Huawei Office Network Solution Overview

Introduction to Huawei Network Solution
Page 0 Copyright © 2020 Huawei Technologies Co., Ltd. All rights reserved.
Contents
1. Know More About Huawei
2. Basic Concepts of Campus & CloudCampus Solution
3. Basic Concepts of Wi-Fi 6 & AirEngine Solution
4. Basic Concepts of SD-WAN Router Solution
5. Basic Concepts of HiSecEngine Firewall Solution
Know More About Huawei
Huawei: Leading Provider of ICT infrastructure and Smart Devices
Focusing on ICT to provide products, solutions, and services to three customer groups
Build connectivity for Indonesia: 13 region offices, 5 logistics centers
Contents
Wireless, IoT, and Cloudification Drive Campus Network Transformation
A famous enterprise A top-ranked university A leading cloud company
Wireless IoT Cloudification

Short-form video services develop rapidly and The campus network needs to be comprehensively By 2025, 85% of enterprise services will be cloud-
employee terminals per 100 m2 increase from transformed to support 14,300 IoT terminals, 14 smart based, posing higher requirements on network
40 to 80, driving demand for higher wired applications, 306 smart classrooms, and more. quality and latency.
access bandwidth.
Higher bandwidth Better experience Higher efficiency

1G access, 40G backbone → 10G access, 100G Differentiated service assurance and Automated deployment and intelligent
backbone millisecond-level low latency O&M
Building a high-quality campus network with higher bandwidth, better experience, and higher efficiency
Huawei CloudCampus 3.0 Solution: Building a High-Quality Campus Network for the
Digital Era
Digitalization transforms enterprises
Customer Transform workplaces Transform production Transform public services

Health Smart
flow e-Schoolbag mgmt. office
analysis
Open industry application development platform

SDK | API
iMaster NCE-Campus: autonomous driving platform that integrates management, control, and analysis
Management and
control layer
E2E automation Intelligent O&M
Planning automation | Network construction automation | User experience visibility | Fault demarcation |
Policy automation Network optimization & self-healing
Management, control,
NETCONF/YANG and analysis Telemetry High-quality network for the digital era
Network layer
Full-10GE access, unleashing digital productivity
• Multi-GE switch + high-density 10GE/25GE fixed switch + 100GE core, building a simplified, ultra-broadband network
• Wired and wireless convergence (managing up to 10K APs and supporting 50K concurrent users), preferential service assurance for VIPs
• Network-wide automated deployment, plug-and-play devices, and precise insight into network-wide link quality
CloudEngine S-series campus switches
AirEngine Wi-Fi 6/6E AirEngine Wi-Fi 6 powered by Huawei 5G, building a fully wireless campus network
Lightning-fast speed More stable coverage More stable application More stable roaming
Industry's only dual-band 16 Smart antenna: always-on signals Dynamic Turbo: Lossless roaming:
smart antennas: 10.75 Gbps, 2x for users, 20% greater coverage application acceleration, < zero packet loss
the industry average range 10 ms latency during roaming
7 Huawei Confidential
Innovative Simplified Architecture: Easier Campus Network Planning and Deployment,
Simpler Network Construction
As Is: traditional solution To Be: Huawei solution
Many configuration and management nodes, "planning first and then RUs are planning-free and configuration-free. They can be deployed or
deployment", high O&M costs replaced on demand and flexibly scaled.
Architecture
revolution
Core Core
Aggregation 3 layers → 2
layers
Central Central
switch Access switch
Access
Manual orchestration of network topology, Automatic discovery of network topology

independent maintenance of access devices
Innovative RTU, Building a "Pay-as-You-Grow" Campus Network
+ =
Elastic architecture Various RTU licenses On-demand target network
Elastic core 10G
CloudEngine S12700E Model L

5G
Base model Model S

Elastic aggregation 2.5G + Model E
CloudEngine S6730-H RTU license
1G
Model X
Elastic access (PoE++) Model Y
CloudEngine S5732-H
Evolvable port rates Flexible combinations, on-demand configuration
RTU is short for right-to-use. RTU licenses can be used to improve the port rates and switching capacity of switches.
Free Mobility 3.0: Fine-Grained Policy Control, Automated Deployment, Consistent
Experience
Free mobility 3.0 Group Group ID Contextual Awareness (5W1H: Who, When, Where,
Name Whose, How)
Free Mobility 2.0 • IP-security group entry VIP 30 Leader, wired and wireless, anytime
synchronization
Guest 10 Guest, wireless, working hours…
Free Mobility 1.0 • VXLAN networking, with
packet header carrying user
Enhanced
Employee 20 Employees, wired/wireless...

feature
• Group policy-based group information

control Server 57 Fixed IP address of the server
• Region-specific differentiated
• Permission, application, policy (multi-matrix)
and security policies Permission
1. Define security Bandwidth
groups and policies QoS
2015 2018 2020 2. Automatically

translate and deliver
• Authentication and policy policies IP-security group entry
enforcement points cannot synchronization
requirements
• Authentication and policy

be separated.
Lowered
enforcement points cannot

• Traffic must pass through be separated.
the firewall to implement 4. Match and enforce policies
• VXLAN networking is
inter-group isolation across
required to implement • Authentication and policy
gateways. enforcement points can be
inter-group isolation across
separated.
• Incompatible with third- gateways.
party devices for networking
• Incompatible with third- • No need of traffic detour to the
party devices for networking firewall or VXLAN networking
3. Onboard and authenticate
• Compatible with third-party terminals and add them to
devices for networking security groups
Authentication Policy enforcement
point point
Intelligent O&M: Terminal Visibility, Fault Diagnosis and Analytics
Technical Solution
Initiate an NQA
ICMP test on
As-Is To-Be CampusInsight CampusInsight.
Hop-by-hop CLI detection Automatic end-to-end diagnosis Telemetry

Access → Aggregation → Core → Authentication → Initiating NQA Trace on CampusInsight • User information
Firewall → Server • User authentication • User group
information • Terminal
• Terminal identification information
• Terminal discovery information
Client info
(ARP Snooping)
Step 3 • DHCP online status
AAA DHCP
Step 2
Access point Authentication point

Step 1
Issue Category Typical Root Causes
Authentication failure, timeout, and slowness

