ZTE MF286D and forcing B1+B3+B7

[Mig25]

Having this modem with the Nordic brand on the website, I could force at most two bands, I don't have a choice of three individual bands, only All at once. Especially in Play I could not get rid of the B20.

After a lot of research, I found that the site sends the appropriate values ​​for each band to the modem, and so
B1 - 0x1
B3 - 0x4
B7 - 0x40
B8 - 0x80
B20 - 0x80000
B38 - 0x2000000000

And now, if we want to aggregate any of the above bands, we add the values, remembering that MF286D can aggregate up to three bands, for B1+B3+B7 the value is 0x45.

1. We go to the router page with the selection of bands in the Chrome browser
2. Go to the tab with the selection of bands (in my case this http://192.168.32.1/index.html#lock_band ) and press Shift+Crtl+I (or look in the Developer Tools menu).
3. In the tool, click on the Elements tab (and if it is already open to the Html text below, to select this window) press Ctrl+F and look for the text "lockOptions, " (without quotes), then click a few times on it to remove ( together with the comma and space after it, so that the text "value" is in its place
4. two paragraphs below is a line with the text: LTE Band 0(1MHz) we're trying to replace it with B1+B2100+B0
(If you don't see these paragraphs, press the small right-pointing triangle to change it to a down-pointing triangle )
I don't edit the first line with All.
5. Now you can close the developer tool with a cross in the upper right corner (not necessary), and now the option B1+B2100+B1 will appear on the page in the drop-down menu instead of LTE Band 3(7MHz), if you select it and press Apply, you must believe that the modem just blocked these Bands. (On this page when you enter here, All will be selected all the time, only where you can see it is on the main page that B20 will not jump anymore).

Of course, after opening the browser again, there will be no trace of our changes, but the modem will remember this choice even after a reboot or power outage. It will definitely lose this setting after a factory reset and most likely after a software update.

[Mig25]

In addition, the router has a serial console, and you can get to it quite easily with a USB-ttl converter.
The logs are still flying to the console, but after pressing ENTER, a prompt and quite a bit of Openwrt (here in the CC version) are shown.
some commands to check:
It will display the current aggregation:

Code: Select all

echo -e -n 'AT+ZNLOCKBAND?\r' > /dev/ttyUSB1 && grep -m1 "ZNLOCKBAND:" /dev/ttyUSB1


It will set the aggregation to B1+B3+B7 (according to the codes above):

Code: Select all

echo -e -n 'AT+ZNLOCKBAND=1,0,45,0\r' > /dev/ttyUSB1


It will show information about aggregation:

Code: Select all

echo -e -n 'AT+ZCAINFO?\r' > /dev/ttyUSB1 && grep -m1 "ZCAINFO:" /dev/ttyUSB1


[Mig25]

I was able to upload the "browser" from the Nordic (Scandinavian) version to the MF286D router from the Play distribution, add this menu for forcing the B1+B3+B7, B1+B3+B20 and B3+B7+B20 bands (I don't know if they are still needed some other combinations), somehow translate into Polish.
In addition, Samba support is enabled (Play does not have it).
Also, if anyone needs an opinion on the choice of bands, please pm me. (To change it, you have to unscrew the router, so unfortunately it is out of warranty).

[onken]

Does this band binding via the website work for modems from Play?

[Mig25]

Unfortunately, not for this to work on the Play website, you need to modify the firmware so that the lockband tab is there, and this still requires a console. And since you already have a console, you can do it right away with the commands above.

[pppp]

Good job,
Please show for posterity how to modify the serial console gui of the modem from Play with a band selector from Nordic.

The band selector itself is one thing and the ability to place in the primary cell would be useful.

I had such a ficzer in B525 and it did the job.
For example, I had only bands 1800 +800 selected. And the trash randomly set once 800 and once 1800 as the primary cell.
The transfer was good at primary 800 and to D at 1800. Finally I found a soft that had it covered
The primary cell was permanently located there by giving the command via telnet with the parameter: PCI , band and frequency.
So cell fix 307 20 8110 (fix on PCI 307, band 20, freq 810.0MHz)
cell unfix removed cell placement
There was also the possibility of locating on the gui - not only by telnet

I have a guarantee...

