diff --git a/BUILDING.md b/BUILDING.md
index 5a6f013..e0a5dfd 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -158,7 +158,7 @@
 make OPENOLTDEVICE=asfvolt16 OPENOLT_PROTO_VER=master
 ```
 
-By default, the `OPENOLT_PROTO_VER` defaults to git tag *v4.0.11* of the
+By default, the `OPENOLT_PROTO_VER` defaults to git tag *v4.0.14* of the
 [voltha-protos](https://gerrit.opencord.org/gitweb?p=voltha-protos.git;a=summary)
 repo.
 
diff --git a/Makefile b/Makefile
index ee5bda2..a689a37 100644
--- a/Makefile
+++ b/Makefile
@@ -27,7 +27,7 @@
 
 ## Variables
 OPENOLTDEVICE     ?= asfvolt16
-OPENOLT_PROTO_VER ?= v4.0.11
+OPENOLT_PROTO_VER ?= v4.0.14
 
 DOCKER                     ?= docker
 DOCKER_REGISTRY            ?=
diff --git a/agent/Makefile.in b/agent/Makefile.in
index 9a99b6b..5ccea59 100644
--- a/agent/Makefile.in
+++ b/agent/Makefile.in
@@ -42,7 +42,7 @@
 # This specifies the GIT tag in https://github.com/opencord/voltha-protos
 # repo that we need to refer to, to pick the right version of
 # openolt.proto and tech_profile.proto
-OPENOLT_PROTO_VER ?= v4.0.11
+OPENOLT_PROTO_VER ?= v4.0.14
 
 # Variables used for Inband build
 INBAND = "n"
diff --git a/agent/common/core.h b/agent/common/core.h
index ab4c788..b3a5408 100644
--- a/agent/common/core.h
+++ b/agent/common/core.h
@@ -225,7 +225,7 @@
                 int32_t alloc_id, int32_t network_intf_id,
                 int32_t gemport_id, const ::openolt::Classifier& classifier,
                 const ::openolt::Action& action, int32_t priority_value,
-                uint64_t cookie, int32_t group_id, uint32_t tech_profile_id);
+                uint64_t cookie, int32_t group_id, uint32_t tech_profile_id, bool enable_encryption = false);
 Status FlowRemoveWrapper_(const openolt::Flow* request);
 Status FlowRemove_(uint32_t flow_id, const std::string flow_type);
 Status Disable_();
diff --git a/agent/src/core_api_handler.cc b/agent/src/core_api_handler.cc
index 2c5ff83..3d8bd93 100644
--- a/agent/src/core_api_handler.cc
+++ b/agent/src/core_api_handler.cc
@@ -1149,6 +1149,7 @@
         }
     }
 
+// TODO: MOVE THIS TO A NEW METHOD
     if (omcc_encryption_mode == true) {
         // set the encryption mode for omci port id
         bcmolt_itupon_gem_cfg gem_cfg;
@@ -1162,7 +1163,7 @@
         BCMOLT_FIELD_SET(&gem_cfg.data, itupon_gem_cfg_data, encryption_mode, encryption_mode);
         err = bcmolt_cfg_set(dev_id, &gem_cfg.hdr);
         if(err != BCM_ERR_OK) {
-                OPENOLT_LOG(ERROR, openolt_log_id, "failed to confiure omci gem_port encryption mode = %d\n", onu_id);
+                OPENOLT_LOG(ERROR, openolt_log_id, "failed to configure omci gem_port encryption mode = %d\n", onu_id);
                 return bcm_to_grpc_err(err, "Access_Control set ITU PON OMCI Gem port failed");
         }
     }
@@ -1459,6 +1460,17 @@
     return Status::OK;
 }
 
+bool get_aes_flag_for_gem_port(const google::protobuf::Map<unsigned int, bool> &gemport_to_aes, uint32_t gemport_id) {
+    bool aes_flag = false;
+    for (google::protobuf::Map<unsigned int, bool>::const_iterator it=gemport_to_aes.begin(); it!=gemport_to_aes.end(); it++) {
+        if (it->first == gemport_id) {
+            aes_flag = it->second;
+            break;
+        }
+    }
+    return aes_flag;
+}
+
 Status FlowAddWrapper_(const ::openolt::Flow* request) {
 
     int32_t access_intf_id = request->access_intf_id();
@@ -1479,7 +1491,9 @@
     uint32_t tech_profile_id = request->tech_profile_id();
     bool replicate_flow = request->replicate_flow();
     const google::protobuf::Map<unsigned int, unsigned int> &pbit_to_gemport = request->pbit_to_gemport();
+    const google::protobuf::Map<unsigned int, bool> &gemport_to_aes = request->gemport_to_aes();
     uint16_t flow_id;
+    bool enable_encryption;
 
     // The intf_id variable defaults to access(PON) interface ID.