Connectivity issue analysis
Path trace DHCP failure, timeout, and slowness
Application quality analysis VoIP failure, poor quality, disconnection, and Layer 2
and path trace loop
AS-F15 AGS-F53 CS-F5 FW-F5
Port anomaly, optical module failure, PoE failure,
sudden traffic increase or decrease, packet loss during
Device fault analysis
forwarding, queue congestion, and threshold-cross
services
CloudEngine S-Series Switch Portfolio (1/2)
Modular switches 25GE fixed switches
New S6730-H-V2
• 3.6 Tbps per slot • 2.4 Tbps per slot
(March 2023) 48 x 25GE, 6 x 100GE
• 50K users, 100K terminals • 10K APs, 50K users
VXLAN
• Clos orthogonal architecture • MACsec on 10GE, 25GE,
40GE, and 100GE ports
S16700-4/8
S12700E-4/8/12 S6730-H
24*100GE 6*100GE 48*10GE 24*10GE + 24*GE 2*100GE + 4*40GE
28 x 25GE, 4 x 100GE, 220 mm
36*100GE 18*100GE 24/36*40GE 48*10GE
VXLAN, MACsec
24*Multi-GE +
40*25GE 12*40GE 48*GE
24*GE
10GE fixed switches
• 800 Gbps per slot • 720 Gbps per slot

• 48*Multi-GE per slot • 4K APs, 15K users S6730-H-V2
• 60 W PoE++ at 300 m 24/28/48 x 10GE, 6 x 100GE,
S8700-4/6/10 S7703/06/12 1 card slot VXLAN, MACsec
24/48*10GE 48 x GE 12*10GE optical + 16*GE 24*10GE optical + 24*GE
24/48*Multi-GE 2*100GE + 4*40GE 6*100GE 12*40GE
optical optical/electrical optical + 24*GE electrical optical
48*10GE optical- 24*GE 16*25GE 24*Multi-GE + 48*GE 48*GE
2*10GE + 20*GE 48*GE PoE 48*10GE
electrical electrical 24*GE electrical optical
S6730-H
24/48 x 10GE, 6 x 100GE
VXLAN, MACsec
CloudEngine S-Series Switch Portfolio (2/2)
Multi-GE switches
S5732-H-V2 S5732-H
24/48 x 2.5/5/10GE, 4 x 25GE + 2 x 100GE 24/48 x 1/ 2.5/5/10GE, 4 x 25GE + 2 x 100GE
90 W PoE++, supporting RTU licenses 60 W PoE++, supporting RTU licenses
Enhanced GE switches
S5732-H-V2 S5732-H S5731-H

20/24/44 x GE, 4 x 10GE + 6 x 40GE 20/44 x GE, 4 x 10GE + 6 x 40GE 24/48 x GE, 4 x 10GE, 30W PoE+, 1
1 card slot, VXLAN VXLAN card slot VXLAN
Standard GE switches Simple GE switches
S5731-S S5731-S S5736-S S5735-S-V2 S5735-L-V2

24/48 x GE Base-T, 4 x 10GE, 24/48 x GE SFP, 4 x 10GE, 24/48 x GE SFP, 4 x 10GE 24/48 x GE, 4 x 10GE, two 12GE 24/48 x GE, 4 x 10GE, two 12GE
30W PoE+, VXLAN VXLAN 1 card slot, 420 mm dedicated stack ports, 30W PoE+ dedicated stack ports, 30W PoE+,
Built-in AC/DC
Contents
A Leader in the 2022 Gartner Magic Quadrant
Named a Leader
Steady rise in the past 11 years
The only non-North American vendor
Huawei strengths
• Comprehensive product portfolio: Huawei has a comprehensive
wired and wireless product portfolio. This allows it to address all
customer use cases and price competitively compared to most of its
competitors.
• AI- and ML-enabled network management platform: The iMaster
NCE-Campus network management platform provides AI-driven Wi-Fi,
wired, and WAN network assurance services, and user policy
orchestration, plus the ability to simulate, test and verify network
planning.
• Wireless-first support: Huawei is focused on supporting firms that are
adopting a "wireless-first" strategy. A focus on integrated features that
support ease of management and high levels of end-user experience.
• Simplified architecture: Innovative "central switch + remote unit (RU)"
architecture, as well as optical-electrical PoE at an ultra-long distance of
300 m greatly reduces cabling costs and energy consumption.
Magic Quadrant™ for Enterprise Wired and Wireless LAN Infrastructure Gartner MQ report
Common WLAN Issues Deteriorating User Experiences
Fault rectification takes a long

There are no signals or signals are weak.
time.
• The network environment is diversified and there
• It is difficult to reproduce wireless network
are many partitions, causing coverage holes or
faults. As a result, fault locating takes a
poor signal quality in some areas.
long time or cannot be demarcated, and
faults are difficult to rectify.
Signals are available, but terminals fail

Poor network Roaming is interrupted.
to be connected.
experience • Roaming policies based on terminal behaviors
• Some terminals fail to access a network
Unsatisfactory do not provide protection during roaming, and
because many terminals are connected.
cause a long handover and large packet loss.
Terminals are connected, but the The network is unstable.

experience is low. • Dense deployment and uncertain interference
• High-density user access causes network cause terminal disconnection or service
congestion and sharply decreases wireless interruption.
network bandwidth.
Planning Construction O&M Optimization
3D Signal Simulation Resolves Coverage Holes or Weak Coverage

Problems from the Planning Perspective
Identify the obstacle height based on the AP deployment height and location, simulate signal coverage, and use 3D signal simulation to achieve more accurate effect.
Cloud network planning: https://serviceturbo-cloud.huawei.com
Walking mode, comprehensive

coverage simulation
You can also select several APs

for partial simulation.
Display information
about connected APs:
➢ AP name
➢ Channel
➢ RSSI
➢ Rate
AirEngine Wi-Fi 6 Common Networking Architecture

Wireless AP Access LSW Core LSW WAC
AirEngine Wi-Fi 6
Leader AP Solution
GE/2.5GE/10GE
GE or 10GE uplink AC6508
Specification: 512 APs, 4K users
AC6805
Specification: 6K APs, 64K users
GE/2.5GE/10GE
uplink
GE or 10GE CloudEngine AirEngine 9700-M1

