password” used for SNMPv1/v2c authentication — unique per OLT in ISPMan, not a fixed value
Trap	An unsolicited alert the OLT pushes to the manager (e.g. ONU offline)

SNMP uses UDP port 161 for polling (GET/WALK) and UDP port 162 for traps.

The four things that must always be true (any vendor, any platform)

SNMP service is enabled on the OLT (most vendors ship it disabled by default).
The community string matches on both the OLT and the monitoring platform — regenerated values must be updated on both sides.
The manager’s IP/subnet is allowed through the OLT’s access-control list.
Routing works both ways — the OLT needs a route back to the monitoring server’s subnet, or SNMP replies never arrive even though the request was received. This is the most commonly missed step.

Vendor notes

Vendor	SNMP default state	Typical MIB namespace	Notes
V-SOL	Disabled by default, enable under `System Configuration → SNMP`	Vendor-private MIB (varies per model/firmware)	ACL often has default deny rules for SNMP/Telnet that must be edited
Huawei (MA5600/MA5800)	Configurable via CLI	`1.3.6.1.4.1.2011.*`	Well-documented OID trees for ONT optical power, status, MAC counts
ZTE (C300/C320)	Configurable via CLI	`1.3.6.1.4.1.3902.*`	Similar community/ACL model
FiberHome	Configurable via CLI/Web	`1.3.6.1.4.1.5875.*` (varies)	LibreNMS ships a community MIB for FiberHome OLTs
BDCOM	Configurable via CLI	Standard MIB-II + private extensions	Cisco-like `snmp-server` syntax

Worked Example — V-SOL OLT via CLI

This mirrors Steps 2–3 above but shown as raw CLI commands, useful when the OLT doesn’t expose every access-list option in its web UI. Substitute your own community string, IPs, and port — the ones below are illustrative only.

Addresses that come from the ISPMan-assigned WireGuard network (the monitoring server IP, the router’s management subnet) follow a 10.x.x.x pattern.
Addresses that are purely local to your own network (the OLT’s LAN IP, the mgmt VLAN gateway) are shown as x.x.x.x since they can be anything you’ve assigned.

enable
config
snmp-server start
snmp-server community <your-ispman-community> ro
snmp-server host 10.x.x.x udp-port <port> version 2c community <your-ispman-community>
login-access-list permit snmp 10.x.x.0/24
ip route 0.0.0.0 0.0.0.0 x.x.x.x
write

Test from the monitoring server before relying on ISPMan’s “Poll now”:

snmpwalk -v 2c -c <your-ispman-community> x.x.x.x 1.3.6.1.2.1.1

If this returns system info (uptime, sysName, sysDescr), SNMP is reachable and ISPMan’s poll should succeed.

Quick Troubleshooting Checklist

SNMP service enabled on OLT
Community string on the OLT exactly matches the one shown on the OLT’s ISPMan page
Router command from ISPMan’s OLT page has been run on the parent router
ACL/access list on the OLT permits SNMP from the router’s management /24 subnet
OLT has a route back to the monitoring server’s subnet (default route or static route)
snmpwalk/snmpget from the manager returns data before expecting ISPMan’s poll to succeed
Firewall/NAT on any router in between isn’t blocking UDP 161/162