     // For trap-from-nni flow where access interface ID is not valid , change it to NNI interface ID
@@ -1515,11 +1529,12 @@
                 flow_id = dev_fl_symm_params[0].flow_id;
                 gemport_id = dev_fl_symm_params[0].gemport_id; // overwrite the gemport with symmetric flow gemport
                                                                // Should be same as what is coming in this request.
+                enable_encryption = get_aes_flag_for_gem_port(gemport_to_aes, gemport_id);
                 ::openolt::Classifier cl = ::openolt::Classifier(classifier);
                 cl.set_o_pbits(dev_fl_symm_params[0].pbit);
                 Status st = FlowAdd_(access_intf_id, onu_id, uni_id, port_no, flow_id,
                                     flow_type, alloc_id, network_intf_id, gemport_id, cl,
-                                    action, priority, cookie, group_id, tech_profile_id);
+                                    action, priority, cookie, group_id, tech_profile_id, enable_encryption);
                 if (st.error_code() == grpc::StatusCode::OK) {
                     device_flow dev_fl;
                     dev_fl.is_flow_replicated = false;
@@ -1536,10 +1551,11 @@
                 ::openolt::Classifier cl = ::openolt::Classifier(classifier);
                 flow_id = dev_fl_symm_params[i].flow_id;
                 gemport_id = dev_fl_symm_params[i].gemport_id;
+                enable_encryption = get_aes_flag_for_gem_port(gemport_to_aes, gemport_id);
                 cl.set_o_pbits(dev_fl_symm_params[i].pbit);
                 Status st = FlowAdd_(access_intf_id, onu_id, uni_id, port_no, flow_id,
                                     flow_type, alloc_id, network_intf_id, gemport_id, cl,
-                                    action, priority, cookie, group_id, tech_profile_id);
+                                    action, priority, cookie, group_id, tech_profile_id, enable_encryption);
                 if (st.error_code() != grpc::StatusCode::OK && st.error_code() != grpc::StatusCode::ALREADY_EXISTS) {
                     OPENOLT_LOG(ERROR, openolt_log_id, "failed to install device flow=%u for voltha flow=%lu. Undoing any device flows installed.", flow_id, voltha_flow_id);
                     // On failure remove any successfully replicated flows installed so far for the voltha_flow_id
@@ -1568,9 +1584,10 @@
                 OPENOLT_LOG(ERROR, openolt_log_id, "could not allocated flow id for voltha-flow-id=%lu\n", voltha_flow_id);
                 return ::Status(grpc::StatusCode::RESOURCE_EXHAUSTED, "flow-ids-exhausted");
             }
+            enable_encryption = get_aes_flag_for_gem_port(gemport_to_aes, gemport_id);
             Status st = FlowAdd_(access_intf_id, onu_id, uni_id, port_no, flow_id,
                                 flow_type, alloc_id, network_intf_id, gemport_id, classifier,
-                                action, priority, cookie, group_id, tech_profile_id);
+                                action, priority, cookie, group_id, tech_profile_id, enable_encryption);
             if (st.error_code() == grpc::StatusCode::OK) {
                 device_flow dev_fl;
                 dev_fl.is_flow_replicated = false;
@@ -1607,10 +1624,11 @@
                     ::openolt::Classifier cl = ::openolt::Classifier(classifier);
                     flow_id = dev_fl.params[cnt].flow_id;
