Routing Domain

Routing Domain

A routing domain defines whether routes between different transport networks are reachable. Transport networks in the same routing domain are reachable to each other.

WANs provided by different Internet service providers (ISPs) are usually constructed independently and cannot communicate with each other. Sometimes, the WANs provided by different ISPs can communicate with each other. In this case, the WANs belong to the same routing domain.

iMaster NCE-Campus provides the following routing domains by default:

• MPLS: MPLS leased line, which carries normal services of users in wired mode.
• Internet: public Internet, which carries normal services of users in wired mode.

If the default routing domains do not meet your requirements, you can configure routing domains as needed.

IPSec encryption

Whether to enable IPsec encryption in a routing domain:

• Toggled off: IPsec encryption is disabled. In this case, enable protocol 47 of all devices on the firewall.
• Toggled on: IPsec encryption is enabled. In this case, the encryption algorithm and password that are set in IPSec Encryption Parameters are used for encryption.

Transport Network

Transport Network

Type of the transport network to which a WAN-side physical link belongs. It describes transport networks with the same link quality attribute. It is used to identify a type of networks provided by the same ISP. Each physical WAN link of a site belongs to a transport network.

Routing

Routing protocol

Routing protocol used by IWGs to establish BGP peer relationships with RRs.

AS number

Local AS number. It takes effect for RRs and IWGs added by the MSP administrator and also takes effect for the tenant devices that manage MSP RRs.

When a tenant is associated with an MSP RR, the BGP AS number on an edge device must be the same as that configured by the MSP administrator.

Community pool

A community attribute pool is a resource management pool. Community attributes can be configured and allocated to services.

Currently, the community pool is mainly used in the following configurations: IBGP on the WAN, RR management, Internet access, mutual access, area management, and multi-tenancy IWG. When the current community attribute pools are insufficient, you can add new ones as needed. A maximum of 10 community attribute pools can be configured. After the configuration, the community attribute pools that have been used cannot be updated or deleted. Unused community attribute pools can be deleted.

IP Pool

The IP address pool created by an MSP administrator is mainly used for configurations irrelevant to tenant services, and currently is mainly used to establish BGP peer relationship with RRs. The IP addresses in the IP address pool can be used as:

• System IP addresses
• IP address of public VPNs

The number of IP addresses in the IP address pool depends on the number of IWGs, RRs, and tenant edge sites. Plan address pools based on the network scale. The number of required addresses increases with the number of sites. For details about the relationship between them, click Details.

You can select Simple mode or Advanced mode for an address pool. In simple mode, IP addresses are assigned from the same address pool. In advanced mode, IP addresses can be assigned by setting IP pool, Interworking Tunnel, or Interlink.

IPSec Encryption Parameters

Protocol

Security protocol. The default value is ESP.

Authentication algorithm

Authentication algorithm. The value can be SHA2-256 or SM3. The default value is SHA2-256.

Encryption algorithm

Encryption mode of a link. The AES-128, AES-256, and SM4 algorithms are supported. If the authentication algorithm is set to SM3, the encryption algorithm can only be set to SM4.

If the authentication algorithm is set to SHA2-256, you are advised to select the AES-256 encryption algorithm. This is because the key of AES-256 contains 256 bits, having a higher security level than AES-128.

Life time

Global IPsec SA lifetime.

A security association (SA) defines the encryption algorithm, digest, and keys for secure data transmission between IPsec peers. You can configure the IPsec SA lifetime to update the SA in real time. This reduces the risk of SA cracking and enhances security.

IPSec SA generation mode

Whether to configure the IPsec SA generation mode. By default, this item is toggled off.

DH Group

Diffie-Hellman (DH) public key algorithm. It is used to dynamically negotiate encryption keys between two sites to prevent traffic monitoring between tenants connected to the same RR in multi-tenant scenarios.

