Huawei H19-401_V2.0 - HCSP-Presales-Campus Network Planning and Design V2.0

NETCONF (Network Configuration Protocol) is the primary management protocol used in the Xinghe Intelligent Campus solution for communication between iMaster NCE-Campus and network devices. It uses a multi-layer structure where the Content Layer (data) and Operations Layer are encoded in XML . This allows for a structured, hierarchical representation of configuration data and state information, making it more efficient and programmable than traditional CLI or SNMP.

The iMaster NCE-CampusInsight platform is built around the "Experience-Centric" O & M philosophy, which is categorized into three primary views :

Network Health View (B): Monitors the overall stability and performance of switches and APs.

User Experience View (C): Tracks individual user journeys (connection, authentication, roaming).

Application Experience View (A): Analyzes the quality of specific services like video conferencing or ERP.

While terminal information is available, a "Terminal health view" is not considered one of the three core architectural pillars of the CampusInsight dashboard.

By default, Virtual Networks (VNs) are isolated from one another as they exist in separate VRFs. To enable inter-VN communication:

Internal Route Leaking (C): Routes are imported/exported between VRFs on the Border Node .

External Traffic Steering (D): Traffic is sent out of the Fabric through the Border Node to an external Firewall or Gateway , which then routes the traffic back into the second VN. This is the preferred method when security inspection between VNs (e.g., Guest VN to Office VN) is required.

In a Virtualized Campus Network (Fabric) , terminals that do not support authentication protocols (such as simple IP cameras or legacy printers) cannot participate in dynamic authorization processes like 802.1X or Portal. To allow these "dumb" terminals to access a specific Virtual Network (VN) , administrators must manually bind the access port or a specific Static VLAN (A) to the desired VN (VRF) on the Edge node. This ensures the terminal's traffic is correctly encapsulated into the VXLAN overlay.

Wi-Fi Shield is a signature security technology exclusive to Huawei AirEngine series APs (specifically Wi-Fi 6 Advanced and Wi-Fi 7 models). It leverages advanced beamforming and the addition of interference signals to create a "secure zone" around an authorized user. By sending precise interference to non-target directions, it ensures that even if a malicious user intercepts the signal, they receive only disordered noise that cannot be demodulated. This is a key differentiator in Huawei’s Xinghe Intelligent Campus security framework.

Huawei’s WIDS (Wireless Intrusion Detection System) and WIPS (Wireless Intrusion Prevention System) provide comprehensive air interface protection. They are designed to detect:

Flood attacks (A): Detecting an abnormal volume of management frames (like Auth/Deauth floods).

Spoofing attacks (B): Detecting unauthorized APs or STAs using the MAC addresses of authorized devices.

Weak IV attacks (C): Detecting attempts to exploit older encryption (like WEP) by identifying weak Initialization Vectors.

Brute force cracking (D): Monitoring for repeated authentication failures that indicate an attempt to guess WPA/WPA2-PSK or WAPI-PSK keys.

The CloudEngine S16700 is Huawei's flagship core switch for large-scale enterprise campuses. It features an orthogonal Clos architecture with massive per-slot bandwidth (up to 14.4 Tbps). To support the evolution to ultra-high-speed backbones, the S16700 supports a high-density 400GE line card that provides 18 ports per board. When fully populated (8 slots), the S16700-8 chassis can support up to 144x400GE ports.

In a Virtualized Campus Network (Fabric) , Huawei recommends Distributed Gateway deployment. In this model, the Layer 3 gateway functionality for a tenant is moved down to the Edge nodes (Access or Aggregation switches). This ensures that "East-West" traffic (communication between devices in the same subnet but on different switches) is routed locally at the edge, preventing traffic from having to travel up to a centralized core and back down, thus reducing latency and avoiding bottlenecks.