Контроллер доступа — Huawei AC6508

Олег

22 июня 2022

Контроллер фиксированного беспроводного доступа AC6508 малой ёмкости предназначен для малых и средних предприятий. Устройство способно управлять 256 точками доступа (AP) и выполнять функцию коммутатора GE, что обеспечивает объединенный доступ пользователей проводной и беспроводной связи. Решение, отличающееся высокой масштабируемостью, позволяет гибко настраивать число управляемых точек доступа. В сочетании с полной линейкой точек доступа Huawei стандартов 802.11ax, 802.11ac и 802.11n данный контроллер формирует решение, адаптируемое к любому сценарию — для установки в кампусных сетях крупных предприятий, офисах компаний, беспроводных городских вычислительных сетях, а также покрытия общественных зон беспроводной связью.

Функции

Большая ёмкость и высокая производительность. Устройство поддерживает 10 интерфейсов GE и 2 оптических интерфейса 10 GE, 256 точек доступа и 4000 пользователей.
Адаптируемость. Поддерживаются различные режимы передачи данных, включая прямую передачу трафика от точек доступа в сеть и туннелирование трафика до контроллера. Эффективное администрирование с использованием методов управления доступом на основе ролей и на основе категорий пользователей.
Гибкие средства эксплуатации и техобслуживания. В комплекс средств O&M входят iMaster NCE, CampusInsight, веб-платформа и интерфейс командной строки.

Роуминг

Балансировка при бесшовном роуминге.
Dynamic Frequency Assignment (DFA) алгоритм для обнаружения и устранения помех на смежных каналах. При избыточности сигнала точка может сменить частоту, перейти в другой режим работы или отключиться для увеличения пропускной способности системы.
Интеллектуальная технология оптимизации конфликтов. Алгоритмы Dynamic Enhanced Distributed Channel Access (EDCA) и Airtime Scheduling используются для планирования времени занятости канала и приоритета обслуживания каждого пользователя. Каждому пользователю назначается относительно равное время для использования ресурсов канала.

Дополнительные роли

AC6508 имеет встроенный сервер Portal/AAA и может обеспечивать аутентификацию пользователей Portal/802.1X.

Сеть

WLAN AC может быть развернут в режимах встроенной, байпасной, мостовой и ячеистой сети и поддерживает как централизованную, так и локальную переадресацию.
WLAN AC и точки доступа могут быть подключены по L2 или L3. Когда точки доступа развертываются в частной сети, а сетевой адаптер WLAN развертывается в общедоступной сети, можно развернуть NAT.
WLAN AC совместим с сериями точек доступа Huawei 802.11n, 802.11ac и 802.11ax APs с поддержкой гибридных сетей 802.11n, 802.11ac и 802.11ax.
Поддерживает идентификацию более 6000 приложений от 4 до 7 уровня, включая обычные офисные приложения и приложения для загрузки P2P, такие как Lync, FaceTime, YouTube и Facebook.
Поддерживает технологии управления политиками на основе приложений, включая политики блокировки трафика, ограничения трафика и корректировки приоритетов.
Поддерживает автоматическое расширение базы данных приложений.

Надёжность

Бесперебойное обслуживание в режимах AC 1+1 HSB, и N+1.
Поддерживает агрегирование портов Link Aggregation Control Protocol (LACP) или Multiple Spanning Tree Protocol (MSTP).
Поддерживает экранирование аутентификации WAN между точками доступа и WLAN AC. В режиме локальной переадресации эта функция сохраняет оперативное состояние существующих STA и позволяет получать доступ к новым STA, когда точки доступа отключены от ACS WLAN, обеспечивая непрерывность обслуживания.

Управление

AC6508 имеет встроенный веб-интерфейс, который прост в настройке и обеспечивает всесторонний мониторинг и интеллектуальную диагностику.

Мониторинг

Мониторинг состояния и ключевые показатели эффективности собраны на одной странице и отображаются в режиме реального времени.

