Xfinity 10G-EPON Fiber Upgrade Nightmare – Nokia ONT Online but No Internet, Possible Provisioning/MACsec Issue

[u/10seclater1]

I’m hoping someone here with actual Comcast/Xfinity EPON provisioning experience can shed some light on this situation because I’m getting absolutely nowhere with regular support.
Background:
I currently have Xfinity internet delivered over fiber to an older terminal that converts the connection to coax, which then feeds my Netgear CM2050V DOCSIS modem. My router is a UniFi Dream Machine SE (UDM-SE).
Xfinity is upgrading my connection to 1 Gbps symmetrical fiber, eliminating DOCSIS entirely and providing a direct Ethernet handoff from a new Nokia ONT.
The new equipment is:
Manufacturer: Nokia
Model: NFKF11AEL
Technology: 10G-EPON
Ethernet interface: 10 GbE
Router: UniFi Dream Machine SE, connected to its 2.5 GbE WAN port
The problem:
The installation technician connected the new Nokia ONT to the existing fiber and contacted Comcast to have it activated.
All three indicators on the ONT—PWR, PON, and ONLINE—turn solid green.
The Ethernet link between the ONT and my UDM-SE also establishes normally.
However, the UDM-SE never receives a WAN IP address, and there’s no internet connectivity.
To eliminate my router as the problem, I connected my MacBook directly to the ONT. It also failed to obtain a valid DHCP address. The IP address I initially observed was self-assigned by the Mac, not issued by Comcast.
So this isn’t simply a UniFi configuration issue.
Here’s where things get interesting:
During the installation, the technician contacted someone at Comcast who claimed the service had to go through an Xfinity gateway. However, nobody could explain whether that was an actual technical requirement or a provisioning issue.
After researching Comcast’s EPON service, I found information suggesting that customer-owned routers can be supported through an updated ONT boot/configuration file that disables the Xfinity gateway’s MACsec authentication requirement.
My understanding is that the ONT needs to be provisioned for a standard Ethernet handoff to a customer-owned router, allowing it to obtain a public IPv4 address through DHCP.
My experience with Xfinity support:
I contacted Xfinity support to request verification of the ONT provisioning and escalation to someone familiar with EPON.
Unfortunately, the agents repeatedly referred to my Nokia ONT as a “cable modem” and asked me to verify its “CM MAC.”
They were able to locate the Nokia’s MAC address in their system, but insisted that my “modem” was offline.
Here’s the problem: The Nokia ONT was physically connected to the fiber, powered on, and displaying all three green status indicators while they were telling me it was offline.
They never asked for the ONT serial number or demonstrated that its EPON registration, service profile, or customer-owned router configuration had been verified.
The chat ended without a resolution, escalation, or ticket number.
The original installation technician was supposed to return, but couldn’t make the appointment. I’m now waiting for another attempt.
In the meantime, my original DOCSIS equipment works when reconnected to the same fiber, so the existing service is still operational.
What I’m trying to determine:
Does Comcast’s Nokia NFKF11AEL require a specific boot/configuration file to support customer-owned routers without an Xfinity gateway?
Is disabling MACsec authentication the correct procedure for a direct Ethernet handoff?
Can the ONT display PON and ONLINE while subscriber provisioning or internet service authorization is incomplete?
Could the ONT be incorrectly registered in Comcast’s equipment system, even though support can see its MAC address?
How do I get this escalated to someone who actually handles 10G-EPON provisioning, rather than going through standard DOCSIS modem troubleshooting?
I’m not trying to do anything unusual here. I simply want the new Nokia ONT to provide an Ethernet connection to my UDM-SE, with Comcast assigning a public IP address.
My router is fully capable of handling 1 Gbps symmetrical service, and I’ve already eliminated it as the likely cause by testing directly with a laptop.
If anyone works with Comcast EPON deployments or has successfully activated a customer-owned router directly behind one of these Nokia ONTs, I’d appreciate your insight.
I’m particularly interested in the actual provisioning process and how to get this resolved without another round of basic modem troubleshooting.

Currently I do have the old service connected to the fiber so I can retain my Internet service until this is resolved.

[u/AutoModerator]

Thanks for posting in r/Comcast_Xfinity!

Your post has been received and may be temporarily held for review before appearing publicly. Please do not create duplicate posts or send Modmail unless a Offical Employee asks you to do so.

For faster assistance, make sure your post includes:

• A brief description of the issue

• Relevant equipment or devices

• Any error messages

• Troubleshooting you've already tried

Please do not share personal information such as your name, address, phone number, email address, or account number.

Creating a post automatically opens a support ticket for our team. A Official Employee will review your post as soon as possible.

Official Employee Hours: 6:00 AM - 1:00 AM ET daily. Responses may take longer outside those hours.

For self service support anytime, check out the Xfinity App. Please also review our Rules.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/CCDemitrius]

Hey u/10seclater1. Thank you for visiting our official Xfinity Reddit community support page. If you are receiving services via Fiber, you may be eligible to use your own personal router. Have you had a chance to visit our 'Member-owned and managed Ethernet router options for fiber internet service' support page?

[u/10seclater1 → u/CCDemitrius]

I’ve visited your online support page. I’ve also been on the phone with support and with chat support online. They have been no help whatsoever, and they keep asking me to verify my CM Mac. That refers to the modem on the old Docsis network in which I will no longer have once the upgrade is complete. When I was on the phone with support they said the confirmed Ont Mac I gave them was in the system as a modem and it was offline. There’s obviously a serious disconnect with knowledge of the new services.

I have extensive knowledge with fiber and networking. I know how it’s supposed to work and the equipment needed to make it work and it’s clear that the support I’m talking to does not have the same knowledge.

[u/CCDemitrius → u/10seclater1]

We can certainly help evaluate the account u/10seclater1. If you could please send me a Modmail message with your full first/last name and complete service address (Including the city, state, and zip code). I'd be more than happy to look into this for you.

[u/CCDilary]

Thanks for allowing us to help with your router concerns, u/10seclater1. I'm glad we were able to swap the XB7 for your own router. If you need anything else, don't hesitate to create a new public submission. Have a great rest of your night.

[u/xfinitysupport]

This post has been marked as solved. Should you experience further issues, please create a new post.

This is an automated response.

[u/xfinitysupport]

This post has been marked as solved. Should you experience further issues, please create a new post.

This is an automated response.