ISP Configuration ManagementJun 7, 2026 6 min read

Ciena 6500 TL1: How GNE/RNE Routing Works, With Real Session Output

How Ciena 6500 TL1 reaches remote NEs through a gateway: RTRV-NE-LIST, TID routing, the DENY codes that matter, and real session output.

rConfigAll at rConfig

Ciena 6500 TL1: How GNE/RNE Routing Works, With Real Session Output

Your collector can reach one Ciena 6500 shelf over SSH. It needs to back up nine. The other eight have no management IP you can get to, and they never will, because that is how the network was built.

This is the gateway and remote NE model, and it is the first thing that trips up any tool written for routers. This post walks through it with real TL1 sessions. The output is from rConfig Sim, our open source device simulator, which we use to test the rConfig Ciena TL1 driver. Names and serials are made up. The behaviour is not.

Gateways and remote NEs

A Gateway NE (GNE) is the shelf with a reachable management address. A Remote NE (RNE) sits behind it, connected over the optical network's own data communications channel, with no direct path from your management network.

So you do not log in to an RNE. You log in to the GNE and ask it to pass your commands along. In TL1 that is done with the target identifier, the TID, the second field of every command. Leave the TID empty and the GNE answers for itself. Put an RNE's name in it and the GNE forwards the command.

That one field is the whole trick. Most of what follows is about what goes wrong around it.

Logging in happens after SSH, not during it

On a router, a successful SSH login means you are in. On a 6500 over TL1 it means you have a pipe. Authentication is a TL1 command, ACT-USER, and until you send it the shelf refuses everything with PLNA (privilege, login not active):

RTRV-SYS:::CTAG001;
   CIENA-LAX-1001 26-06-07 11:42:13
M  CTAG001 DENY
   PLNA
;

ACT-USER::admin:CTAG002::admin;
   CIENA-LAX-1001 26-06-07 11:42:18
M  CTAG002 COMPLD
   /*AUTHTYPE=LOCAL*/
   /*USERID=ADMIN*/
;

If your tool treats "SSH connected" as "logged in", every command after that comes back denied and the backup it saves is a file full of PLNA. We have seen that file. It is a valid backup of nothing.

Reading a Ciena TL1 response

Every response has the same bones. Take a shelf inventory:

RTRV-EQPT::ALL:CTAG003;
   CIENA-LAX-1001 26-06-07 11:42:25
M  CTAG003 COMPLD
   "SHELF-1::PROVISIONED,TYPE=6500-7SLOT,SN=LBCQ7F3K1P,SWVER=12.4,IP=127.0.0.1:IS-NR"
   "SLOT-1:OTR2,CLEI=WMOTH4K2NP,SN=LBCQ7F3K1P01,PN=NTK547C:IS-NR"
   "SLOT-1-1::OPTIC=QSFP28,WL=1550.12,SN=LBCK9M2T4R01:IS-NR"
   "SLOT-1-2::OPTIC=CFP2,WL=1531.90,SN=LBCP3X8W2H02:IS-NR"
   "SLOT-2:WL3N,CLEI=WMOT8J3D0Q,SN=LBCR4T7Y2K02,PN=NTK583F:IS-NR"
   "SLOT-7::UNEQUIPPED:OOS-AUMA"
;

The first line is the source identifier (SID) of whoever answered, then the date and time.
M marks a response to a command, followed by your CTAG and the completion code: COMPLD or DENY.
Each quoted line is one record. Ciena records are mostly KEY=VALUE pairs, which is a kindness. Not every vendor does this.
A lone ; ends the response.

The CTAG is how you match an answer to a question. You pick it, the NE echoes it back. On a quiet session that feels pointless. It stops being pointless when alarms start arriving in the middle of your session and you need to know which block belongs to which command.