Конфигурация

Веб-система поддерживает групповую конфигурацию AP и автоматически выбирает общие параметры для пользователей, упрощая процедуру настройки.
Если две AP группы имеют небольшие различия в конфигурации, пользователи могут скопировать конфигурацию одной группы точек доступа в другую.

Диагностика в один клик решает 80% распространенных сетевых проблем

Веб-система поддерживает интеллектуальную диагностику в режиме реального времени и периодическую диагностику одним щелчком мыши по параметрам пользователей, точек доступа и
WLAN AC и предоставляет возможные предложения по устранению неисправностей.

Основные характеристики

Порты: 10 портов GE + 2 порта 10 GE SFP+
Источник питания: Адаптер питания переменного или постоянного тока
Пропускная способность контроллера: 6 Гбит/с
Максимальное количество управляемых точек доступа: 256
Максимальное количество пользователей доступа: 4K
Сеть между точкой доступа и контроллером доступа: Сеть уровня 2 или 3
Режимы передачи: Прямая передача и туннелирование трафика
Схема резервирования контроллера: 1+1 (горячее резервирование) или N+1
Протоколы радиосвязи: 802.11 a/b/g/n/ac/ac wave 2/ax

Спецификация

Коммутация и переадресация

Ethernet features
- Ethernet
  - Operating modes of full duplex, half duplex, and auto-negotiation
  - Rates of an Ethernet interface: 10 Mbit/s, 100 Mbit/s, 1000 Mbit/s, and autonegotiation
  - Flow control on interfaces
  - Jumbo frames
  - Link aggregation
  - Load balancing among links of a trunk
  - Interface isolation and forwarding restriction
  - Broadcast storm suppression
- VLAN
  - Access modes of access, trunk, and hybrid
  - Default VLAN
  - VLAN pool
- MAC
  - Automatic learning and aging of MAC addresses
  - Static, dynamic, and blackhole MAC address entries
  - Packet filtering based on source MAC addresses
  - Interface-based MAC learning limiting
- ARP
  - Static and dynamic ARP entries
  - ARP in a VLAN
  - Aging of ARP entries
- LLDP
Ethernet loop protection
- MSTP
  - STP
  - RSTP
  - MSTP
  - BPDU protection, root protection, and loop protection
  - Partitioned STP
IPv4 forwarding
- IPv4 features
  - ARP and RARP
  - ARP proxy
  - Auto-detection
  - NAT
  - Bonjour protocol
- Unicast routing features
  - Static route
  - RIP-1 and RIP-2
  - OSPF
  - BGP
  - IS-IS
  - Routing policies and policy-based routing
  - URPF check
  - DHCP server and relay
  - DHCP snooping
- Multicast routing features
  - IGMPv1, IGMPv2, and IGMPv3
  - PIM-SM
  - Multicast routing policies
  - RPF
IPv6 forwarding
- IPv6 features
  - ND protocol
- Unicast routing features
  - Static route
  - RIPng
  - OSPFv3
  - BGP4+
  - IS-IS IPv6
  - DHCPv6
  - DHCPv6 snooping
- Multicast routing features
  - MLD
  - MLD snooping
Device reliability
- BFD
Layer 2 multicast features
- Layer 2 multicast
  - IGMP snooping
  - Prompt leave
  - Multicast traffic control
  - Inter-VLAN multicast replication
Ethernet OAM
- EFM OAM
  - Neighbor discovery
  - Link monitoring
  - Fault notification
  - Remote loopback
QoS features
- Traffic classification
  - Traffic classification based on the combination of the L2 protocol header, IP 5-tuple, and 802.1p priority
- Action
  - Access control after traffic classification
  - Traffic policing based on traffic classification
  - Re-marking packets based on traffic classifiers
  - Class-based packet queuing
  - Associating traffic classifiers with traffic behaviors
- Queue scheduling
  - PQ scheduling
  - DRR scheduling
  - PQ+DRR scheduling
  - WRR scheduling
  - PQ+WRR scheduling
- Congestion avoidance
  - SRED
  - WRED
- Application control
  - Smart Application Control (SAC)
Configuration and maintenance
- Terminal service
  - Configurations using command lines
  - Error message and help information in English
  - Login through console and Telnet terminals
  - Send function and data communications between terminal users
- File system
  - File systems
  - Directory and file management
  - File uploading and downloading using FTP and TFTP
- Debugging and maintenance
  - Unified management over logs, alarms, and debugging information
  - Electronic labels
  - User operation logs
  - Detailed debugging information for network fault diagnosis
  - Network test tools such as traceroute and ping commands
  - Intelligent diagnosis
  - Interface mirroring and flow mirroring
- Version upgrade
  - Device software loading and online software loading
  - BIOS online upgrade
  - In-service patching
Security and management
- Network management
  - ICMP-based ping and traceroute
  - SNMPv1, SNMPv2c, and SNMPv3
  - Standard MIB
  - RMON
  - NetStream
- System security
  - Different user levels for commands, preventing unauthorized users from accessing device
  - SSHv2.0
  - RADIUS and HWTACACS authentication for login users
  - ACL filtering
  - DHCP packet filtering (with the Option 82 field)
  - Local attack defense function that can protect the CPU and ensure that the CPU can process services
  - Defense against control packet attacks
  - Defenses against attacks such as source address spoofing, Land, SYN flood (TCP SYN), Smurf, ping flood (ICMP echo), Teardrop, broadcast flood, and Ping of Death attacks
  - IPSec
  - URL filtering
  - Antivirus
  - Intrusion prevention