After IPSec SA generation mode is toggled on, you can select a DH group. Currently, DH Group can be set only to GROUP19, GROUP20, or GROUP21. The DH group security levels are as follows: GROUP21 > GROUP20 > GROUP19.

Port Configuration

DTLS Server Port

Port number checked by the DTLS server.

CPEs and RRs set up control channels over DTLS connections for TNP information exchange. When an RR goes online, iMaster NCE-Campus delivers the command for configuring the port checked by the DTLS server to the RR. As such, the RR can set up control channels with CPEs.

By default, the port checked by the DTLS server is 55100. You can modify this setting as needed.

STUN Server Port

In most cases, an RR is configured as a STUN server and the CPE functioning as a branch gateway is configured as a STUN client. To detect whether a NAT device is deployed between the RRs and CPEs, you need to enable the STUN server function on the RRs and configure the IP address and UDP port number to be checked by the STUN server for STUN messages.

By default, the port checked by the STUN server is 3478. You can modify this setting as needed.

Connection Source Port

After this item is toggled on, you can specify the scanning start port, scanning times, and scanning increment for NAT detection, hole punching, and Keepalive (KA) packets.

Device Activation Security Settings

URL encryption key

Key for encrypting the URL in a deployment email. Email-based deployment will be successful only after you click the URL in the received email on your PC and enter this key.

URL opening validity period (day)

Validity period for a device to register its ESN with iMaster NCE-Campus. The timer starts once a deployment email is sent.

If you do not obtain the device ESN, you can add the device to iMaster NCE-Campus based on the device model. After a site is created and a deployment email is sent, the device checks whether the URL is valid. If so, the device registers its ESN with iMaster NCE-Campus.

Link Failure Detection Parameter Configuration

Detection packet sending interval

Interval at which an AR sends detection packets, in milliseconds. The default value is 1000 milliseconds.

Number of failed detections

Number of detection failures permitted before an AR automatically switches the link. The default value is 6.

Priority of detection packets

Priority in the IP header of a detection packet. A numerically higher value indicates a higher priority.

Viewing devices

View detailed information about a site.

1. Choose Design > Site Design > Device Management from the main menu.
2. Select a site from the navigation pane to view devices at the site.
   • Click All Devices to view all devices.
   • Click Not in Any Sites to view all devices that have not been added to any sites.
   • Click All Sites to view all devices at all sites.
   • Click a site under All Sites to view all devices at the selected site.

Restoring a device to its deployment configurations

After a device is restored to its deployment configurations, only deployment-related configurations (interface and sub-interface configurations, including their IP addresses) are retained on the device and other configurations are deleted from the device.

You need to use this function in the following situations:

1. After a site is deleted, the controller only deletes related configurations from the database and does not delete related configurations from devices at the site. In this case, you need to use this function to restore the devices at the deleted site to their deployment configurations.
2. You need to re-deliver configurations to a device.

1. Choose Design > Site Design > Device Management from the main menu.
2. Select the device to be restored to its deployment configurations.
3. Click More > Restore Deployment Configurations.

Modifying devices

Modify the name, ESN, or other information of a device.

1. Choose Design > Site Design > Device Management from the main menu.
2. Click in the Operation column in the row of the device to be modified.

Deleting devices

Delete unnecessary devices.

1. Choose Design > Site Design > Device Management from the main menu.
2. Click in the Operation column in the row of the device to be deleted.

Addition method

Method of adding a device.

Mode

Device information

ESN

ESN of a device. It is the unique identifier of a device. You can obtain the device ESN from the factory configuration list of the device or from the display esn command output if the device version is V300R022C00. (To view the ESN of a device running V600R022C00, run the display device esn command.)

Name

Unique name of a device. It is recommended that the site name be included in the device name. If the value is left empty, the device name is the same as the ESN by default. A device name can contain a maximum of 64 characters.