[Mig25]

Here's the entire fw nordic dump: https://eko.one.pl/forum/viewtopic.php? ... 09#p256209
you need to replace mtd8, and it's best to edit it. In the latest Nodic, selecting Bands for Upload is added, but in Poland it has no reason to be (because upladu every operator blocks aggregation).
The command is 'AT+ZULCA?'
After you can change the aggregation in the Play software using a script: viewtopic.php? f = 11 & t = 47687 & p = 631704 # p631704
Or this program: https://www.mediafire.com/file/f7r0ui5f ... d.zip/file
The web change has lost its raison d'être.

[Mig25]

The Italians made an addition to CHROM (similar to Huwei), in which the signal, current aggregations are quite clearly shown, and you can also set your own;
https://www.youtube.com/watch?v=giGz7J38XvA

[sim]

Hi,

I have a ZTE MF286D router from the PLAY distribution (purchased from this operator together with the subscription). Here is information about the firmware and software that I managed to extract from the reworked zte_getbandinfo.py script.
{'hardware_version': 'MF286DHW1.0'}
{'wa_inner_version': 'BD_NTTPLMF286DMODULEV1.0.0B01 [Oct 10 2020 10:25:56]'}
{'network_provider': 'Play'}
{'cr_version': 'CR_NTTPLMF286DV1.0.0B01'}
{'cr_inner_version': 'CR_NTTPLMF286DV1.0.0B02'}
{'wa_inner_version_tmp': 'BD_NTTPLMF286DMODULEV1.0.0B01 [Oct 10 2020 10:25:56]'}
{'integrate_release_version': 'NTT_PL_MF286DV1.0.0B02'}
{'integrate_version': 'NTT_PL_MF286DV1.0.0B02'}
{'wa_version': 'BD_MF286DMODULEV1.0.0B01'}
{'wa_version_tmp': 'BD_MF286DMODULEV1.0.0B01'}
{'new_version_state': 'version_idle'}

I really care about 3xCA aggregation, but unfortunately with such a good signal quality as below, I only have a main carrier on B7 and an additional one on B1. What's more, I connected the phone to the same eNodeB and I have B7+B1+B3 aggregations, so the conclusion is that this eNodeB has the ability to aggregate these bands.

And this is how it looks from the perspective of the zte_getbandinfo.py script.
Z_SINR: {'Z_SINR': '21.8'}
Z_rsrq: {'Z_rsrq': '-7.0'}
rssi: {'rssi': '51'}
lte_rsrp: {'lte_rsrp': '-74'}
lte_ca_pcell_band: {'lte_ca_pcell_band': '7'}
lte_ca_pcell_bandwidth: {'lte_ca_pcell_bandwidth': '20.0'}
lte_ca_pcell_arfcn: {'lte_ca_pcell_arfcn': '3350'}
lte_ca_scell_band: {'lte_ca_scell_band': '1'}
lte_ca_scell_bandwidth: {'lte_ca_scell_bandwidth': '15.0'}
lte_ca_scell_arfcn: {'lte_ca_scell_arfcn': '523'}
lte_ca_scell_info: {'lte_ca_scell_info': '229,2,1,523,15.0;'}

In light of the above, I have the following questions for you:
1. Has anyone managed to aggregate 3*CA (3 bands) on the MF286D from the PLAY distribution (FW='CR_NTTPLMF286DV1.0.0B01') in the Play network?
2. Would changing the firmware on my ZTE MF286D solve my problem with the lack of 3xCA aggregation? If so, which firmware would solve my problem?

Many thanks in advance for your answer

[Mig25]

On the Play software, I had no problem aggregating the three B7+B1+B3 bands.
Maybe you played around with the aggregation script before and set some custom one.

[barney87]

Hello!
I'll dig up the topic a bit. I bought MF286D with NTT software, I was able to switch to nordic b11 using the framework. Everything is running nicely, many more configuration options are available. The only problem I have is setting the right bands. I definitely want to have b1 aw ca b3 + b7 as main (in this configuration I get the best dl results) and the only option to do that is to use the aforementioned chrome script from my colleagues from Italy. The problem occurs when the device is restarted - the given bands are still aggregated, unfortunately, in a different configuration. Is there any way to save this band setting without disassembling the device? Or maybe I misunderstand it and the device aggregates 3 bands together? Only then, why does the concept of "main" and "ca" appear as separate items and I get different dl results in this and not another configuration?