                     gemport_id = dev_fl.params[cnt].gemport_id;
+                    enable_encryption = get_aes_flag_for_gem_port(gemport_to_aes, gemport_id);
                     cl.set_o_pbits(dev_fl.params[cnt].pbit);
                     Status st = FlowAdd_(access_intf_id, onu_id, uni_id, port_no, flow_id,
                                         flow_type, alloc_id, network_intf_id, gemport_id, cl,
-                                        action, priority, cookie, group_id, tech_profile_id);
+                                        action, priority, cookie, group_id, tech_profile_id, enable_encryption);
                     if (st.error_code() != grpc::StatusCode::OK) {
                         OPENOLT_LOG(ERROR, openolt_log_id, "failed to install device flow=%u for voltha flow=%lu. Undoing any device flows installed.", flow_id, voltha_flow_id);
                         // Remove any successfully replicated flows installed so far for the voltha_flow_id
@@ -1644,7 +1662,7 @@
                 int32_t alloc_id, int32_t network_intf_id,
                 int32_t gemport_id, const ::openolt::Classifier& classifier,
                 const ::openolt::Action& action, int32_t priority_value, uint64_t cookie,
-                int32_t group_id, uint32_t tech_profile_id) {
+                int32_t group_id, uint32_t tech_profile_id, bool aes_enabled) {
     bcmolt_flow_cfg cfg;
     bcmolt_flow_key key = { }; /**< Object key. */
     int32_t o_vid = -1;
@@ -1698,13 +1716,13 @@
             return bcm_to_grpc_err(BCM_ERR_PARM, "flow network setting invalid");
         }
 
-        if (onu_id >= 0) {
+        if (onu_id >= ONU_ID_START) {
             BCMOLT_MSG_FIELD_SET(&cfg, onu_id, onu_id);
         }
-        if (gemport_id >= 0) {
+        if (gemport_id >= GEM_PORT_ID_START) {
             BCMOLT_MSG_FIELD_SET(&cfg, svc_port_id, gemport_id);
         }
-        if (gemport_id >= 0 && port_no != 0) {
+        if (gemport_id >= GEM_PORT_ID_START && port_no != 0) {
             bcmos_fastlock_lock(&data_lock);
             if (key.flow_type == BCMOLT_FLOW_TYPE_DOWNSTREAM) {
                 port_to_flows[port_no].insert(key.flow_id);
@@ -1856,7 +1874,7 @@
 
     BCMOLT_MSG_FIELD_SET(&cfg, action, a_val);
 
-    if ((access_intf_id >= 0) && (onu_id >= 0)) {
+    if ((access_intf_id >= 0) && (onu_id >= ONU_ID_START)) {
         qos_type = get_qos_type(access_intf_id, onu_id, uni_id);
         if (key.flow_type == BCMOLT_FLOW_TYPE_DOWNSTREAM) {
             tm_val.sched_id = get_tm_sched_id(access_intf_id, onu_id, uni_id, downstream, tech_profile_id);
@@ -1996,6 +2014,22 @@
         bcmos_fastlock_unlock(&data_lock, 0);
 
     }
+
+    /*
+       Enable AES encryption on GEM ports if they are used in downstream unicast flows.
+       Rationale: We can't do upstream encryption in GPON. This change addresses the common denominator (and also minimum viable)
+       use case for both technologies which is downstream unicast GEM port encryption. Since the downstream traffic is inherently
+       broadcast to all the ONUs behind a PON port, encrypting the individual subscriber traffic in this direction is important
+       and considered good enough in terms of security (See Section 12.1 of G.984.3). For upstream unicast and downstream multicast
+       GEM encryption, we need to make additional changes specific to XGSPON. This will be done as a future work.