Deployment Verification

• If this function is enabled, you need to manually confirm deployment on the device management page after a device goes online for the first time. After that, the controller can deliver configurations to the device.
• If this function is disabled, the controller automatically delivers configurations to devices after they go online for the first time.

AR6300

RR

50

1000

AR1000V

RR

50

1000

AR6300

IWG

300

200

AR1000V

IWG

300

200

Viewing device capability configuration

View detailed information about a site.

On the Device Capability page, view devices and their access capability configurations.

Modifying device capability configuration

Modify the number of tenants and sites that a device can access.

Click in the Operation column on the Device Capability page.

Deleting device capability configuration

Delete unnecessary devices.

Click in the Operation column on the Device Capability page.

Device Model

Model of a device.

Type

Role attached to the device:

• RR
• IWG

Tenant Count/VN Count

• If Type is set to RR, this parameter specifies the number of tenants that the RR can access. The maximum value is 50.
• If Type is set to IWG, this parameter specifies the number of tenant departments that the IWG can access. The maximum value is 300.

Site Count

Number of sites that the device can access.

• If Type is set to RR, this parameter specifies the number of sites that the RR can access. The maximum value is 1000.
• If Type is set to IWG, this parameter specifies the number of sites that the IWG can access. The maximum value is 200.

Modifying a site

A site can be modified when it is not activated and cannot be modified after being activated.

1. Click in the Operation column in the row of the site to be modified.
2. Modifying site configuration
3. Click OK.

Deleting a site

A site cannot be deleted in any of the following situations:

1. A site has sub-sites.
2. A site is configured with a centralized Internet access policy.

1. Click in the Operation column in the row of the site to be deleted.
2. Click OK.

Site Name

Name of a site. It is recommended that you name a site in the format of Site role_Geographical location.

Y

Location

Geographical location of the RR site.

Y

Southbound IP service name

Southbound IP service to be configured for the site. Select a southbound IP service that has been configured. In the IPv6 single-stack or IPv4/IPv6 dual-stack scenario, southbound IPv6 addresses are displayed on the Select Southbound IP Service Name page.

Y

More

Description

Site-related information.

Y

Responsible person

Responsible person of the site.

Y

Email

Email address to which a deployment email is to be sent. By default, this email address is automatically associated during email-based deployment.

Y

Phone number

Phone number of the responsible person.

-

Postcode

Postcode of the site.

-

Address

Geographic location of the site.

-

Add Device

Device Model

Model of an AR to be added to the site. Select the model of a device that has been added to the device list.

Y

ESN

ESN of the AR to be added to the site.

Y

Modifying a site

A site can be modified when it is not activated and cannot be modified after being activated.

1. Click in the Operation column in the row of the site to be modified.
2. Modifying site configuration
3. Click OK.

Deleting a site

A site cannot be deleted in any of the following situations:

1. A site has sub-sites.
2. A site is configured with a centralized Internet access policy.

1. Click in the Operation column in the row of the site to be deleted.
2. Click OK.

Site Name

Name of a site. It is recommended that you name a site in the format of Site role_Geographical location.

Location

Geographical location of the IWG site.

Southbound IP

Southbound IP service to be configured for the site. Select a southbound IP service that has been configured. In the IPv6 single-stack or IPv4/IPv6 dual-stack scenario, southbound IPv6 addresses are displayed on the Select Southbound IP Service Name page.

More

Description

Site-related information.

Responsible person

Responsible person of the site.

Email

Email address to which a deployment email is to be sent. By default, this email address is automatically associated during email-based deployment.

Phone number

Phone number of the responsible person.

Postcode

Postcode of the site.

Address

Geographic location of the site.

Add Device

Device Model

Model of an AR to be added to the site. Select the model of a device that has been added to the device list.

ESN

ESN of the AR to be added to the site.

