Huawei OLT Bridge ONU , Easy

Huawei OLT Bridge ONU: Enable Traffic Between ONUs

In this guide, I'll show you how to bridge ONUs on a Huawei OLT so clients connected to different ONU devices can communicate with each other on the same Layer 2 network.

This setup was tested on a Huawei SmartAX MA5683T, but the exact same commands work on other Huawei MA5600 series OLTs (MA5608T, MA5800, etc.).

The Problem: ONU-to-ONU Traffic Is Blocked by Default

I had to link several offices of one organization into a single local network. Each office was connected through a different ONU, and by default, traffic between ONUs inside a Smart VLAN is blocked on Huawei OLTs.

Important: If your clients only need to reach different networks (different subnets/gateways), you don't need this setup — just enable proxy ARP on your core router and traffic will route through it. No OLT configuration changes are required.

This guide is for the case where clients must be in the same network — for example:

  • Office 1: receives two tagged VLANs on a managed switch — VLAN for Internet + VLAN for the local network
  • Other offices: ONUs receive the local network VLAN untagged, bridging them all together

Table of Contents

Step 1 – Create the VLAN

Create a new Smart VLAN (we use VLAN 1060 in this example):

vlan 1060 smart

Step 2 – Add VLAN to the Uplink Port

Add the VLAN to the uplink port (only needed if this VLAN must also leave the OLT):

port vlan 1060 0/9 0

Step 3 – Create the ONT Service Profile

Create an ont-srvprofile and map Ethernet port 1 to VLAN 1060:

ont-srvprofile gpon profile-id 5 profile-name "Madankc"
ont-port eth 1
port vlan eth 1 translation 1060 user-vlan 1060
commit

Step 4 – Create the ONT Line Profile

Create an ont-lineprofile with a T-CONT, GEM port, and VLAN mapping:

ont-lineprofile gpon profile-id 26 profile-name "Madankc"
tcont 4 dba-profile-id 15
gem add 1 eth tcont 4
gem mapping 1 0 vlan 1060
commit

Step 5 – Register the ONUs

Enter the GPON interface and add the ONUs by serial number. Note the ont port native-vlan command — it sets the untagged VLAN on the ONU's Ethernet port:

interface gpon 0/2
ont add 3 126 sn-auth "465454480813353C" omci ont-lineprofile-id 26 ont-srvprofile-id 5 desc "madankc onu1"
ont add 3 127 sn-auth "465454480813352A" omci ont-lineprofile-id 26 ont-srvprofile-id 5 desc "madankc onu2"
ont port native-vlan 3 126 eth 1 vlan 1060 priority 0
ont port native-vlan 3 127 eth 1 vlan 1060 priority 0

Step 6 – Create Service Ports

Create a service-port for each ONU with tag translation:

service-port 5383 vlan 1060 gpon 0/2/3 ont 126 gemport 1 multi-service user-vlan 1060 tag-transform translate
service-port 5384 vlan 1060 gpon 0/2/3 ont 127 gemport 1 multi-service user-vlan 1060 tag-transform translate

Step 7 – Enable User Bridging (The Key Step)

This is the most important step. Create a VLAN service profile with MAC-based forwarding and enable user-bridging:

vlan service-profile profile-id 1 profile-name "srvprof-1"
forwarding vlan-mac
user-bridging enable
commit

Then bind the profile to VLAN 1060:

vlan bind service-profile 1060 profile-id 1

✅ Done! ONUs in VLAN 1060 can now communicate with each other at Layer 2.

Verification Commands

Check the service profile and VLAN configuration:

display vlan service-profile profile-id 1
display vlan 1060

FAQ

Why is ONU-to-ONU traffic blocked by default?

Huawei OLTs isolate traffic between ONUs in a Smart VLAN for security. The user-bridging enable command in the VLAN service profile disables this isolation for the specific VLAN.

Does this work on MA5608T and MA5800?

Yes. The same configuration applies to all Huawei MA5600/MA5800 series OLTs running similar VRP software versions.

Do I need user-bridging if clients are in different subnets?

No. If clients use different subnets and gateways, traffic will naturally pass through the router — just enable proxy ARP on the router and no OLT changes are needed.

What does "tag-transform translate" do?

It translates the VLAN tag between the ONU side (user-vlan) and the OLT network side (vlan), allowing flexible VLAN mapping per service port.

Related posts: