Typical Applications

Context

This solution is applicable to deployment operations in scenarios such as sales stores, large-scale shopping malls, and modern campuses, and supports fast deployment of firewalls, switches, APs, and ARs.

Procedure

By following instructions on the deployment configuration page, you can quickly deploy sites. The following configurations are used for reference only (some optional parameters are not described here).

1. Navigate to the page for deployment of hybrid devices.
   1. Log in to iMaster NCE-Campus as a tenant administrator.
   2. Click Branch Network in the Typical Scenario area.

2. In the Site Management phase:
   • Create sites on the Site Management tab page. For details, see Create a Site.
   • View and set device deployment locations to plan wireless networks on the Floor tab page. For details, see Monitoring Sites.

3. In the Device Management phase:
   • Add devices to sites on Device Manage tab page. For details, see Adding Devices.
   • Upload a network plan on the Network Planning Import tab page. After a network plan is imported, related information is automatically imported, improving manual configuration efficiency. For details, see Configuring a Network Plan.

4. In the Device Onboarding phase:

   Configure devices downstream connected to a gateway to access the network through the gateway.

   Table 5-429 Parameters on the Device Onboarding page

   Parameter	Description
   Select the management subnet gateway	Select a gateway device at the local site.
   Device management subnet VLAN	The value is the same as the VLAN ID of the gateway that is directly connected to intranet devices.
   To obtain the subnet segment, perform the following steps	This parameter value can be set to Manual or Automatic. Manual: You need to manually configure the default IP addresses and masks. Auto: The default IP addresses are allocated automatically from the address pool.
   IP address pool	This parameter value can be set to an available IP address from the resource pool. Alternatively, you can click to create an available IP address.
   IP address	IP address of a VLANIF interface, which is used as the default gateway address of DHCP clients.
   Mask	Subnet mask of an IP address that a DHCP client automatically obtains. The gateway IP address and subnet mask determine the IP address range (DHCP address pool) that DHCP clients may obtain.
   AP mode	Mode of an AP in the subnet. The options are Cloud AP and Fit AP. NOTE: The AP mode of the current subnet can be specified only when the AP is managed by iMaster NCE-Campus for the first time. If the AP device is not configured with the initial configuration or has been executed, the AP mode cannot be changed.
   Automatically negotiates the controller address	When the function is enabled, the DHCP server of the current subnet automatically generates Option 148. Devices (switches or cloud-based APs) in the subnet can obtain the iMaster NCE-Campus address through Option 148 to register with iMaster NCE-Campus.
   Controller address type	Type of the iMaster NCE-Campus address. The value can be an IP address or a domain name. If the iMaster NCE-Campus address is set to a domain name, ensure that the DNS function is configured on the live network to resolve the iMaster NCE-Campus domain name. Otherwise, devices fail to register with iMaster NCE-Campus.
   Automatically negotiates the WAC address	When the function is enabled, the DHCP server of the current subnet automatically generates Option 43. Devices (Fit APs) in the subnet can obtain the WAC address through Option 43. NOTE: When there are Fit APs in the site, this item needs to be configured.
   WAC address	Enter the WAC address, which is separated by newline characters.

5. Device Configuration.

   On the One Config tab page, click the role icon of a device on the network and configure the device.

   When adding a device to a site, you can set the role of the device. The configuration varies according to device roles. The following figure shows configurations required for each device role.