Single_gateway_mixed_links

Single gateway with an Internet link and an MPLS link

Internet (Device1, GE0/0/0, Internet)

MPLS (Device1, GE0/0/1, MPLS)

-

Single_gateway_mpls_link

Single gateway with an MPLS link

MPLS (Device1, GE0/0/0, MPLS)

-

Single_gateway_internet_link

Single gateway with an Internet link

Internet (Device1, GE0/0/0, Internet)

-

Single_gateway_dual_internet_links

Single gateway with dual Internet links

Internet1 (Device1, GE0/0/0, Internet)

Internet2 (Device1, GE0/0/1, Internet)

-

Dual_gateways_mixed_links

Dual gateways with an Internet link and an MPLS link respectively

Internet (Device1, GE0/0/0, Internet)

MPLS (Device2, GE0/0/0, MPLS)

Device1: GE0/0/1, Device2: GE0/0/1

Importing or exporting WAN link templates in batches

WAN link templates can be imported or exported using Excel files in batches.

Click Import or Export to configure WAN link templates in batches.

Modifying a WAN link template

The template name, gateway type, WAN link information can be modified. The default templates provided by the system cannot be modified.

Click in the Operation column on the WAN Link Template page to modify a template.

Deleting a WAN link template

WAN link templates can be deleted. The default templates provided by the system cannot be deleted.

Click in the Operation column on the WAN Link Template page to delete a template.

Copying a WAN link template

You can quickly create a WAN link template by copying an existing template, which improves the configuration efficiency.

If you perform the following operations after copying a template, the copied template may fail to be applied to sites associated with the source template:

• Modify Gateway.
• Modify or delete settings in the WAN Link area.
• Modify parameters in the Inter-CPE Link area.

Click in the Operation column on the WAN Link Template page to copy a template.

Template name

Name of a WAN link template.

Y

Gateway

Gateway type of the site where the link template is to be applied.

• Single Gateway: Select this option for sites with light gateway service traffic and low reliability requirements.
• Dual Gateways: Select this option for sites with high reliability requirements.

Y

Multiple sub-interfaces

Whether to enable the multiple sub-interfaces function on a device. If a device requires multiple sub-interfaces on a WAN link for WAN-side communication, you need to enable this function on the device. After this function is enabled, a maximum of 256 sub-interfaces can be created for a single gateway, and a maximum of 512 sub-interfaces can be created for dual gateways.

Y

WAN Link

Name

Name of a WAN link.

Y

Device

Name of the gateway at the site.

Y

Interface

Type and number of a physical interface used by the WAN link.

The following interface types are supported:

• GE: Ethernet interface, Ethernet sub-interface, and Layer 3 Eth-Trunk interface
• FE: Ethernet interface, Ethernet sub-interface, and Layer 3 Eth-Trunk interface
• XGE: Ethernet interface, Ethernet sub-interface, and Layer 3 Eth-Trunk interface
• LTE: 3G, 4G, and 5G interfaces
• xDSL (ATM): ADSL interface, and G.SHDSL interface (working in ATM mode by default)
• xDSL (PTM): VDSL interface (working in PTM mode by default)
• E1-IMA (ATM): G.SHDSL interface (working in ATM mode by default), E1-IMA interface, and E1-IMA sub-interface
• Ima-group: G.SHDSL interface (working in ATM mode by default), E1-IMA interface, and Ima-group sub-interface
• Serial: Serial interface and FR sub-interface
• Eth-Trunk interface
• Loopback interface
  NOTE:

  1. Loopback interfaces can be used only as transport network ports (TNPs) and cannot be configured with any services.
  2. By default, the overlay tunnel function is enabled on virtual links with loopback interfaces at both ends and cannot be disabled.

Y

Sub Interface

Whether to enable the sub interface function on the device.

-

Overlay Tunnel

Whether to enable the overlay tunnel function. If this function is enabled, an overlay tunnel is created on the WAN link.

Y

Sub Interface Index

Number of the sub interface.

The parameter is available only when Sub Interface is enabled.