Specification: 2K APs, 40K users
Switch S12700E
GE/2.5GE/10GE AP + WAC Solution

uplink
GE or 10GE GE/2.5GE/10GE
Cloud Managed Solution
uplink Specification: 400K APs, 2000K users
Mesh Solution
RSSI-based Wireless Positioning and Refined O&M Based on Terminal

Locations
Partners that provide upper-layer
Application layer ... ... applications:
(provided by a In China: Etone and TDLBS
third party) Location analysis Customer flow statistics IT service system Outside China: Purple and Cloud4Wi
CampusInsight provides the

positioning capability.
Northbound API interconnection

• Map information
• Wi-Fi terminal location
.
information
.
.
Supported functions
• Crowd flow heatmap, walking
Network layer path, interference source
positioning, and location query
Terminal layer MateBook Application scenarios

• Shopping mall or supermarket
• Office
Spectrum Analysis: Monitoring the Status of All Channels
CampusInsight spectrum analysis monitors the status of all channels on APs and displays the usage of each
channel, which is simple and easy to understand.
Traditional 3 All-channel status monitoring

CampusInsight monitors the status of
spectrum analysis all channels in real time based on APs,
and displays the historical trend chart,
FFT? non-Wi-Fi interference source types,
and RSSIs.
Spectrum graph?
Spectral density
diagram? Historical trend chart of each channel
2
APs report channel scan data
1 to CampusInsight through WMI.
APs scan all channels in real
time and scan co-channel
interference, non-Wi-Fi
interference, and normal usage
proportion of each channel.
AP List of detected Wi-Fi/non-Wi-Fi interference sources
Neighboring AP
Constant-frequency device
Frequency scanning device Frequency hopping device
(2.4G wireless video and audio,
(Microwave oven, Bluetooth, (Cordless phone and cordless
5G wireless video and audio, baby
and game controller) phone base)
monitor, and ZigBee device)
Flagship Indoor Wi-Fi AP: AirEngine 8760-X1-PRO
16 spatial streams + flexible
Industry's highest: two 10G uplink ports
radio mode switchover
16 spatial streams
Ultra-high capacity
10.75 Gbps 10GE 10GE
Optical: 10GE SFP+

Dual-PoE power
Radio modes: 4+8+independent radio for Electrical: 10GE x 2
supply, improving
scanning/4+12/4+8+4 Supporting optical/electrical
AP reliability
hybrid cable
Independent probe Innovative heat dissipation design, the

temperature is reduced by 4℃
AirEngine 8760-X1-PRO
Independent hardware +
dual-band scanning
Real-time network optimization Liquid cooling Bionic shark fin cooling
* Works with CampusInsight to perform big data optimization.
Parameter Specifications Parameter Specifications

Port 2 x 10GE electrical + 1 x 10GE SFP+ Antenna Built-in smart antenna
DC: 42.5 V to 57 V
Bluetooth BLE 5.2 Power supply
PoE++, dual power supplies for backup
AP rate 1.15 Gbps + 9.6 Gbps USB port 1
Hardware encryption: IPsec and DTLS
Built-in IoT module ZigBee, RFID, asset management, and ESL Security
WPA3
Indoor High-End Wi-Fi 6 AP: AirEngine 6760-X1/X1E
Basic mode: 4+6 RTU mode:

1. Two spatial streams added: 4+8 2. SDR, 3. Independent dual-
(bringing higher performance) 4+8/4+4+4/4+6+scanning band scanning
5 GHz 2.4 GHz Radio 1 Radio 2
2.4 GHz 5 GHz-1
Radio 1 Radio 2 Radio 3
Switchable 5 GHz-2
Real-time network
AirEngine 6760-X1 AP rate: 8.35 Gbps AP rate: 10.75 Gbps Flexible switchover
status awareness

1 x 10GE electrical + 1 x GE
Port Antenna Built-in smart antenna
electrical + 1 x 10GE SFP+
DC: 42.5 V to 57 V
Bluetooth BLE 5.2 Power supply
PoE++
4+6 mode: 1.15 Gbps + 7.2 Gbps

AP rate USB port 1
4+8 mode: 1.15 Gbps + 9.6 Gbps
AirEngine 6760-X1E Built-in IoT ZigBee, RFID, asset Hardware encryption: IPsec and DTLS
Security
module management, and ESL WPA3
* Right To Use (RTU): The number of spatial streams and functions are added through licenses.
Indoor Triple Radios Wi-Fi 6 AP: AirEngine 6761-21T
Triple radios Leader AP Insensitive access
Radio 1 Radio 2
2.4 GHz 5 GHz-1
Radio 3
5 GHz-2 Module CPE
Maximum rate: 6.575 Gbps Direct forwarding: 24 Secure and

insensitive
(2+2+4) Tunnel forwarding: 12 terminal access

Maximum 6.575 Gbps
Antenna Built-in smart antenna
rate (0.575 Gbps + 1.2 Gbps + 4.8 Gbps)
Interface 2 x GE electrical port Bluetooth BLE 5.2
Power
21.2 W (excluding USB) USB 1
consumption
Power DC: 12 V ± 10% IoT
AirEngine 6761-21T supply PoE+ power supply expansion
USB extended external IoT
Indoor Mid-Range Wi-Fi 6 AP: AirEngine 5761-21
6 streams + smart antenna Leader AP Insensitive access
Module CPE
Maximum rate: 5.375 Gbps Direct forwarding: 24 Secure and

insensitive
(2+4) Tunnel forwarding: 12 terminal access

5.375 Gbps
Maximum rate Antenna Built-in smart antenna
(0.575 Gbps + 4.8 Gbps)
Interface 2 x GE electrical port Bluetooth BLE 5.2
Power
17.9 W (excluding USB) USB 1
consumption
AirEngine 5761-21 DC: 12 V ± 10%
Power supply IoT expansion USB extended external IoT
PoE+ power supply
WLAN Product Portfolio
Wi-Fi 6 (802.11ax) indoor AP Wi-Fi 6 (802.11ax) outdoor AP WAC
NEW AirEngine 8760R-X1 AirEngine 8760R-X1E
23/03 Wi-Fi 6E • Device rate: 10.75 Gbps • Device rate: 10.75 Gbps
• NSS: 8+8/4+12 • NSS: 8+8/4+4+4
• Built-in smart antennas • External antennas
• BLE 5.2, PoE out • BLE 5.2, PoE out
AirEngine 8760-X1-PRO AirEngine 8761-X1 AirEngine 6760-X1 AirEngine 6760-X1E AirEngine 6761-22T* • 1 x 10GE electrical + 1 x GE • 1 x 10GE electrical + 1 x GE
• Device rate: 10.75 Gbps • Device rate: 5.95 Gbps • Device rate: 10.75 Gbps • Device rate: 10.75 Gbps • Device rate: 6.575 Gbps electrical port + 1 x 10GE SFP+ electrical + 1 x 10GE SFP+
• NSS: 4+12/4+8+4 • NSS: 4+8 • NSS: 4+6/4+8/4+4+4 • NSS: 4+6/4+8/4+4+4 • NSS: 2+2+4 (6 GHz)
• Built-in smart antennas • Built-in smart antennas • Built-in smart antennas • External antennas • Built-in smart antennas
• BLE 5.2, two built-in IoT slots • BLE 5.2, USB for IoT module • BLE 5.2, two built-in IoT slots • BLE 5.2, two built-in IoT slots • BLE 5.2 AC6805
• 2 x 10GE electrical + 1 x 10GE • 1 x 10GE electrical + 1 x GE • 1 x 10GE electrical + 1 x GE electrical • 1 x 10GE electrical + 1 x GE • 1 x 2.5GE electrical port, 1 x GE AirEngine 6760R-51 AirEngine 6760R-51E
• Device rate: 5.95 Gbps • Device rate: 5.95 Gbps
• Forwarding performance: 120 Gbps
SFP+ electrical + 1 x 10GE SFP+ electrical + 1 x 10GE SFP+ electrical port
Dynamic-Zoom • NSS: 4+4 • NSS: 4+4 • Maximum number of manageable APs: 6K
Smart Antennas • Built-in smart antennas • External antennas • Maximum number of access users: 64K
• BLE 5.2 • BLE 5.2
Hybrid Optical-
• 1 x 5GE electrical port + 1 x GE • 1 x 5GE electrical + 1 x GE
Electrical
electrical port + 1 x 10GE SFP+ electrical + 1 x 10GE SFP+
AirEngine 6761-21 AirEngine 6761-21E AirEngine 6761-21T AirEngine 5760-51
• Device rate: 3.55 Gbps • Device rate: 3.55 Gbps • Device rate: 6.575 Gbps • Device rate: 5.95 Gbps
Specification upgrade
• NSS: 4+4 • NSS: 4+4 • NSS: 2+2+4 • NSS: 2+4/4+4/2+2+4 AirEngine 5761R-11 AirEngine 5761R-11E
• Built-in Dynamic-Zoom • External antennas • Built-in smart antennas • Built-in smart antennas • Device rate: 1.775 Gbps • Device rate: 2.4 Gbps
Smart Antennas • BLE 5.2 • BLE 5.2 • BLE 5.2, two built-in IoT slots • NSS: 2+2 • NSS: 2+2
• BLE 5.2 • 1 x 2.5GE electrical port, 1 x • 1 x 2.5GE electrical port, 1 x • 1 x 5GE electrical port + 1 x GE • Built-in antennas • External antennas
• 1 x 2.5GE electrical port, 1 10GE SFP+ GE electrical port electrical • BLE 5.2 • BLE 5.2
x 10GE SFP+ NEW • 1 x GE electrical + 1 x SFP • 1 x GE electrical + 1 x SFP
23/03
AirEngine 9700-M1
• Forwarding performance: 120 Gbps
Wi-Fi 6 (802.11ax) scenario-specific AP • Maximum number of manageable APs: 3K
AirEngine 5761-21 AirEngine 5761-11 AirEngine 5762-12 AirEngine 5761-12 AirEngine 5762-10
• Device rate: 5.375 Gbps • Device rate: 1.775 Gbps • Device rate: 2.975 Gbps • Device rate: 1.775 Gbps • Device rate: 2.975 Gbps • Maximum number of access users: 32K
• NSS: 2+4 • NSS: 2+2 • NSS: 2+2 • NSS: 2+2 • NSS: 2+2
• Built-in smart antennas • Built-in smart antennas • Built-in smart antennas • Built-in smart antennas • Built-in smart antennas
• BLE 5.2 • BLE 5.2 • BLE 5.2 • BLE 5.2, built-in dual IoT slots • 1 x GE electrical
• 1 x 2.5GE electrical port, 1 x • 1 x GE electrical • 1 x GE electrical • 2 x GE electrical AirEngine 6760-51EI
GE electrical port • Device rate: 4.8 Gbps
• NSS: 4
Wi-Fi 6 (802.11ax) wall plate AP • External antennas
NEW • 1 x 5GE electrical + 1 x GE electrical +
Port upgrade
23/03 1 x 10GE SFP+
Hybrid Optical-
Electrical AC6508
AirEngine 5761-11W AirEngine 5761-12W AirEngine 5762-12SW * AirEngine 5762-13W AirEngine 5762-15HW AirEngine 5762-17W • Forwarding performance: 10 Gbps
• Device rate: 1.775 Gbps • Device rate: 1.775 Gbps • Device rate: 2.975 Gbps • Device rate: 2.975 Gbps • Device rate: 2.975 Gbps • Device rate: 2.975 Gbps • Maximum number of managed APs: 512
Wi-Fi 6 CPE UNR032H with vertical Wi-Fi 6 CPE UNR033H with
• NSS: 2+2 • NSS: 2+2 • NSS: 2+2 • NSS: 2+2 • NSS: 2+2 • NSS: 2+2 network ports horizontal network ports • Maximum number of access users: 4K
• Built-in smart antennas • Built-in smart antennas • Built-in smart antennas • Built-in smart antennas • Built-in smart antennas • Built-in smart antennas • Device rate: 2.975 Gbps • Device rate: 2.975 Gbps
• BLE 5.2 • BLE 5.2, PoE out • BLE 5.0 • BLE 5.0 • BLE 5.1 • BLE 5.1
• NSS: 2+2 • NSS: 2+2
• Uplink: 1 x GE electrical • Uplink: 1 x GE electrical • Uplink: 1 x GE electrical • Uplink: 1 x GE electrical • Uplink: 1 x 2.5G SFP • Uplink: 1 x GE electrical
• External antennas • External antennas
• Downlink: 4 x GE • Downlink: 4 x GE • Downlink: 1 x GE electrical • Downlink: 1 x GE electrical • Downlink: 4 x GE electrical • Downlink: 1 x GE electrical
electrical + 2 x RJ45 electrical + 2 x RJ45 (Optional colorful cover) • 4 x GE electrical • 4 x GE electrical
passthrough passthrough
Contents
Huawei Is the Only Challenger in the Gartner® Magic QuadrantTM for SD-WAN
• Huawei SD-WAN has been listed as the only challenger in the Gartner® Magic QuadrantTM for five consecutive years
• The only Chinese vendor in the Gartner® Magic QuadrantTM.、
• Huawei continues to rank No. 1 in China in terms of the SD-WAN market share.
2022
Gartner® Magic Quadrant™
For SD-WAN
3 consecutive years Five consecutive years

No.1
Gartner® Peer InsightsTM Challenger in Gartner® Magic
Market share in China
Customers' Choice QuadrantTM
Gartner, Magic Quadrant for SD-WAN, Sept. 2022. This report was named Magic Quadrant for WAN Edge Infrastructure from 2018 to 2021.
Gartner Peer Insights, https://www.gartner.com/reviews/market/sd-wan/vendor/huawei/product/huawei-sd-wan
Gartner, Magic Quadrant, and Peer Insights are registered trademarks and service mark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved. Gartner Peer Insights content consists of the opinions of individual end users
based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise
technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all
warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
Digital Transformation: Huawei SD-WAN Helps Improve Production Efficiency in Various Industries
Finance
Finance Large enterprise Retail store Energy
Financial services onto the cloud Remote office Retail 4.0 Digital gas station
Video conference & collaborative O&M of massive numbers of gas

Multi-cloud multi-center Private line upgrade
office stations
Traditional private lines cannot Poor video conferencing and Complex provisioning procedures A large number of sites are scattered across
quickly adapt to service changes collaborative office experience; Average provisioning period > 1 month the country.
on the cloud.
By 2025, 90% of enterprise 2% packet loss on transmission lines Site visit cost per capita: CNY1000 per visit
applications will be migrated to causes frame freezing in video services.
the cloud.
Slow network service
Unstable communication Slow deployment of Difficult to maintain traditional
provisioning during
quality on private lines traditional private lines private lines
cloudification
Better office experience and higher
More agile financial services Shorter TTM and higher ROI Lower O&M costs
efficiency
Challenges to Multi-Branch Services in the Cloud Era
Surge in bandwidth Diversified networking Complex network

Surge in applications
requirements scenarios O&M
HQ, branch + Onsite configuration by

10–100M private lines → 30+ (voice, ERP, …) →
IaaS/SaaS, private cloud, professional personnel
100M–10G hybrid links 600+ (4K/8K, IoT, VR, …)
POP, ... Deployment over days
Simplified SD-WAN: Converged Deployment of LAN, WAN, and Security, Building Branch Networks
with Ultimate Experience
Integrated management, control, and analysis,
intelligent O&M
Network-wide automation | AI-
• LAN/WAN convergence, unified policy orchestration
powered intelligent O&M
• Batch site configuration, creating 1000 sites in a day
Private SD-WAN Public cloud

cloud Intelligent traffic steering: ultimate experience
AR6700V AR6700V
• Intelligent traffic steering, ensuring experience of key applications
• A-FEC, ensuring smooth video experience even at 30% packet loss
• Data compression, improving data transmission efficiency
Email
FTP Video
conferencing
FTP
Email
FTP Video Large-scale networking, high security and reliability
conferencing
Internet 5G/4G MPLS • Enhanced proactive defense, offering E2E security

• Controller geographic redundancy, fast switchover, and high
reliability
One network to multiple clouds, on-demand

… interconnection
Provincial and municipal Counter Self- Robot Substation Oil & gas • High flexibility with multiple networking models, enabling all-
multi-center service scenario enterprise interconnection
Finance Retail Industry branch • Cloud-native SD-WAN, elastic scaling of performance, one hop to
clouds, and multi-cloud interconnection
Batch Flexible Application
Security O&M
Deployment Networking Optimization
Simplified/Batch Deployment, Higher Deployment Efficiency

Low efficiency, loose GUI relationships, and high Wizard-based template, batch deployment, higher
As-Is To-Be deployment efficiency
skill requirements
Long time Template-based

Quick configuration
Creating 30 minutes required for configuration Only 3 minutes required for
Creating sites
devices configuring and configuring and deploying a
(3 minutes)
(3 minutes)
deploying a single site single site
Site replication
Complex operations One stop

Configuring Configuring WAN E2E configuration on
NTP links Complex configuration,
requiring redirection across one page
(2 minutes) (10 minutes)
multiple pages
High skill Site replication

Connecting Configuring WAN requirements Batch deployment of sites of
the RR routes the same type
High dependence on
(2 minutes) (10 minutes)
personal experience,
error-prone
Security O&M
Flexible Networking Overview

⚫ SD-WAN mainly aims to provide flexible and reliable
networking for enterprise WANs.
⚫ Huawei SD-WAN Solution leverages the IP overlay technology
together with traditional network technologies — such as
(management channel)
Layer 2 switching, Layer 3 routing, and VPN isolation — to
achieve on-demand, flexible, and automatic connections RR
NETCONF
between enterprise branches, DCs, and the cloud, under the
management of iMaster NCE.
⚫ Huawei SD-WAN Solution uses the following channels to
MPLS
implement flexible networking:
 Management channel
HQ/DC site GRE or GRE over IPsec (data channel) Branch site
 Control channel
Edge Edge
 Data channel Internet
Management channel Control channel Data channel
Security O&M
Application-based Intelligent Traffic Steering: Ensuring Experience of

Key Applications
Application-based intelligent traffic steering Customer benefits
Application controllability
and visibility
Application-based intelligent traffic steering,
• Traffic of key applications
Quick identification of key automatically switching traffic of key applications to
is automatically switched
applications the optimal link to the optimal link.
Intelligent traffic steering based on many factors,
FPI such as the application SLA, priority, and bandwidth
Feature
identification
• Hybrid links, such as MPLS,
Customized
applications
MPLS Internet, and LTE, are fully
SLA non- utilized.
compliance
SLA non-
compliance
Internet
Selecting the optimal link for
Key applications, such as key applications
video and ERP
Security O&M
Per-Flow/Per-Packet Load Balancing: Ensuring a Bandwidth