[Mig25]

You probably understand it well, there is a base band, and additional bands are aggregated to it (i.e. joined together). In addition, upload in most cases takes place only in the baseband (upload aggregation has only Orange at the moment and probably not everywhere).
And which is the base band, it is not only the router that decides, but also the BTS.
You could try with cell lock (although it doesn't work in Play), but you would have to either upload it with the Openwrt framework, or disassemble the router and get to the console.

[jfk]

In addition, upload in most cases takes place only in the baseband (upload aggregation has only Orange at the moment and probably not everywhere).

In MF286D / Orange, aggregation works very well. Unlike MF289F-in Łódź, it worked for me on BTS, here I do not want to, unlike 286D (maybe it's a matter of configuring external antennas - because the modem used them).

[jfk]

PS Aggregation/upload.

[Mig25]

Maybe try to force two bands on MF289F on which MF286D aggregates UL?
Generally, the MF289F has a better modem, aggregates four bands, but unlike the MF286D, the lockcell does not work (although the commands accept it), there is no VoLTE, and maybe there is no CA UL ...
Maybe someone can solve these issues programmatically.

[jfk]

Maybe try to force two bands on MF289F on which MF286D aggregates UL?

I got it from Vodafone and there is no force bands option in the GUI. The upload aggregation works on B1, B3, B7 (although I did not check with B20 due to the load on this band).

Generally, the MF289F has a better modem, aggregates four bands, but unlike the MF286D, the lockcell does not work (although the commands accept it), there is no VoLTE, and maybe there is no CA UL ...
Maybe someone can solve these issues programmatically.

MF289F aggregates upload-proven, except that in Łódź BTS is close, less than 500m / with an external antenna connected, but at such a distance it also collects signals from internal antennas well (the modem is much better / especially when BTS is loaded, it pulls stably over 50% more when aggregating 4CCA).

[Mig25]

There is no option in the GUI, but the Italian Chrome extension works (only the one for MF286D, not for example for MC801A)....

[Jazzor]

@Mig25 having experience with this modem, have you noticed an anomaly like mine, that single bands have high DL and in aggregation it drops drastically?

[Lucek1221]

Hello. Does the Zmanager application for ZTE MC286A work in this ZTE 801D router, i.e. https://sfile.mobi/tk5YgXjRo47 it's about the version with the nordic soft and from the Polish distribution as if someone could check. Thank you and best regards.

[maro_86]

Hello
I have an Orange card. So far I had B525, and now I bought ZTE MF286D with Nordic B12 soft. For the first day, the forcing of the bands worked almost perfectly. I had dn up to 70Mbps. From the next day, ZTE had transfers like Huawei up to a dozen or so Mb / s, and aggregation, despite selecting 2 or 3 bands, did not work. The router chose what it wanted, usually one band or two in some strange combination. I even tried the program given in this topic to set the bands at least 1800 and 2100, but without result. What could be the reason?

I have at least a few transmitters in close proximity:
ID: T-33113
ID: 74034
ID: T-33330
ID: 4903

[voytek]

Show what specific base station it is connecting to. The router has omnidirectional antennas so it can jump around the base stations if they are at a similar distance and have similar signal parameters.

Such a signal, so an external 1800-2600 antenna would not hurt.

[maro_86]

So even if it jumps, why can't it aggregate at least 1800 and 2100? I even checked under load when I was downloading a large file, I thought it would start then, but nothing changed.
The closest I have is ID: T-33113 about 500m in a straight line. The rest is about 1 km away.
Weird that on the first day it worked great no matter what time it was and now it's at B525.

[voytek]

We are not interested in which one is closest to you, show specific station numbers and connection parameters (from the router). Bandwidth and signal strength are not enough.

[maro_86]

eNB ID/Cell ID274034/32
eNB ID/Cell ID(HEX)42e72/20
Signal Strength-93 dBm
LTE Frequency Band2100MHz(B1)
SNR0.0 dB
Main band RSRQ-17.0 dB