ACS URL configuration via DHCP Vendor Specific Information

As stated in TR-069, a CPE has 3 ways to know about the ACS URL it has to use for configuration and management; 2 of these ways are not very exciting, while the remaining one opens interesting scenarios for a true plug-and-play deployment.

The not less interesting ACS configuration methods expect the URL to be built-in in the CPE (by factory, for example), or to be configured locally via a LAN-side CPE auto-configuration protocol.

The really interesting method is based on DHCP. Anyway, a CPE doesn’t need to implement this or other methods to be TR-069 compliant; all of them are optional.


A CPE which implements this mechanism sends a DHCP Request with the string “” in the Vendor Class Identifier (DHCP option 60); at this point, the DHCP server can send back a DHCP ACK with the Vendor Specific Information (DHCP option 43) containing CWMP informations.

This option lets DHCP servers to send one or more vendor specific parameters to clients, encoded in the form option_code/value_length/value; CWMP specifies two parameters: option code 1 for ACS URL and option code 2 for the ProvisioningCode.

When CPE receive the URL it can start the standard CWMP connection and operations with the given ACS.


The use of this mechanism let us to build interesting scenarios: you can deploy CPEs at the customer sites without a line of configuration, you can bind CPEs CWMP ID to a customer and let DHCP/ACS do the rest, or interact with a RADIUS server to obtain the circuit ID by the IP address and automatically bind it to the right customer.


Microsoft Windows Server 2003

DHCP Option 43 on Win2K3 for ACS URL To setup your Microsoft Windows Server 2003 box to send DHCP Option 43 you have to edit the Scope Options and configure it in a way like the one you can see in the image (click to enlarge). To reach this window, you have to open the DHCP management console from the Administrative Tools, then expand the Superscope and the Scope you want to apply the option to. In the example, we used the URL


To configure dhcpd, you can use the option vendor-encapsulated-options option:

subnet netmask {
        option routers;
        append dhcp-parameter-request-list 43;
        option vendor-encapsulated-options 01:11:68:74:74:70:3A:2F:2F:61:63:73:2E:6D:65:2E:63:6F:6D;

In any case you have to remember the 3 fields: option_code, value_length and value.
In this example we use as ACS URL, so our option will contain 0x01 (CWMP option for ACS URL), 0x11 (hex of decimal 17 = length of the URL) then the other 17 bytes forming the URL.

You may ask: why the append dhcp-parameter-request-list 43?;
Well, I tested this ACS discovery mechanism with an AVM Fritz!Box Fon 7170 firmware 58.04.67 at its factory settings; I plugged the LAN cable on its LAN1 interface then I powered it up. When it sends its DHCP REQUEST, it does not insert option 43 in the Parameter Request List, so dhcpd doesn’t send it back to the CPE. The above command tells dhcpd to always send option 43 in the OFFER/ACK.


TR-069 at Boadband Forum, par. “3.1 ACS Discovery”;

RFC2132 – DHCP Options and BOOTP Vendor Extensions, par. “8.4. Vendor Specific Information”.

The following two tabs change content below.
Italian, born in 1980, I started working in the IT/telecommunications industry in the late '90s; I'm now a system and network engineer with a deep knowledge of the global Internet and its core architectures, and a strong focus on network automation.

Latest posts by Pier Carlo Chiodi (see all)


  1. Sondre says:

    Hi Pierky!

    Your post are awesome, we setup the openacs server in notime! 🙂

    We are currently testing this with Thomson TG787i and Thomson TG784i DSL modems, but unfortunately I have a hard time getting the DHCP Option 43 to make it’s magic. I have altered the value_length and value to suit our needs, and with tcpdump I see that it’s sending the option to the modem, but the modem will not respond to it and change it’s ACS URL.

    Do you have any ideas or experience with Thomson modems on this matter?


    • pierky says:

      Hi Sondre,

      thanks for your comment! 😉
      Unfortunately I have no experience with those products! All I can tell you is that not all the CPEs implement DHCP ACS discovery method. Have you already checked this with the vendor?

      I can also suggest you to give a look at OpenACS support forum @

      Maybe there you could find some interesting answers!

      Good luck 😉

  2. Ben says:

    Another method that does not require you to calculate the hex values manually is as follows (for ISC)

    # Define a custom option space for tr069 options
    option space tr069;
    option tr069.acs-server-url code 1 = text;
    option tr069.provisioning-code code 2 = text;

    And then within the scope where you would like to assign the options

    # host or class or subclass, etc.
    host blah {
    # Encapsulate option space in vendor option (43)
    vendor-option-space tr069;
    option tr069.acs-server-url “http://url/of/acs/server”;
    option tr069.provisioning-code “special-code”;

    This makes it a bit easier to maintain without dumping the hex back into a tool to convert it.

  3. suriani says:

    hi pierky

    thanks for your post

    can i know if this configuration can be use for linux system.

  4. donkey255 says:

    Salve Pier

    Your contribution was vey helpful for me, at this point I would like to thank you!

    I still fight now with cisco DHCP does not send option 43 in OFFER/ACK to the CPE like ISC-DHCPD.

    Many ISPs still use cisco equpement in their infrastructure, may be you have experience how this is going on at your side ? I am pleased about a short feedback, molte grazie in anticipo.

    Cari saluti

Leave a Reply