Wireless

Networking between APs and WLAN ACs
- APs and WLAN ACs can be connected through a Layer 2 or Layer 3 network.
- APs can be directly connected to a WLAN AC.
- APs are deployed on a private network, while WLAN ACs are deployed on the public network to implement NAT traversal.
- WLAN ACs can be used for Layer 2 bridge forwarding or Layer 3 routing.
- WAN authentication escape is supported between APs and WLAN ACs. In local forwarding mode, this feature retains the online state of existing STAs and allows access of new STAs when APs are disconnected from WLAN ACs, ensuring service continuity.
Forwarding mode
- Direct forwarding (distributed forwarding or local forwarding)
- Tunnel forwarding (centralized forwarding)
- Centralized authentication and distributed forwarding
- In direct forwarding mode, user authentication packets support tunnel forwarding.
- Soft GRE forwarding.
- Tunnel forwarding + EoGRE tunnel
WLAN AC discovery
- An AP can obtain the device's IP address in any of the following ways:
  - Static configuration
  - DHCP
  - 3DNS
- The WLAN AC uses DHCP or DHCPv6 to allocate IP addresses to APs.
- DHCP or DHCPv6 relay is supported.
- On a Layer 2 network, APs can discover the WLAN AC by sending broadcast CAPWAP packets
Wireless networking mode
- WDS bridging:
  - Point-to-point (P2P) wireless bridging
  - Point-to-multipoint (P2MP) wireless bridging
  - Automatic topology detection and loop prevention (STP)
- Wireless mesh network
  - Access authentication for mesh devices
  - Mesh routing algorithm
  - Go-online without configuration
  - Mesh network with multiple MPPs
  - Vehicle-ground fast link handover
  - Mesh client mode
- CAPWAP tunnel
  - Centralized CAPWAP
  - CAPWAP control tunnel and data tunnel (optional)
  - CAPWAP tunnel forwarding and direct forwarding in an extended service set (ESS)
  - Datagram Transport Layer Security (DTLS) encryption, which is enabled by default for the CAPWAP control tunnel
  - Heartbeat detection and tunnel reconnection
- Active and standby WLAN ACs
  - Enables and disables the switchback function.
  - Supports load balancing.
  - Supports 1+1 hot backup.
    NOTE: In 1+1 VRRP HSB mode, WLAN ACs share one virtual IP address, simplifying the network topology.
  - Supports N+1 backup.
  - Supports wireless configuration synchronization between WLAN ACs.