Utilization of Over 90%
Uneven traffic distribution on links, resulting Per-flow and per-packet load balancing:
in low bandwidth utilization No congestion occurs on high-quality links, with a bandwidth utilization
Uneven traffic distribution on links of over 90%.
The primary link is congested while the secondary link
is idle.
P1 P2 P2 P3 P4 Packet
reassembly
Congested active link (MPLS) Key services MPLS (high-quality link) P1 P2 P3 P4
P1 P2 P3 P4
P1 P2 P3 P4
5G P1 P2 P3 P4 Receiving
secondary Sending end P1 P3 P4 end
Common services
link: (elephant flows)
idle 5G/Internet (lossy link)
• Per-flow/per-packet load balancing is configured for common services (elephant
flows) to share high-quality links.
• Packets on high-quality links are dynamically adjusted based on the bandwidth,
improving bandwidth utilization and preventing congestion.
Low comprehensive bandwidth • Only one retransmission is required upon packet loss on lossy links, preventing
packet loss and ensuring low latency.
utilization
Security O&M
A-FEC: Ensuring Smooth Video Experience Even at 30% Packet Loss
A-FEC NetEngine AR NetEngine AR

WAN
Real-time awareness of application packet loss and
adaptive redundancy compensation Real-time awareness of
application packet loss
Optimizing experience of video conferencing,
live streaming, video surveillance, and VoIP
services
Adaptive redundancy
compensation Packet loss occurs on a link. Packet-level FEC
Traditional: Artifacts appear on the video when the packet loss rate is A-FEC: No frame freezing occurs in case of 30% packet loss.
higher than 2%.
Note: A-FEC is supported in Huawei SD-WAN Solution.
Security O&M
Security Overview
⚫ The emergence of SD-WAN brings the
transformation of enterprise WAN architecture,
from a closed one to an open one, enlarging the
attack surface and bringing new security iMaster NCE
security
challenges, such as unauthorized access, data
(management channel)
hardening 1
breach, and network attacks. 1 Management RR
NETCONF
channel security
⚫ Huawei SD-WAN Solution provides high security
Control 1
from the following perspectives: channel
security
 System security: component security and inter- 1 CPE security
component security hardening
MPLS
 Service security: firewall, antivirus, intrusion
GRE or GRE over IPsec (data channel)
prevention system (IPS), and URL filtering HQ/DC site Branch site
1
2 Data
Edge Service traffic channel Edge
Internet
security security
Security O&M
SD-WAN O&M
Quickly obtain abnormal Quickly locate faulty devices Optimize WAN investment and
traffic or sites configuration policies
Real-time alarm monitoring Visualized topology status 45+ customized views

⚫ Customized dashboard (role or ⚫ Topology display based on sites and Site, link, application, device, and health
preference) links status views
⚫ Network-wide real-time alarms (in ⚫ Real-time acquisition of information • Bandwidth usage • Top N applications by
minutes) about the status and performance by site traffic
of sites and links for enterprises • Top N sites by • Link throughput trend
throughput • …
Portfolio of Huawei NetEngine AR Routers
HQ/Large branches NetEngine AR6300
NetEngine AR8140 NetEngine AR6280 5G-RU-101 5G-SIC
NetEngine
AR6300/AR6200
series
SRU-400H/SRU-600H SRU-400H/SRU-600H
Small- and medium-sized
enterprise branches
NetEngine AR6121E NetEngine AR6140E-9G-2AC NetEngine AR6710-L50T2X4 NetEngine AR6710-L26T2X4
NetEngine AR6100
series
Small enterprises
AR651 AR651W AR657W AR651W-8P
NetEngine AR650
series
Available only outside China
SOHO
NetEngine AR617VW-LTE4EA
AR611W AR617VW-LTE4
AR610 series
Available only Available only in Latin
outside China America
Contents
Entered the Gartner Magic Quadrant Ten Consecutive Times (2013-2022) and
Named a Challenger Six Consecutive Times (2017-2022)
✓ The only Chinese security vendor listed in the Gartner's

Challengers Quadrant for 6 consecutive years (2017-2021)
✓ Listed in Gartner's Magic Quadrant for 10 consecutive years
(2013-2021), the longest time in China
✓ No.1 comprehensive strength of enterprise-level firewalls in
China and top 5 in the world
✓ Serving more than 100,000 enterprises in over 80 countries
"Huawei provides a complete firewall solution with competitive

cost-effectiveness and is the best shortlisted vendor for
customers in China, Asia Pacific, Europe, and Latin America."
- Gartner Analysts Rajpreet Kaur, Adam Hils, Jeremy D'Hoinne
New Challenges Facing Firewalls
Difficult identification of
Service performance bottleneck Slow manual handling
unknown threats
Digital transformation drives interconnection Ever-changing unknown threats are highly It takes several hours to handle security
as well as the explosive growth of data, making difficult to identify, only 60% of which can be issues manually due to massive security
the service processing performance of accurately detected by traditional NGFWs. policies and logs.
firewalls become a bottleneck.
⚫ Growing popularity of all-optical networks and ⚫ Growing known threats ⚫ Analysis of massive security policies and logs
exponentially increased network traffic ⚫ Rapidly changed unknown threats ⚫ Time-consuming closed-loop threat handling
⚫ Higher demands on performance and latency ⚫ Ever-emerging encrypted attacks ⚫ Requirement for unified management
caused by the ever-increasing security service during interworking with other network
requirements products and security products
⚫ IPv6 network reconstruction
ASE Dynamically Allocating Resources to Service Modules,
Maximizing Resource Utilization
As-Is To-Be
• Resources are dynamically allocated to service • The Adaptive Security Engine (ASE) is used to
modules in advance. The resources are occupied and dynamically allocate CPU resources to service
cannot be dynamically optimized. The functions of modules, maximizing resource utilization. In addition,
each module must be delivered as a whole. component-based function delivery is available.
Content security Network features
• The traditional mechanism allocates CPU • Flexible resource scheduling: ASE can
Memory pre-allocation Dynamic memory
for IPS
resources to each function module in advance. allocation for IPS
dynamically schedule processes based on
Memory pre-allocation
Memory resources are still reserved for function Dynamic memory CPU resources and service traffic to
for AV modules even if the function is disabled. When allocation for AV decouple content security services and
Memory pre-allocation for the function requires more resources, the memory Dynamic memory maximize resource utilization.
anti-DDoS cannot be dynamically allocated. allocation for anti-DDoS • Component-based delivery (R22.0):
Memory pre-allocation for • Component-based delivery is not available. Memory pre-allocation independent compilation, release,
policy functions for policy functions
Compilation, release, and restart must be deployment, restart, and upgrade.
Idle resources performed as a whole. Idle resources
NP-based Acceleration of Data Service Offloading and 10
μs-Level Low-Latency and Fast Forwarding
As Is To Be
Session table CPU Session table
Session1 Session1
30 µs–50 µs General- ARM core
purpose CPU Session2 Session2
Unloading
+ flow tables
Network
10-18 Network Forwarding Flow1
10 µs–18 µs forwarding chip microseconds (NP) acceleration Flow2
engine
(NP)
Huawei USG6000F uses the NP acceleration engine to unload

