NOC (Network Operations Center) Role

The NOC role provides dedicated network operations access for technicians and network engineers. NOC users can monitor network infrastructure, manage routers, OLTs, and IP pools, search and troubleshoot customer connections — all without access to financial data, billing, or package management.

Overview

Feature	NOC Access
Network Monitoring	✅ Full access (view-monitoring)
Router Management	✅ Permission-based CRUD
Router Device Management	✅ Permission-based (manage-router-devices)
OLT / ONU Management	✅ Permission-based CRUD
IP Pool Management	✅ Permission-based CRUD
PPP / PPPoE Profiles	✅ Permission-based (view via view-ip-pools, add/edit via edit-ip-pools; delete is group-admin only)
Customer Search	✅ By username, mobile, or ID (search-customers)
Customer Create / Edit	✅ Permission-based (create-customer, edit-customer)
Customer Disconnect	✅ Permission-based (disconnect-customer)
Remove MAC Bind	✅ Permission-based (remove-mac-bind)
Send SMS to Customer	✅ Permission-based (send-sms)
DDoS Protection	✅ Permission-based (manage-ddos-policies, manage-ddos-mitigation, view-ddos-sensor-token)
Inventory Reports (Mikrotik / OLT / ONU / Other)	✅ Read access
Complaints / Support Tickets	✅ Access
Operator List	✅ Read-only (view only, cannot create/edit/delete operators)
Billing / Payments	❌ No access
Package Management	❌ No access
Financial & Revenue Widgets	❌ No access
Financial Reports	❌ No access (only inventory reports are exposed)

Creating NOC Users

NOC users are created by Group Admins from the admin panel.

Steps

1. Navigate to Staff → NOC in the Group Admin sidebar
2. Click New NOC User
3. Fill in the required fields:
   • Name — Full name of the NOC user
   • Mobile — Contact phone number
   • Email — Login email address (must be unique)
   • Password — Minimum 8 characters
4. Select the desired permissions from the checklist
5. Click Submit

Editing NOC Users

From the NOC Users list, click Actions → Edit to modify a NOC user’s name, mobile, password, or permissions.

Deleting NOC Users

From the NOC Users list, click Actions → Delete to remove a NOC user. This also removes all their permissions.

Permissions

NOC users have granular, permission-based access. Each permission can be individually toggled when creating or editing a NOC user.

Dashboard

Permission	Description
noc-dashboard	Access to the NOC Command Center dashboard

Router Management

Permission	Description
view-routers	View router list and details
add-routers	Create new routers
edit-routers	Modify existing routers
delete-routers	Remove routers

OLT Management

Permission	Description
view-olts	View OLT list and details, ONU list
add-olts	Create new OLTs
edit-olts	Modify existing OLTs
delete-olts	Remove OLTs

IP Pool Management

Permission	Description
view-ip-pools	View IPv4 and IPv6 pool lists
add-ip-pools	Create new IP pools
edit-ip-pools	Modify existing IP pools
delete-ip-pools	Remove IP pools

Customer Operations

Permission	Description
search-customers	Search customers by username, mobile, or ID (also unlocks the Customers list, Online Customers, and the import tools in the NOC sidebar)
create-customer	Create new customers
edit-customer	Edit existing customers
disconnect-customer	Disconnect a customer’s PPPoE session
remove-mac-bind	Clear a customer’s bound MAC address
send-sms	Send SMS messages to customers

Monitoring

Permission	Description
view-monitoring	Access monitoring tools (Ubiquiti, MikroTik, Cambium, Network Topology, Status Checks, Managed Switches)
manage-router-devices	MikroTik device management — interfaces, VLANs, bridges, IP addresses, firewall filter/NAT, and reboot/update actions (no delete operations)

Note: OLT/ONU pages in the monitoring section additionally require the view-olts permission.

DDoS Protection

Permission	Description
manage-ddos-policies	Configure the DDoS network profile, protected scope, telemetry sources, detection policies, and response connectors
manage-ddos-mitigation	Change attack status and propose, approve, or cancel permitted response workflows
view-ddos-sensor-token	Activate monitoring, rotate the sensor credential, and view its one-time plaintext value

Note: The complete list of assignable NOC permissions lives in config/noc_permissions.php. A NOC user with no permissions still lands on the panel but sees only the Dashboard, Operators list, Terminal, Support Tickets, Status Checks, Reports, DDoS Protection, Zabbix, and Security items — the network and customer menus stay hidden until the matching permission is granted.

NOC Panel Navigation

When a NOC user logs in, they see a dedicated sidebar. Some entries are always shown; others appear only once the matching permission is granted.