AP management

AP access control
- Displays MAC addresses or SNs of APs in the whitelist.
- Adds a single AP or multiple APs (by specifying a range of MAC addresses or SNs) to the whitelist.
- Automatically discovering and manually confirming APs.
- Automatically discovering APs without manually confirming them
AP profile management
- Specifies the default AP profile that is applied to automatically discovered APs.
AP group management
- The AP group function is used to configure multiple APs in batches. When multiple APs managed by a WLAN AC require the same configurations, you can add these APs to one AP group and configure the AP group to complete AP configuration.
AP region management
- Supports three AP region deployment modes:
  - Distributed deployment: APs are deployed independently. An AP is equivalent to a region and does not interfere with other APs. APs work at the maximum power and do not perform radio calibration.
  - Common deployment: APs are loosely deployed. The transmit power of each radio is less than 50% of the maximum transmit power.
  - Centralized deployment: APs are densely deployed. The transmit power of each radio is less than 25% of the maximum transmit power.
- Specifies the default region to which automatically discovered APs are added.
AP type management
- Manages AP attributes including the number of interfaces, AP types, number of radios, radio types, maximum number of virtual access points (VAPs), maximum number of associated users, and radio gain (for APs deployed indoors).
- Provides default AP types.
Network topology management
- Supports LLDP topology detection.
AP working mode management
- Supports AP working mode switchover. The AP working mode can be switched to the Fat or cloud mode on the AC.

Radio management

Radio profile management
- The following parameters can be configured in a radio profile:
  - Radio working mode and rate
  - Automatic or manual channel and power adjustment mode
  - Radio calibration interval
  - The radio type can be set to 802.11b, 802.11b/g, 802.11b/g/n, 802.11g, 802.11n, 802.11g/n, 802.11a, 802.11a/n, 802.11ac, or 802.11ax.
- You can bind a radio to a specified radio profile
- Supports MU-MIMO.
Unified static configuration of parameters
- Radio parameters such as the channel and power of each radio are configured on the WLAN AC and then delivered to APs
Dynamic management
- APs can automatically select working channels and power when they go online.
- In an AP region, APs automatically adjust working channels and power in the event of signal interference:
  - Partial calibration: The optimal working channel and power of a specified AP can be adjusted.
  - Global calibration: The optimal working channels and power of all the APs in a specified region can be adjusted.
- When an AP is removed or goes offline, the WLAN AC increases the power of neighboring APs to compensate for the coverage hole.
- Automatic selection and calibration of radio parameters in AP regions are supported.
Enhanced service capabilities
- Band steering: Enables terminals to preferentially access the 5G frequency band, achieving load balancing between the 2.4G and 5G frequency bands.
- Smart roaming: Enables sticky terminals to roam to APs with better signals.
  - 802.11k and 802.11v smart roaming
  - 802.11r fast roaming (≤ 50 ms)