Traditional firewall latency consists of network chip processing firewall session entries on core components, reducing the subsequent
latency and computing chip processing latency, resulting in packet forwarding delay by 70%. In addition, the USG6000F can
high forwarding latency. implement customized acceleration based on ACLs/interfaces to protect
key services.
New session Subsequent

creation session process
Dynamic/Static Intelligent Uplink Selection Based on Multi-
Egress Links
Static intelligent uplink selection Dynamic intelligent uplink selection IPSec/Internet/MPLS-based
uplink selection
ISP1 ISP2 ISP1 ISP2 Internet DC

ISP1
• Link weight IPSec VPN MPLS

• Interface bandwidth
• Link priority
(1 primary link + N
secondary links)
• Latency
• Jitter
• Packet loss rate
⚫ User-defined link weight ⚫ User-defined link SLA (latency, jitter, and ⚫ Intelligent IPSec uplink selection
⚫ Uplink selection by binding ISP address packet loss rate), selecting the optimal link
for traffic forwarding ⚫ Internet/MPLS-based uplink selection
sets to interfaces
⚫ Application-based intelligent uplink selection
Extensive Security Database and Comprehensive
Security Detection Capability
Service awareness Web category (URL) Intrusion prevention
⚫ Identification of 6000+ applications ⚫ Main web category database capacity > 160 million ⚫ Signatures: 20,000+
⚫ Full coverage of mainstream application protocols ⚫ Local high-performance self-learning hot database ⚫ Attack detection technology based on
⚫ Encrypted P2P protocols, Web 2.0, mobile ⚫ Effective data matching rate: 96%+ vulnerability and behavior analysis
applications, and micro applications ⚫ Enterprise-level web categories: 100+ ⚫ Anti-evasion technology based on context
⚫ Rapid response to customized requirements semantic restoration
⚫ Real-time analysis of 500 million URLs on the cloud
⚫ Default blocking rate > 85%
Defense against botnets,

Anti-malware (AV)
Trojan horses, and worms
⚫ Identified botnets: 500+ ⚫ Multi-level protection technologies defending against

⚫ Identified worms and Trojan horses: 1000+ hundreds of millions of viruses; detection of files
compressed in up to 100 layers
⚫ Accurate role identification capability based on
botnet topology analysis technology ⚫ Integrated intelligent technology detecting unknown
viruses (CDE)
⚫ Zombie tool collection and analysis technology
⚫ Detection of 20+ types of malicious code carriers
⚫ Threat detection accuracy: 99.9%+
⚫ Real-time virus database, covering popular high-risk
malware
45 Huawei Confidential Huawei security center: https://isecurity.huawei.com/sec/web/securityResearch.do#

Unified Management by the SecoManager, Simplifying O&M Based
on Service Deployment and Policy Change
Unified management
• The SecoManager supports unified management
of multiple security products, such as the
iMaster NCE
firewall, IPS, and anti-DDoS, and centralized
control of security policies, improving O&M
efficiency
• The firewall supports plug-and-play and can
O&M Policy proactively register with the SecoManager after
connecting to the network
Automatic security service orchestration
Management Report • Policies can be automatically deployed to
SecoManager
corresponding firewalls based on protected
network segments, and network segment
changes will trigger policy changes of device
reselection and deployment
• Customers can configure and manage security
Configuration Policy Log sending policies in the logical partition view
delivering control
Flexible management in multiple
scenarios
...
• In data center(DC) scenarios, the SecoManager
AntiDDoS AIFW IPS and DC SDN controller are deployed together to
centrally manage firewalls
Border Protection for Large and Midsize Enterprises
Border protection scenario for large and
midsize enterprises Scenario characteristics
File server Email server Web server • An enterprise has a large number of employees and
complex service traffic, making the enterprise network
vulnerable to various threats and attacks.
.COM
• High requirements are raised on defense performance and
border threat detection, requiring stable running in heavy
traffic environments.
DMZ
Product deployment and highlights

Branch
• Deployment: USG6000F series used as the egress gateway of

Trust large and midsize enterprises.
Employee Internet
• NP acceleration: The NP provides the fast forwarding capability,
network which greatly improves the firewall forwarding capability.
Public network • Service processing: The product provides mode matching,
USG6000F host/server acceleration for encryption/decryption service processing, content
security monitoring, and IPsec.
• Intelligent defense: The built-in AI detection engine enhances
border detection capabilities.
Untrust
Intranet Control and Security Isolation
Intranet control and security isolation scenario Scenario characteristics
• The intranets of large and midsize enterprises are complex,

Marketing department Production department Server area
security levels and security isolation need to be implemented for
different service networks, and traffic exchanged between different
networks needs to be monitored in real time.
• The user management system implements permission control,
quota control, and bandwidth resource management for intranet
access users.
Product deployment and highlights