+    */
+    if (aes_enabled && (access_intf_id >= 0) && (gemport_id >= GEM_PORT_ID_START) && (key.flow_type == BCMOLT_FLOW_TYPE_DOWNSTREAM)) {
+        OPENOLT_LOG(INFO, openolt_log_id, "Setting encryption on pon = %d gem_port = %d through flow_id = %d\n", access_intf_id, gemport_id, flow_id);
+        enable_encryption_for_gem_port(access_intf_id, gemport_id);
+    } else {
+        OPENOLT_LOG(WARNING, openolt_log_id, "Flow config for flow_id = %d is not suitable for setting downstream encryption on pon = %d gem_port = %d. No action taken.\n", flow_id, access_intf_id, gemport_id);
+    }
+
     return Status::OK;
 }
 
diff --git a/agent/src/core_utils.cc b/agent/src/core_utils.cc
index 968975e..59c7cdc 100644
--- a/agent/src/core_utils.cc
+++ b/agent/src/core_utils.cc
@@ -918,7 +918,7 @@
 
     err = bcmolt_cfg_set(dev_id, &cfg.hdr);
     if(err != BCM_ERR_OK) {
-        OPENOLT_LOG(ERROR, openolt_log_id, "failed to install gem_port = %d err_text=%s\n", gemport_id, cfg.hdr.hdr.err_text);
+        OPENOLT_LOG(ERROR, openolt_log_id, "failed to install gem_port = %d err = %s (%d)\n", gemport_id, cfg.hdr.hdr.err_text, err);
         return bcm_to_grpc_err(err, "Access_Control set ITU PON Gem port failed");
     }
 
@@ -939,7 +939,7 @@
     err = bcmolt_cfg_clear(dev_id, &gem_cfg.hdr);
     if (err != BCM_ERR_OK)
     {
-        OPENOLT_LOG(ERROR, openolt_log_id, "failed to remove gem_port = %d err=%s\n", gemport_id, gem_cfg.hdr.hdr.err_text);
+        OPENOLT_LOG(ERROR, openolt_log_id, "failed to remove gem_port = %d err = %s (%d)\n", gemport_id, gem_cfg.hdr.hdr.err_text, err);
         return bcm_to_grpc_err(err, "Access_Control clear ITU PON Gem port failed");
     }
 
@@ -948,6 +948,32 @@
     return Status::OK;
 }
 
+Status enable_encryption_for_gem_port(int32_t intf_id, int32_t gemport_id) {
+    bcmos_errno err;
+    bcmolt_itupon_gem_cfg cfg;
+    bcmolt_itupon_gem_key key = {
+        .pon_ni = (bcmolt_interface)intf_id,
+        .gem_port_id = (bcmolt_gem_port_id)gemport_id
+    };
+
+    BCMOLT_CFG_INIT(&cfg, itupon_gem, key);
+
+    bcmolt_control_state encryption_mode;
+    encryption_mode = BCMOLT_CONTROL_STATE_ENABLE;
+    BCMOLT_FIELD_SET(&cfg.data, itupon_gem_cfg_data, encryption_mode, encryption_mode);
+
+    err = bcmolt_cfg_set(dev_id, &cfg.hdr);
+    if(err != BCM_ERR_OK) {
+        OPENOLT_LOG(ERROR, openolt_log_id, "failed to set encryption on pon = %d gem_port = %d, err = %s (%d)\n",
+            intf_id, gemport_id, cfg.hdr.hdr.err_text, err);
+        return bcm_to_grpc_err(err, "Failed to set encryption on GEM port");;
+    }
+
+    OPENOLT_LOG(INFO, openolt_log_id, "encryption set successfully on pon = %d gem_port = %d\n", intf_id, gemport_id);
+
+    return Status::OK;
+}
+
 Status update_acl_interface(int32_t intf_id, bcmolt_interface_type intf_type, uint32_t access_control_id,
                 bcmolt_members_update_command acl_cmd) {
     bcmos_errno err;
diff --git a/agent/src/core_utils.h b/agent/src/core_utils.h
index 8404912..0f7cfe7 100644
--- a/agent/src/core_utils.h
+++ b/agent/src/core_utils.h
@@ -93,6 +93,7 @@
 bcmos_errno get_nni_interface_status(bcmolt_interface id, bcmolt_interface_state *state);