Finding the remote NEs

Before you can walk the RNEs you need their names. On the 6500 you ask the gateway with RTRV-NE-LIST:

RTRV-NE-LIST:::2;
   CIENA-LAX-1001 26-06-07 11:43:01
M  2 COMPLD
   "SHELF-1::SID=\"RNE-LIMERICK\",NENAME=\"RNE-LIMERICK\",GNE=NO,GNEIPADDR=,INETADDR=10.0.254.3,COST=30,NETYPE=00011600"
   "SHELF-1::SID=\"RNE-GALWAY\",NENAME=\"RNE-GALWAY\",GNE=NO,GNEIPADDR=,INETADDR=10.0.254.4,COST=40,NETYPE=00011600"
;

Two things worth noticing. The gateway does not list itself, so if you build your device list purely from this output you will back up every shelf except the one you connected to. And the SID values are quoted inside an already quoted record, so a parser that splits on the first " it finds will hand you garbage.

Talking to an RNE: put its name in the TID

Same command, same session, different TID:

RTRV-EQPT:RNE-LIMERICK:3;
   RNE-LIMERICK 26-06-07 11:43:08
M  3 COMPLD
   "SHELF-1::PROVISIONED,TYPE=6500-7SLOT,SN=LBC2K9F4P1,SWVER=12.4,IP=127.0.0.1:IS-NR"
   "SLOT-1:OTR2,CLEI=WMOTH4K2NP,SN=LBC2K9F4P101,PN=NTK547C:IS-NR"
;

RTRV-ALM-ALL:RNE-LIMERICK:4;
   RNE-LIMERICK 26-06-07 11:43:12
M  4 COMPLD
   "SLOT-2:MN,CONTBUS,SA,,,,:\"Intermittent equipment communication\""
;

One thing to be honest about: those two commands skip the AID field, and the simulator lets that go. A strict NE reads 3 as the AID, not the CTAG. On real kit, keep every colon: RTRV-EQPT:RNE-LIMERICK:ALL:3; and RTRV-ALM-ALL:RNE-LIMERICK::4;.

On Ciena, the header SID changes to the RNE that answered. That is useful: you can check that the reply really came from where you sent the command. Do not assume the same holds on other vendors. Infinera DTN-X, for one, answers routed commands with the gateway's own name in the header, so on that platform the header tells you nothing about routing.

When it goes wrong

A TL1 DENY carries a four-letter code, and there are three you will meet early:

PLNA: you have not logged in, or the login failed.
ICNV: command not valid. Usually a typo, or a verb this NE type does not support.
IIAC: invalid access identifier. Behind a gateway it most often means the RNE name in your TID is wrong or the RNE is unreachable.

RTRV-EQPT:RNE-NOWHERE:9;
   CIENA-LAX-1001 26-06-07 11:43:22
M  9 DENY
   IIAC
;

Note the header there: the gateway answered, because the RNE never got the command. If your tool saves that response as RNE-NOWHERE's inventory, you now have a "successful" backup of a shelf you never reached. Treat a DENY as a failed collection, always, and alert on it.

What a collector has to get right

Writing the rConfig Ciena TL1 driver came down to a short list. None of it is clever. All of it is easy to miss:

Log in with ACT-USER after the SSH session is up, and check for COMPLD before doing anything else.
Use a unique CTAG per command and match responses on it, not on arrival order.
Build the RNE list from RTRV-NE-LIST, then add the gateway itself.
Route each RNE's commands through the TID and keep a separate, versioned backup per NE, not one blob per gateway.
Treat DENY as a failure with its code recorded, so IIAC on one RNE does not hide behind a green tick on the gateway.

Get those five right and a gateway with five remotes behind it is six devices in your inventory, each with its own history and diff. That is how TL1 configuration management in rConfig handles the 6500, alongside the Cisco ONS 15454 and Infinera DTN-X drivers.

Try it without a shelf

Nobody has a spare 6500 and a handful of remotes to break things on. rConfig Sim will stand up a simulated gateway with remote NEs behind it, so you can point any TL1 client at it, ours or your own, and watch what it does with PLNA, IIAC and a gateway that leaves itself off the list.

Ciena 6500 TL1 driver reference, the full verb set and GNE/RNE behaviour
Ciena TL1 examples, every session above and a few more
Why rConfig Sim models the Ciena 6500, the background to all of this
TL1 commands and protocol guide, if you want the language itself: command anatomy, responses, alarms and error codes

Request a demo