Dashboard (always shown)

• Dashboard / NOC Command Center — Real-time network monitoring dashboard with device counts, router metrics, OLT status, and alerts. The dashboard is non-financial and shows only customer status stats (online, active, suspended, disabled) and performance charts.

Operators (always shown)

• A read-only list of the parent Group Admin’s operators, with a detail view. NOC users cannot create, edit, suspend, or delete operators — only view them for network context.

Customers (requires search-customers)

• All Customers, Online Customers, Import Customers (from routers), and Import from Excel.
• The customer details page shows profile information, connection details (router, IP, MAC, PPPoE info), online/offline status, and usage/bandwidth graphs, plus Disconnect and Send SMS action buttons (permission-based). With create-customer / edit-customer the New Customer and edit flows are available.

Note: NOC users cannot see billing information, payment history, package details, or pricing on the customer details page.

Monitoring (requires view-monitoring)

• Ubiquiti Devices, MikroTik Monitor, Cambium Devices
• OLT Management and ONU List (require view-olts)
• Network Topology, Managed Switches

Reports (always shown)

• Inventory reports only: Mikrotik, OLT, ONU, and Other. Financial reports are not exposed to NOC users.

Status Checks (always shown)

• Uptime/status-check monitoring, history, run-now, and public-page settings.

Network (requires view-routers or view-ip-pools)

• Routers (requires view-routers)
• IPv4 Pools and IPv6 Pools (require view-ip-pools)
• PPP/Profiles — view with view-ip-pools, add/edit with edit-ip-pools (delete stays group-admin only)
• Equipment Auth — read-only FreeRADIUS device access, shown only when the equipment-device-access permission is present

Terminal (always shown)

• Opens a full-screen browser SSH/Telnet terminal for network devices, including the iPilot AI assistant.

Logs (always shown)

• Router Log, OLT Log, and RADIUS Log (PPP authentication).

Support Tickets (always shown)

• Complaints, Archived Complaints, and complaint Reports.

DDoS Protection (always shown)

• The DDoS Protection console. Configuration, mitigation, and sensor-token actions are gated by the manage-ddos-policies, manage-ddos-mitigation, and view-ddos-sensor-token permissions.

Zabbix (always shown)

• Zabbix Monitor and Zabbix Servers.

Security (always shown)

• Account Security (Change Password, Two-Factor Authentication), Device Verification, Activity Logs, and Authentication Logs.

Financial Data Isolation

NOC users are strictly isolated from all financial data:

• The dashboard shows no revenue widgets, billing summaries, Cash In/Cash Out charts, or payment shortcuts
• The dashboard shows only non-financial metrics such as online, active, suspended and disabled customer counts
• Customer detail pages hide all billing tabs, payment history, plan pricing, and subscription sections
• Financial reports are blocked; only inventory (Mikrotik/OLT/ONU/Other) reports are exposed

The NOC panel routes are additionally protected by the same middleware stack as other admin areas:

• 2FA — Requires two-factor authentication (if enabled)
• payment.subscription — Enforces subscription checks
• can:accessNocPanel — Gate check for NOC role

This ensures NOC users are subject to the same account/subscription enforcement as other admin areas.

Router API Password Security

When editing routers, the NOC routers-edit form does not render the stored API password in the HTML. The password field is left blank; the existing password is preserved server-side unless a new value is explicitly submitted.

Data Scoping

NOC users are scoped to their parent Group Admin’s data:

• They can only see routers, OLTs, IP pools, and customers belonging to their parent Group Admin and the Group Admin’s operators/sub-operators
• They cannot see or access resources from other Group Admins

URL Structure

All NOC panel routes are under /admin/noc/:

• /admin/noc/dashboard — NOC Command Center
• /admin/noc/routers — Router management
• /admin/noc/olts — OLT management
• /admin/noc/onus — ONU list
• /admin/noc/ipv4pools — IPv4 pool management
• /admin/noc/ipv6pools — IPv6 pool management
• /admin/noc/ubiquiti-devices — Ubiquiti monitoring
• /admin/noc/mikrotik/monitor — MikroTik monitoring
• /admin/noc/cambium-devices — Cambium monitoring
• /admin/noc/topology — Network topology
• /admin/noc/status-checks — Status checks

Activity Logging

All NOC user management actions are logged in the activity log:

• noc_user_create — When a group admin creates a NOC user
• noc_user_update — When a group admin updates a NOC user
• noc_user_delete — When a group admin deletes a NOC user

Granular Action-Level Authorization

Router operations enforce action-specific NOC permissions:

• view-routers — Required for listing/viewing routers
• add-routers — Required for creating new routers
• edit-routers — Required for editing existing routers
• delete-routers — Required for deleting routers

Similarly, OLT and ONU operations are gated by their respective permissions via OltPolicy and OnuPolicy.