 Status install_gem_port(int32_t intf_id, int32_t onu_id, int32_t gemport_id);
 Status remove_gem_port(int32_t intf_id, int32_t gemport_id);
+Status enable_encryption_for_gem_port(int32_t intf_id, int32_t gemport_id);
 Status update_acl_interface(int32_t intf_id, bcmolt_interface_type intf_type, uint32_t access_control_id,
                 bcmolt_members_update_command acl_cmd);
 Status install_acl(const acl_classifier_key acl_key);
diff --git a/agent/test/Makefile b/agent/test/Makefile
index 66986e3..df93b7c 100644
--- a/agent/test/Makefile
+++ b/agent/test/Makefile
@@ -21,7 +21,7 @@
 TOP_DIR=`pwd`
 OPENOLTDEVICE ?= asfvolt16
 
-OPENOLT_PROTO_VER ?= v4.0.11
+OPENOLT_PROTO_VER ?= v4.0.14
 
 ########################################################################
 ##
diff --git a/agent/test/src/test_core.cc b/agent/test/src/test_core.cc
index 7efb8c9..2d2bede 100644
--- a/agent/test/src/test_core.cc
+++ b/agent/test/src/test_core.cc
@@ -1237,6 +1237,7 @@
         uint64_t cookie = 0;
         int32_t group_id = -1;
         uint32_t tech_profile_id = 64;
+        bool enable_encryption = true;
 
         NiceMock<BalMocker> balMock;
         openolt::Flow* flow;
@@ -1536,7 +1537,81 @@
     ASSERT_TRUE( status.error_message() == Status::OK.error_message() );
 }
 
+// Test 11 - FlowAdd - success case (Downstream-Encrypted GEM)
+TEST_F(TestFlowAdd, FlowAddDownstreamEncryptedGemSuccess) {
+    onu_id = 2;
+    flow_id = 7;
+    flow_type = "downstream";
+    alloc_id = 1025;
+    enable_encryption = true;
 
+    bcmos_errno flow_cfg_get_stub_res = BCM_ERR_OK;
+    bcmos_errno olt_cfg_set_res = BCM_ERR_OK;
+    EXPECT_GLOBAL_CALL(bcmolt_cfg_get__flow_stub, bcmolt_cfg_get__flow_stub(_, _))
+                     .WillRepeatedly(DoAll(SetArg1ToBcmOltFlowCfg(flow_cfg), Return(flow_cfg_get_stub_res)));
+    ON_CALL(balMock, bcmolt_cfg_set(_, _)).WillByDefault(Return(olt_cfg_set_res));
+
+    Status status = FlowAdd_(access_intf_id, onu_id, uni_id, port_no, flow_id, flow_type, alloc_id, network_intf_id,
+        gemport_id, *classifier, *action, priority_value, cookie, group_id, tech_profile_id, enable_encryption);
+    ASSERT_TRUE( status.error_message() == Status::OK.error_message() );
+}
+
+// Test 12 - FlowAdd - success case (Downstream-Unencrypted GEM - prints warning that encryption will not applied)
+TEST_F(TestFlowAdd, FlowAddDownstreamUnencryptedGemWarning) {
+    onu_id = 2;
+    flow_id = 8;
+    flow_type = "downstream";
+    alloc_id = 1025;
+    enable_encryption = false;
+
+    bcmos_errno flow_cfg_get_stub_res = BCM_ERR_OK;
+    bcmos_errno olt_cfg_set_res = BCM_ERR_OK;
+    EXPECT_GLOBAL_CALL(bcmolt_cfg_get__flow_stub, bcmolt_cfg_get__flow_stub(_, _))
+                     .WillRepeatedly(DoAll(SetArg1ToBcmOltFlowCfg(flow_cfg), Return(flow_cfg_get_stub_res)));
+    ON_CALL(balMock, bcmolt_cfg_set(_, _)).WillByDefault(Return(olt_cfg_set_res));
+
+    Status status = FlowAdd_(access_intf_id, onu_id, uni_id, port_no, flow_id, flow_type, alloc_id, network_intf_id,
+        gemport_id, *classifier, *action, priority_value, cookie, group_id, tech_profile_id, enable_encryption);