WLAN service management

ESS management
- Allows you to enable SSID broadcast, set the maximum number of access users, and set- the association aging time in an ESS.
- Isolates APs at Layer 2 in an ESS.
- Maps an ESS to a service VLAN.
- Associates an ESS with a security profile or a QoS profile.
- Enables IGMP for APs in an ESS.
- Supports Chinese SSIDs.
VAP-based service management
- Adds multiple VAPs at a time by binding radios to ESSs.
- Displays information about a single VAP, VAPs with a specified ESS, or all VAPs.
- Supports configuration of offline APs.
- Creates VAPs according to batch delivered service provisioning rules in automatic AP discovery mode.
Service provisioning management
- Supports service provisioning rules configured for a specified radio of a specified AP type.
- Adds automatically discovered APs to the default AP region. The default AP region is configurable.
- Applies a service provisioning rule to a region to enable APs in the region to go online.
Multicast service management
- Supports IGMP snooping.
- Supports IGMP proxy.
Load balancing
- Performs load balancing among radios in a load balancing group.
- Supports two load balancing modes:
  - Based on the number of STAs connected to each radio
  - Based on the traffic volume on each radio
Bring Your Own Device (BYOD)
- Identifies device types according to the OUI in the MAC address.
- Identifies device types according to the user agent (UA) field in an HTTP packet.
- Identifies device types according to DHCP Option information.
- Carries device type information in RADIUS authentication and accounting packets.
Location services
- Locates AeroScout and Ekahau tags.
- Locates Wi-Fi terminals.
- Locates Bluetooth terminals.
- Locates Bluetooth tags.
Spectrum analysis
- Identifies the following interference sources: Bluetooth, microwave ovens, cordless phones, ZigBee, game controller, 2.4 GHz/5 GHz wireless audio and video devices, and baby monitors.
- Works with the eSight to display spectrums of interference sources.
Hotspot2.0
- Supports a Hotspot2.0 network.
Internet of Things (IoT)
- Supports IoT cards on the AP to converge the WLAN and IoT.
Navi WLAN AC
- Supports remote STA access on the Navi WLAN AC.
Centralized license control
- Supports a license server as the centralized AP license control point.
- Allows a license server to manage license clients.
- Supports license synchronization between a license server and clients.

WLAN user management

Address allocation of wireless users
- Functions as a DHCP server to assign IP addresses to wireless users.
WLAN user management
- Supports user blacklist and whitelist.
- Controls the number of access users:
  - Based on APs
  - Based on SSIDs
- Logs out users in any of the following ways:
  - Using RADIUS DM messages
  - Using commands
- Supports various methods to view information:
  - Allows you to view the user status by specifying the user MAC address, AP ID, radio ID, or WLAN ID.
  - Displays the number of online users in an ESS, AP, or radio.
  - Collects packet statistics on air interface based on user
WLAN user roaming
- Supports intra-AC Layer 2 roaming.
  NOTE: Users can roam between APs connected to different physical ports on a WLAN AC.
- Supports inter-VLAN Layer 3 roaming on a WLAN AC.
- Supports roaming between WLAN ACs.
- Supports fast key negotiation in 802.1X authentication.
- Authenticates users who request to reassociate with the WLAN AC and rejects the requests of unauthorized users.
- Delays clearing user information after a user goes offline so that the user can rapidly go online again.
User group management
- Supports ACLs.
- Supports user isolation:
  - Inter-group isolation
  - Intra-group isolation