   Table 5-430 Quick configuration features for different device roles

   Device Type	Role	Feature	Reference
   AP	AP	Area, SSID, security authentication	Configure an SSID. An SSID is a network name displayed when a station (STA) connects to a wireless network. An authentication mode can be specified for each SSID to perform access control for STAs. An AP allows multiple SSIDs. For example, employees and guests use different SSIDs, and different authentication modes can be used. For details about how to configure an SSID, see Configuring an SSID. Configure a security policy. To improve network security, you are advised to configure security policies to enhance the attack defense capability of APs. For details about how to configure a security policy, see Configuring Security Policies.
   FW	Gateway	Uplink, NAT, DNS, traffic policy, interface	For details about how to configure uplinks, NAT, and DNS, see Configuring a Network. Configure a quintuple-based security policy (based on the source IP address, source port, destination IP address, destination port, and protocol) and a traffic policy to ensure security and control traffic. For details, see Configuring a Traffic Policy. Configure a network interface on a firewall to ensure that it connects to a wired network. For details about how to configure a network interface, see Configuring Physical Interfaces.
   	Gateway+Core	Uplink, NAT, DNS, subnet, traffic policy, interface
   	Core	DNS, subnet, traffic policy, interface
   LSW	Core	Subnet, physical interface	Configure the DHCP server function on a specified switch. For details, see Configuring a Subnet. Configure a network interface on a switch to ensure that it connects to a wired network. For details about how to configure a network interface, see Configuring Physical Interfaces. Configure a management VLAN for a switch. For details, see Configuring a Management VLAN.
   	Aggregation	Physical interface
   	Access	Physical interface
   AR	Gateway	Uplink link management, NAT, DNS	For details about how to configure uplinks, NAT, DNS, and subnets, see Configuring a Network.
   	Gateway+Core	Uplink link management, NAT, DNS, subnet

6. Check the configuration delivery result.

   Check whether the configurations are successfully delivered to devices on iMaster NCE-Campus web UI. For details, see Checking the Configuration Delivery Result.

Context

CloudCampus Solution integrates the configuration and management models of LAN and WAN services on the campus network. In addition to configuring and managing LAN services for campus networks, this solution can also manage WAN interconnection services, implementing integrated configuration and management of LAN and WAN services.

This solution is applicable to deployment in EVPN tunnel mode in scenarios where site interconnection and Internet access need to be configured. ARs, firewalls, switches, and APs can be deployed.

Procedure

1. Navigate to the page for deployment in site interconnection scenarios.
   1. Log in to iMaster NCE-Campus as a tenant administrator.
   2. Click Multi-Branch Interconnection in the Typical Scenario area.

2. In the Global Configuration phase:
   • On the Physical Network tab page, set global parameters involved in tenant physical networks, including transport network parameters, IPSec encryption parameters, device activation security parameters, link failure detection parameters, and traffic steering policy parameters. For details, see Setting Global Parameters.
   • On the Virtual Network tab page, set global parameters involved in tenant virtual networks, including the AS number, address pool, and DNS. For details, see Setting Global Parameters.

3. In the Site Management phase:
   • Create sites on the Site Management tab page. For details, see Create a Site.
   • View and set device deployment locations to plan wireless networks on the Floor tab page. For details, see Monitoring Sites.

4. In the Device Management phase:
   • Add devices to sites on Device Manage tab page. For details, see Adding Devices.
   • Upload a network plan on the Network Planning Import tab page. After a network plan is imported, related information is automatically imported, improving manual configuration efficiency. For details, see Configuring a Network Plan.
   • Configure a management VLAN for a switch. For details, see Configuring a Management VLAN.

5. In the Device Onboarding phase:
   • On the ZTP tab page, configure physical links on the WAN. This operation is mandatory for site deployment. After a site is configured or activated, you can add or delete WAN-side links. For details, see Configuring the Network Access Mode for a Site.
   • When adding multiple sites, configure the same gateway type, the same number of WAN links, and the same transport network for them on the WAN Link Template tab page. By customizing a site template, you can modularize repeated configuration information. When configuring a site, you can use the site template to automatically fill in the same configuration information, improving the configuration efficiency. A WAN link template is also a classification of sites. You can quickly search for a site by selecting a WAN link template. Once a WAN link template is used by a site, only the template name and description can be modified. Other parameters cannot be modified. Plan the data before creating a WAN link template. For details, see (Optional) Configuring a WAN-side Site Template.
   • On the WAN Underlay tab page, configure the WAN-side underlay network, including interfaces and routes. For details, see Configuring the Underlay Network.
   • On the RR tab page, associate an edge site with an RR if the EVPN tunnel mode is selected. For details, see Associating an Edge Site with an RR Site.

6. In the VPN Configuration phase:
   • Create a virtual network. Create a virtual network interconnecting LAN and WAN. For details, see Creating VNs in LAN-WAN Interconnection Scenario.
   • Configure WAN-side services, including the user-defined topology, user-defined topology policy, and WAN route. For details, see Configuring WAN Services.
   • Configure LAN-side services, including the subnet, interface, route, and SSID. For details, see Configuring Network Devices.
   • To connect the LAN and WAN, configure the VLAN ID, IP address, interconnection port, and interworking route for the LAN-side border device and WAN-side gateway. For details, see Configuring LAN-WAN Interconnection.