Egress gateway
Internet
• Deployment location: The USG6000F series is deployed at the
intranet border of a large or midsize enterprise.
R&D department 1 USG6000F • Fine-grained security policy control: provides fine-grained security
Untrust policy control based on 5-tuple traffic, service applications, user
information, and time ranges, effectively implementing intranet
management and control.
• Quota control: controls intranet users' online traffic and time to
prevent bandwidth abuse and decreased working efficiency due to
R&D department 2 long online time.
Huawei HiSecEngine USG6500F Series AI Firewalls
Model USG6510F-D USG6530F-D USG6510F-DL USG6530F-DL USG6525F USG6555F USG6565F USG6585F
2*10GE SFP+ +
Fixed 10*GE RJ45 + 2*GE 10*GE RJ45 + 4*GE SFP + 8*GE
Interfaces 2*GE SFP + 8*GE 2*GE RJ45 + 8*GE COMBO + 2*10GE SFP+
SFP 2*10GE SFP+ RJ45 + LTE
RJ45 + LTE
IPv4 Firewall
Throughput(1
518/512/64- 2.5/2.5/2.5 Gbps 5/5/3.6 Gbps 2.5/2.5/2.5 Gbps 5/5/3.6 Gbps 2.5/2.5/2.5 Gbps 5/5/3.6 Gbps 7/7/3.6 Gbps 9/8/4 Gbps
byte, UDP)
IPv6 Firewall
Throughput
2.5/2.5/2.5 Gbps 5/5/3.6 Gbps 2.5/2.5/2.5 Gbps 5/5/3.6 Gbps 2.5/2.5/2.5 Gbps 5/5/3.6 Gbps 7/7/3.6 Gbps 9/8/4 Gbps
(1518/512/64-
Byte, UDP)
Form Factor Desktop 1U
External
Optional, 64 GB microSD card available for purchase Optional, M.2 SSD (64 GB/240 GB), hot-swappable
Storage
Power
Single power supply Optional dual power modules for 1+1 redundancy
Supplies
Huawei HiSecEngine USG6600F&USG6700F Series AI Firewalls
Model USG6615F USG6625F USG6635F USG6655F USG6585F USG6710F USG6715F USG6725F
4*100GE(QSFP28) +
8*GE COMBO + 4*GE(RJ45) + 2*100GE(QSFP28) + 2*40G(QSFP+)+
8*GE COMBO + 4*GE(RJ45) + 10*10GE(SFP+) 16*25GE(ZSFP+) +
Fixed Interfaces 4*GE(SFP)+ 6*10GE(SFP+) 8*25(ZSFP+) + 20*10GE(SFP+)
8*10GE(SFP+)
IPv4 Firewall
Throughput(151 15/15/15 Gbit/s 25/25/25 Gbit/s 35/35/35 Gbit/s 50/50/40 Gbit/s 80/80/40 Gbit/s 100/100/60 Gbit/s 160/160/80 Gbit/s 240/240/120 Gbit/s
8/512/64-byte,
UDP)
IPv6 Firewall
Throughput 15/15/15 Gbit/s 25/25/25 Gbit/s 35/35/25 Gbit/s 50/50/25 Gbit/s 80/80/25 Gbit/s 100/100/45 Gbit/s 160/160/50 Gbit/s 240/240/75 Gbit/s
(1518/512/64-
Byte, UDP)
Form Factor 1U
External
Optional, SATA (1 x 2.5 inch) supported, 240 GB/960 GB/1000 GB
Storage
Power Single AC power supply; optional dual
Dual AC power supplies
Supplies AC power supplies
Note: Some 100GE interfaces and 25GE interfaces on the USG6710F/USG6715F/USG6725F are combo interfaces.
Thank You
www.huawei.com

Huawei Office Network Solution Overview

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Huawei Office Network Solution Overview

Uploaded by

Copyright:

Available Formats

Introduction to Huawei Network Solution

2. Basic Concepts of Campus & CloudCampus Solution

3. Basic Concepts of Wi-Fi 6 & AirEngine Solution

4. Basic Concepts of SD-WAN Router Solution

5. Basic Concepts of HiSecEngine Firewall Solution

2. Basic Concepts of Campus & CloudCampus Solution

3. Basic Concepts of Wi-Fi 6 & AirEngine Solution

4. Basic Concepts of SD-WAN Router Solution

5. Basic Concepts of HiSecEngine Firewall Solution

A famous enterprise A top-ranked university A leading cloud company

Wireless IoT Cloudification

Higher bandwidth Better experience Higher efficiency

backbone millisecond-level low latency O&M

Customer Transform workplaces Transform production Transform public services

Open industry application development platform

Manual orchestration of network topology, Automatic discovery of network topology

Elastic core 10G

CloudEngine S12700E Model L

Base model Model S

Employee 20 Employees, wired/wireless...

• Group policy-based group information

2015 2018 2020 2. Automatically

• Authentication and policy

enforcement points cannot

Hop-by-hop CLI detection Automatic end-to-end diagnosis Telemetry

Access point Authentication point

Authentication failure, timeout, and slowness

10GE fixed switches

• 800 Gbps per slot • 720 Gbps per slot

S5732-H-V2 S5732-H S5731-H

Standard GE switches Simple GE switches

S5731-S S5731-S S5736-S S5735-S-V2 S5735-L-V2

2. Basic Concepts of Campus & CloudCampus Solution

3. Basic Concepts of Wi-Fi 6 & AirEngine Solution

4. Basic Concepts of SD-WAN Router Solution

5. Basic Concepts of HiSecEngine Firewall Solution

Fault rectification takes a long

Signals are available, but terminals fail

Terminals are connected, but the The network is unstable.

• High-density user access causes network cause terminal disconnection or service

congestion and sharply decreases wireless interruption.

3D Signal Simulation Resolves Coverage Holes or Weak Coverage

Cloud network planning: https://serviceturbo-cloud.huawei.com

Walking mode, comprehensive

You can also select several APs

AirEngine Wi-Fi 6 Common Networking Architecture

GE or 10GE CloudEngine AirEngine 9700-M1

GE/2.5GE/10GE AP + WAC Solution

RSSI-based Wireless Positioning and Refined O&M Based on Terminal

CampusInsight provides the

Northbound API interconnection

Terminal layer MateBook Application scenarios

Spectrum Analysis: Monitoring the Status of All Channels

Traditional 3 All-channel status monitoring

10.75 Gbps 10GE 10GE

Optical: 10GE SFP+

Independent probe Innovative heat dissipation design, the

Parameter Specifications Parameter Specifications

Basic mode: 4+6 RTU mode:

5 GHz 2.4 GHz Radio 1 Radio 2

2.4 GHz 5 GHz-1

Radio 1 Radio 2 Radio 3

Parameter Specifications Parameter Specifications

4+6 mode: 1.15 Gbps + 7.2 Gbps