-

Transport Network

Type of the transport network to which a WAN-side physical link belongs. It describes transport networks with the same link quality attribute. It is used to identify a type of networks provided by the same ISP. Each physical WAN link of a site belongs to a transport network.

If the available transport network types do not meet your requirements, create a transport network as needed on the WAN Global Configuration page.

Y

Role

Role of the link. You can set this parameter to active or standby. After active and standby links are configured, data travels only through the active link by default. If the active link fails, data moves to the standby link.

For a single-gateway site with multiple WAN links, specify each WAN link as active or standby. At least one active link must be configured. A maximum of one standby link (usually, an LTE or 5G link) can be used as the escape link and has the lowest priority. If all active links fail, traffic is forwarded through the escape link.

For a dual-gateway site, all WAN links are active by default. In addition, a single-gateway site must have at least one active link.

Y

Advanced parameters

Click Configuration and set Controller Southbound interface service and Southbound access priority in the displayed dialog box.

During the controller installation, an iMaster NCE-Campus southbound IP address is configured so that CPEs can communicate with iMaster NCE-Campus using this IP address. If iMaster NCE-Campus and some sites are on a private network while other sites are on a public network, two southbound IP addresses need to be configured so that sites on different networks can access iMaster NCE-Campus. As shown in the following figure, iMaster NCE-Campus and site 1 are on a private network, and site 2 is on a public network. iMaster NCE-Campus can access the public network only through the NAT device, and site 2 has access only to a public IP address after NAT. Therefore, two southbound IP addresses need to be configured during the installation: one is a private IP address, the other is a public IP address after NAT. When configuring a WAN link for site 1, specify the private IP address as the southbound IP address of iMaster NCE-Campus. When configuring a WAN link for site 2, specify the public IP address after NAT as the southbound IP address of iMaster NCE-Campus.

In addition to the default southbound IP address provided by the system, you can also use a southbound access service configured by the system administrator to specify the southbound IP address used by CPEs to communicate with the controller.

Y

Controller Southbound interface service

The southbound access services that have been configured during controller installation planning are used as default options for this parameter. If the system administrator has enabled a customized southbound access service, you can select this customized service in the WAN link template. Tenant administrators can view all available southbound access services on the page. The system administrators can create southbound access services as needed on the page.

Y

Southbound access priority

Priority of a controller southbound access service. This parameter is configurable after Southbound interface service is set.

• The priority can be High, Medium, or Low. The default value is Low.
• For AR5700&6700&8000 series devices, the priority takes effect only for performance channels and is supported in V600R022C00 and later versions.
  NOTE:

  If a device has multiple WAN links, you can configure Southbound access priority for each WAN link. After the device starts, it can select a WAN link based on the priority to register with iMaster NCE-Campus.

  Assume that a device has both Internet and LTE links, and needs to use the Internet link as the active link and the LTE link as the backup link. When configuring ZTP, you can set Southbound access priority of the Internet link to High and that of the LTE link to Medium or Low. As such, the device preferentially selects the Internet link when it attempts to register with iMaster NCE-Campus, and automatically switches to the LTE link for registration if the Internet link is faulty.

Y

Inter-CPE Link (required only when Gateway is set to Dual Gateways)

Use LAN-side L2 interface

Whether to use Layer 2 physical LAN interfaces on the interlinks between two gateways.

• If no direct link is configured between two gateways, LAN-side links need to be used for communication between dual gateways.
• If direct links are configured between two gateways, LAN-side links do not need to be used.

Y

VLAN ID

VLAN ID used by interlinks for communication between two gateways and used for VPN communication. The number of VLAN IDs must be greater than that of VPNs. In the dual-gateway scenario, iMaster NCE-Campus configures a VLAN for each VPN on interlink interfaces between two gateways. This implements VPN isolation. The start VLAN ID must be in the range from 1 to 4086 and the end VLAN ID must be in the range from 9 to 4094. The difference between the start and end VLAN IDs must be greater than or equal to 8 and less than or equal to 300. A maximum of 16 VLAN ranges can be configured, and the total number of VLANs cannot exceed 301.