7. In the Flow Policy phase:
   • Configure a traffic classifier template so that packets matching the same traffic classification rule are processed in the same manner. For details, see Creating a Traffic Classifier Template.
   • Configure an effective time template. By default, a traffic policy takes effect immediately after it is applied to a service module. If you want a traffic policy to take effect only in a certain period, you can define a time range in an effective time template and associate the time range with the traffic policy. Defining and associating time ranges with traffic policies allow you to use time-based traffic policies to control services. For details, see Creating an Effective Time Template.
   • Configure ACL, QoS, intelligent traffic steering, site-to-Internet service, and site-to-legacy site service on the Overlay tab page. For details, see Creating an ACL Policy for the Overlay Network, Creating an Intelligent Traffic Steering Policy for the Overlay Network, Creating a QoS Policy for the Overlay Network, Configuring an Internet Access Policy for a Site, Configuring a Mutual-Access Policy for Traditional Sites.
   • Configure ACL, Cloud Security and NAT on the Underlay tab page. For details, see Creating an ACL Policy for the Underlay Network,Connecting to a Third-Party Secure Cloud Gateway Policy, Creating a NAT Policy for the Underlay Network.
   • Configure QoS and NAT ALG on the Common tab page. For details, see Creating a QoS Policy (General Configuration), Configuring NAT ALG.

Context

To meet the requirements of multi-service convergence on a campus network, you can deploy and configure service-oriented virtual networks (VNs) on a single physical campus network using iMaster NCE-Campus.

Currently, LAN-based VNs are applicable to large- and medium-sized campus networks in the CloudCampus Solution.

Procedure

1. Navigate to the page for deployment in site interconnection scenarios.
   1. Log in to iMaster NCE-Campus as a tenant administrator.
   2. Click VXLAN in the Typical Scenario area.

2. In the Site Management phase:
   • Create sites on the Site Management tab page. For details, see Create a Site.
   • View and set device deployment locations to plan wireless networks on the Floor tab page. For details, see Monitoring Sites.

3. In the Device Management phase:
   • Add devices to sites on Device Manage tab page. For details, see Adding Devices.
   • Upload a network plan on the Network Planning Import tab page. After a network plan is imported, related information is automatically imported, improving manual configuration efficiency. For details, see Configuring a Network Plan.
   • Configure a management VLAN for a switch. For details, see Configuring a Management VLAN.

4. In the Resource Pool phase:
   • Configuring fabric global resource pools: Before creating VNs, you need to configure global resources, including the resource pools of loopback interface IP addresses, VLANs, VNIs, and BDs. During VN creation, iMaster NCE-Campus automatically allocates resources from resource pools. For details, see Configuring a Fabric Global Resource Pool.
   • Configuring underlay automated resource pools: You can enable automated routing domain configuration to implement automatic deployment of the underlay network when creating fabrics, so that the underlay network can be configured automatically. iMaster NCE-Campus automatically allocates resources from the underlay automated resource pools to devices. For details, see Configuring an Underlay Automated Resource Pool.

5. In the Fabric Management phase:

   After a physical underlay network is deployed, virtual Layer 2 or Layer 3 networks (overlay networks) are constructed over it. For details, see Fabric Management.

6. In the VN Configuration phase:

   VNs are created based on a fabric network. A VN corresponds to a network tenant or a service. For details, see LAN-side Logical Network Management.

7. In the Service Deployment phase:
   • A security group is a collection of communicating objects on the network. iMaster NCE-Campus authorizes specific security groups to users based on 5W1H conditions. Alternatively, administrators can specify users' IP addresses in security groups. Security groups are authorized to users through Huawei proprietary RADIUS attributes (Attribute 26 to Attribute 160). For details, see Configuring a Security Group.
   • Tenant administrators can define inter-group access control policies based on security groups and resource groups on the entire network. The policies are present in a policy control matrix. After a policy control matrix is configured, configure an inter-group access control policy from a source security group to a destination security group or resource group based on the policy control matrix. For details, see Configuring Inter-Group Policy Control.