+    ASSERT_TRUE( status.error_message() == Status::OK.error_message() );
+}
+
+// Test 13 - FlowAdd - success case (Upstream-Encrypted GEM - prints warning that encryption will not applied)
+TEST_F(TestFlowAdd, FlowAddUpstreamEncryptedGemWarning) {
+    onu_id = 2;
+    flow_id = 9;
+    flow_type = "upstream";
+    alloc_id = 1025;
+    enable_encryption = true;
+
+    bcmos_errno flow_cfg_get_stub_res = BCM_ERR_OK;
+    bcmos_errno olt_cfg_set_res = BCM_ERR_OK;
+    EXPECT_GLOBAL_CALL(bcmolt_cfg_get__flow_stub, bcmolt_cfg_get__flow_stub(_, _))
+                     .WillRepeatedly(DoAll(SetArg1ToBcmOltFlowCfg(flow_cfg), Return(flow_cfg_get_stub_res)));
+    ON_CALL(balMock, bcmolt_cfg_set(_, _)).WillByDefault(Return(olt_cfg_set_res));
+
+    Status status = FlowAdd_(access_intf_id, onu_id, uni_id, port_no, flow_id, flow_type, alloc_id, network_intf_id,
+        gemport_id, *classifier, *action, priority_value, cookie, group_id, tech_profile_id, enable_encryption);
+    ASSERT_TRUE( status.error_message() == Status::OK.error_message() );
+}
+
+// Test 14 - FlowAdd - success case (Multicast-Encrypted GEM - prints warning that encryption will not applied)
+TEST_F(TestFlowAdd, FlowAddMulticastEncryptedGemWarning) {
+    onu_id = 2;
+    flow_id = 10;
+    flow_type = "multicast";
+    alloc_id = 1025;
+    enable_encryption = true;
+
+    bcmos_errno flow_cfg_get_stub_res = BCM_ERR_OK;
+    bcmos_errno olt_cfg_set_res = BCM_ERR_OK;
+    EXPECT_GLOBAL_CALL(bcmolt_cfg_get__flow_stub, bcmolt_cfg_get__flow_stub(_, _))
+                     .WillRepeatedly(DoAll(SetArg1ToBcmOltFlowCfg(flow_cfg), Return(flow_cfg_get_stub_res)));
+    ON_CALL(balMock, bcmolt_cfg_set(_, _)).WillByDefault(Return(olt_cfg_set_res));
+
+    Status status = FlowAdd_(access_intf_id, onu_id, uni_id, port_no, flow_id, flow_type, alloc_id, network_intf_id,
+        gemport_id, *classifier, *action, priority_value, cookie, group_id, tech_profile_id, enable_encryption);
+    ASSERT_TRUE( status.error_message() == Status::OK.error_message() );
+}
 ////////////////////////////////////////////////////////////////////////////
 // For testing OnuPacketOut functionality
 ////////////////////////////////////////////////////////////////////////////
@@ -1716,6 +1791,10 @@
     FlowRemove_(4, "downstream");
     FlowRemove_(5, "upstream");
     FlowRemove_(6, "downstream");
+    FlowRemove_(7, "downstream");
+    FlowRemove_(8, "downstream");
+    FlowRemove_(9, "upstream");
+    FlowRemove_(10, "multicast");
 
     bcmos_errno flow_cfg_get_stub_res = BCM_ERR_OK;
     EXPECT_GLOBAL_CALL(bcmolt_cfg_get__flow_stub, bcmolt_cfg_get__flow_stub(_, _))
diff --git a/protos/Makefile b/protos/Makefile
index 2494a08..8b28160 100644
--- a/protos/Makefile
+++ b/protos/Makefile
@@ -19,7 +19,7 @@
 # This specifies the GIT tag in https://github.com/opencord/voltha-protos
 # repo that we need to refer to, to pick the right version of
 # openolt.proto, ext_config.proto and tech_profile.proto
-OPENOLT_PROTO_VER ?= v4.0.11
+OPENOLT_PROTO_VER ?= v4.0.14
 
 CXX ?= g++
 CPPFLAGS += `pkg-config --cflags protobuf grpc` -I googleapis/gens -I./