-

Device1 Interface

Physical interfaces used by interlinks between two gateways. If two interlinks are required, the types of the two interlink interfaces on the same device must be the same. The types of the interfaces on both ends of an interlink must be the same. The interface type varies according to whether a direct link exists between two gateways:

• If a direct link exists between two gateways (that is, Use LAN-side L2 interface is disabled), use Layer 3 interfaces at both ends of an interlink. If only one interlink is required, Layer 3 sub-interfaces need to be created for the interfaces directly connecting the two gateways and be used as interlink interfaces. If multiple interlinks are required, iMaster NCE-Campus automatically configures the interfaces of these links as an Eth-Trunk sub-interface on each end to ensure link reliability.
• If no direct link is configured between two gateways (that is, Use LAN-side L2 interface is enabled), use Layer 2 interfaces at both ends of an interlink. If each of the two gateways directly connects to the same LAN switch using a Layer 2 link, a VLAN ID needs to be specified so that the gateways can communicate with each other through the corresponding VLANIF interfaces.

-

Device2 Interface

-

Device

Device name.

Interface type

Type of the LAN or WAN interface to be configured. The value can be L3 or L2. You can set Interface type to L3 or L2 only for GE, FE, and XGE interfaces. Other interfaces are L3 interfaces by default.

Interface

Type and number of the physical interface. Similar to the device name, the values cannot be modified.

Interface bandwidth (for AR1000Vs only)

Bandwidth of a physical interface. The value ranges from 1 to 1000000, in Mbit/s.

APN (This parameter needs to be set only when Interface is set to LTE.)

Multi-Access Point Name (APN) function of an LTE cellular interface used to implement data and VoIP communication.

PVC (VPI/VCI) (configurable only when Interface is set to xDSL (ATM))

PVC with specified VPI or VCI values.

Negotiation mode (This parameter needs to be set only when Interface is set to GE, FE, or XGE.)

Interfaces on both ends of a link must use the same negotiation mode. If an interface working in auto-negotiation mode frequently alternates between Up and Down, disable auto-negotiation and set the same rate and duplex mode on interfaces at both ends of a link.

Working mode (This parameter needs to be set when Negotiation mode to set to Manual.)

Whether an interface works as an optical or electrical interface. Only combo interfaces support both Copper and Fiber modes. You can select either of the two modes for combo interfaces based on networking requirements. For interfaces of other types, set this parameter based on the working mode supported by the interfaces.

Duplex mode (This parameter needs to be set only when Negotiation mode to set to Manual.)

Interfaces on both ends of a link must have the same duplex mode.

For optical interfaces, the duplex mode is fixed at the full duplex mode. For electrical interfaces, you can select the full-duplex or half-duplex mode according to the actual situation.

Speed (This parameter needs to be set only when Negotiation mode to set to Manual.)

Interface rate. Interfaces on both ends of a link must have the same rate.

Optical Module Type (This parameter needs to be set only when Interface is set to XGE.)

Set this parameter based on the transmission rate requirements. GE and 10GE types are available. A GE optical module transmits traffic at a rate of 1000 Mbit/s, and a 10GE optical module transmits traffic at a rate of 10000 Mbit/s. If 10GE is selected, the negotiation mode cannot be configured. The optical modules on the interfaces at both ends of a link must be of the same type.

STP enable (configurable only when Interface type is set to L2)

Whether to enable STP on the interface.

Device

Site gateway on which an Eth-trunk interface is created.

Eth-Trunk ID

ID of an Eth-Trunk interface. In the dual-gateway scenario, if the two gateways are connected through two Layer 3 physical links, the system automatically creates the Eth-Trunk 0 interface on each of the two gateways. In this case, you cannot create an Eth-Trunk interface with the ID of 0.

