TR-369 USP for ISPs
ISPAgents is designed to support TR-369 USP as a modern CPE management path and to help operators plan a USP Device Certification Program for existing agents or compatible router firmware.
Integration status and evidence
USP is a modern CPE operations path
TR-369 USP gives broadband operators a modern way to work with compatible CPE agents. For ISPAgents, the opportunity is not only protocol support. The value is connecting USP actions and telemetry to billing, support, field service, inventory, access control, and operator-reviewed AI assistance.
ISPAgents should keep USP separate from TR-069/CWMP while supporting coexistence because real ISP networks will run mixed fleets for years.
USP workflows for broadband teams
- Provisioning: apply profiles when CPE is installed, replaced, upgraded, or reset.
- Diagnostics: give support and NOC current device context before escalation.
- Telemetry: feed useful CPE signals into customer history and incident workflows.
- Inventory: tie agent identity, serial number, model, interfaces, Wi-Fi, APs, site, and service owner together.
- Safe operations: queue standard Get, Set, Operate, and Subscribe actions with audit and lifecycle tracking.
- AI assistance: summarize CPE state, likely next action, and missing evidence for operator review.
- Coexistence: run USP, TR-069, SNMP, APIs, and custom agents according to equipment reality.
USP Device Certification Program
Clients should treat USP enablement as a certification program with two possible paths.
- If the router already has a USP agent, ISPAgents validates it with tenant-prefixed credentials, MQTT ACLs, data-model discovery, certified workflows, and recovery tests.
- If the router has no USP agent, ISPAgents assesses firmware access, packaging feasibility, vendor adapter needs, TR-181 mapping, and rollout limits before any enablement commitment.
The program should produce a certification row per router model and firmware range: vendor, product class, USP version, transport, supported workflows, known limitations, security evidence, test evidence, and rollout status.
The public framework is the USP Device Certification Program: Integration Ready, ISPAgents Certified, and ISPAgents Advanced Certified.
Certification checklist
- Feasibility: firmware type, package system, storage, RAM, persistence, and upgrade behavior.
- TR-181 mapping: DeviceInfo, Ethernet, IP, Wi-Fi Radio, SSID, AccessPoint, diagnostics, Bulk Data, and SoftwareModules where supported.
- Security: tenant-prefixed usernames, strict topic ACLs, no bare usernames, credential-path protection, and optional future USP mTLS.
- Lab proof: first contact, reconnect after reboot, data-model discovery, interface inventory, Wi-Fi and AP reads, diagnostics, and bad-credential recovery.
- Canary proof: one tenant, one device class, optional mode first, monitored operations, and rollback instructions.
Why ISPs need protocol flexibility
No serious ISP platform can assume one protocol, one vendor, or one perfect fleet. A full product should validate:
- TR-369 USP for compatible modern CPE agents.
- TR-069 ACS workflows for existing CPE fleets.
- SNMP and vendor APIs where they are more practical.
- MikroTik RouterOS control for access and routing workflows.
- FreeRADIUS and managed RADIUS early access paths for subscriber authentication and policy.
- Custom agents for private networks, NATed sites, or unusual equipment.
FAQ
Should ISPs choose TR-369 USP or TR-069?
Most operators should expect coexistence. TR-069 remains common in existing fleets, while TR-369 USP is a stronger path for compatible modern devices and newer management models.
How does USP connect to AI assistance?
USP can provide device context that AI assistance can summarize alongside billing, RADIUS, router, support, and field-service evidence. The summary should explain what is known, what is missing, and what action is safest for operator review.
Can ISPAgents help build a USP agent?
Yes, after feasibility review, when the client or vendor provides a workable firmware path such as OpenWrt, Yocto, vendor Linux, an SDK, a package system, or direct vendor cooperation. If the device cannot run a persistent agent or expose the needed network configuration APIs, ISPAgents should certify the limitation and choose a different management path.
Continue the operations map.
Controller Integrations
Pull devices, topology, and telemetry from external controllers — Ubiquiti UniFi, Cambium cnMaestro, and UISP — into one tenant-scoped pane, mapped to canonical devices. Read-only and safe. This is early access.
Open pageIntegrationsFreeRADIUS Integration
Keep your existing FreeRADIUS where it works, or move selected access workflows to Managed RADIUS early access after tenant launch signoff.
Open pageSolutionsAutomatic Internet Suspension Software
Design suspension and restoration workflows without losing control by connecting billing, payment evidence, RADIUS, MikroTik, custom agents, approvals, and rollback evidence.
Open pageSolutionsCustomer Self-Service App
A phone-first app for an ISP's subscribers — view plan and balance, track data usage, pay, and open support — branded to the operator. Account and usage are live today; CPE controls are on the way.
Open page