WLAN security

WLAN security profile management
- Manages authentication and encryption modes using WLAN security profiles.
Authentication modes
- Open system authentication with no encryption
- WEP authentication/encryption
- WPA/WPA2/WPA3 authentication and encryption:
  - WPA/WPA2-PSK+TKIP
  - WPA/WPA2-PSK+CCMP
  - WPA/WPA2-802.1X+TKIP
  - WPA/WPA2-802.1X+CCMP
  - WPA3-802.1X+GCMP256
  - WPA/WPA2-PSK+TKIP-CCMP
  - WPA/WPA2-802.1X+TKIP-CCMP
- WPA/WPA2-PPSK authentication and encryption
- WPA3-SAE+CCMP authentication and encryption
- WAPI authentication and encryption:
  - Supports centralized WAPI authentication.
  - Supports three-certificate WAPI authentication, which is compatible with traditional two-certificate authentication.
  - Issues a certificate file together with a private key.
- Allows users to use MAC addresses as accounts for authentication by the RADIUS server.
- Portal authentication:
  - Authentication through an external Portal server
  - Built-in Portal authentication and authentication page customization 802.1X authentication:
  - Authentication through an external 802.1X server.
  - Built-in 802.1X authentication.
Combined authentication
- Combined MAC authentication:
  - PSK+MAC authentication
- MAC+portal authentication:
  - MAC authentication is used first. When MAC authentication fails, portal authentication is used.
AAA
- Local authentication/local accounts (MAC addresses and accounts)
- RADIUS authentication
- Multiple authentication servers:
  - Supports backup authentication servers.
  - Specifies authentication servers based on the account.
  - Configures authentication servers based on the account.
  - Binds user accounts to SSIDs.
Security isolation
- Port-based isolation
- User group-based isolation
Security standards
- 802.11i, Wi-Fi Protected Access 2 (WPA2), WPA,802.1X
- Advanced Encryption Standards (AES), Temporal Key Integrity Protocol (TKIP), and Extensible Authentication
- Protocol (EAP) types:
  - EAP-Transport Layer Security (TLS)
  - EAP-Tunneled TLS (TTLS) or Microsoft Challenge Handshake Authentication Protocol Version 2 (MSCHAPv2)
  - Protected EAP (PEAP) v0 or EAP-MSCHAPv2
  - EAP-Flexible Authentication via Secure Tunneling (FAST)
  - PEAP v1 or EAP-Generic Token Card (GTC)
- EAP-Subscriber Identity Module (SIM)
WIDS
- Rogue device scan, identification, defense, and countermeasures, which includes dynamic blacklist configuration and detection of rogue APs, STAs, and network attacks.
Authority control
- ACL limit based on the following:
- Port
- User group
- Use
Other security features
- SSID hiding
- IP source guard:
- Configures IP and MAC binding entries statically.
- Generates IP and MAC binding entries dynamically.

WLANQoS

WMM profile management
- Enables or disables Wi-Fi Multimedia (WMM).
- Allows a WMM profile to be applied to radios of multiple APs.
Traffic profile management
- Manages traffic from APs and maps packet priorities according to traffic profiles.
- Applies a QoS policy to each ESS by binding a traffic profile to each ESS.
AC traffic control
- Manages QoS profiles.
- Uses ACLs to perform traffic classification.
- Limits incoming and outgoing traffic rates for each user based on inbound and outbound CAR parameters.
- Limits the traffic rate based on ESSs or VAPs
AP traffic control
- Controls traffic of multiple users and allows users to share bandwidth.
- Limits the rate of a specified VAP.
Packet priority configuration
- Sets the QoS priority (IP precedence or DSCP priority) for CAPWAP control channels.
- Sets the QoS priority for CAPWAP data channels:
  - Allows you to specify the CAPWAP header priority.
  - Maps 802.1p priorities of user packets to ToS priorities of tunnel packets.
Airtime fair scheduling
- Allocates equal time to users for occupying the channel, which improves users' Internet access experience.

Физические параметры

Размеры (В x Ш x Г): 43.6 x 210 x 250 мм
Тип интерфейса: 2 x 10G (SFP+) + 10 x GE
Потребляемая мощность: 21 Вт
Вес: 1.47 кг
Рабочая температура:
- При высоте над уровнем моря от -60 до 1800 м: 0 - 45 °C
- При высоте над уровнем моря от 1800 до 5000 м: температура понижается каждые 220 м на 1 градус
Рабочая влажность : от 5 до 95 % без конденсата
Модули питания: AC/DC адаптер

Производительность

Number of managed APs
- Central APs： 32
- Common APs and RUs： 256
  NOTE: The RUs managed by the WLAN AC do not occupy the AC's license resources. However, the total number of managed common APs and RUs cannot exceed the upper limit allowed by the AC.
Number of access users
- 4096
  NOTE: The maximum number of access users varies depending on the authentication mode.
Number of MAC address entries: 8192
Forwarding capability
- 10 Gbit/s
  NOTE: Packet length: 1514 bytes
Number of VLANs: 4096
Number of routing entries
- IPv4: 8192
- IPv6: 2048
Number of ARP entries: 6144
Number of multicast forwarding entries: 2048
Number of DHCP IP address pools: 64 IP address pools, each of which contains a maximum of 8192 IP addresses
Number of local accounts: 4096
Number of ACLs: 4096