Eth-Trunk type

Whether the Eth-Trunk interface works in Layer 2 or Layer 3 mode.

Physical interface

Member interface of the Eth-Trunk interface. A maximum of eight member interfaces can be added.

RR/IWG configuration status

• : not configured
• : configured

Specifies whether a WAN link has been configured for the RR/IWG site.

RR/IWG activation status

• : not activated
• : activated

Specifies whether a deployment email has been sent to the gateway of the RR/IWG site.

Adding a WAN link

After a site is activated, you can add WAN links to the site.

1. Choose from the main menu and click the ZTP tab. In the left pane, select the site for which you want to add a WAN link. The WAN link configuration page is then displayed.
2. Click Create and set WAN link parameters.
3. Click OK.

Deleting a WAN link

After a site is activated, you can delete WAN links of the site as needed.

1. Choose from the main menu and click the ZTP tab. In the left pane, select the site from which you want to delete a WAN link. The WAN link configuration page is then displayed.
2. Select the link to be deleted and click Delete. In the displayed Warning dialog box, click OK.

Modifying a WAN link

You can modify WAN links of activated sites, for example, changing the IP address of a WAN link interface. Changing the interface IP address of a link used for deployment on a device will disconnect the device for a period of time.

1. Choose from the main menu and click the ZTP tab. In the left pane, select the site where a WAN link needs to be modified. The WAN link configuration page is then displayed.
2. Select the link to be modified and click in the Operation column. In the Set WAN Link dialog box that is displayed, modify the parameters that are not dimmed. For example, you can modify the IP address of the WAN link interface.

Clearing WAN configurations

After clearing WAN configurations of a site, you can delete this site and restore devices at this site to the undeployed state. This function is not applicable to a site connected to an RR, added to a VN, or configured with a policy.

1. Choose from the main menu.
2. Select a site that has been configured and click Clear WAN Configurations. After the site's WAN configurations are cleared, you can delete the site or deploy it again.

Sending an email

You can configure the controller to send a deployment email to deployment personnel to implement email-based deployment. After ZTP is configured on iMaster NCE-Campus, iMaster NCE-Campus automatically generates a deployment email or ZTP file. The URL in the email or ZTP file carries deployment information.

1. Choose from the main menu.
2. Select a site that has been configured and click Send Email. The deployment personnel can then click the URL in the email for deployment.

Downloading a ZTP file

You can download ZTP files to implement email-or USB-based deployment.

Link name

Link name of a WAN interface at the current MSP site. The WAN link name in the site template is used when a site template is used to create a site. This parameter cannot be modified after being configured.

Y

Transport network

WAN-side network to be accessed. The transport networks you have configured in the global configuration are used as options for this parameter. You can select either Internet or MPLS. This parameter cannot be modified after being configured.

Y

Interface

Gateway interface to which the WAN link connects. This parameter cannot be modified after being configured.

Y

Sub-interface (This parameter is configurable only when Interface is set to GE, FE, XGE, LTE, xDSL(ATM), or xDSL(PTM).)

Whether to use sub-interfaces.

• Set Dot1q VLAN sub-interfaces when Interface is set to GE, FE, XGE, xDSL (ATM), or xDSL (PTM).
• When Interface is set to LTE, you need to set Number.

In addition to the access protocol parameters that need to be set for interfaces, you also need to plan the following parameters:

• Ethernet sub-interface: Select a sub-interface depending on whether a VLAN needs to be terminated on a sub-interface.
  • Sub-interface number: You need to plan a number for a sub-interface. The sub-interface number is used as the name of the sub-interface. For example, if the sub-interface number is set to 10 for WAN interface GE0/0/0, sub-interface GE0/0/0.10 is created on the CPE.
  • Dot1q VLAN: You need to plan the VLAN ID of the sub-interface. If this parameter is specified, a Dot1q sub-interface is created for the parent interface and removes the tag of the specified VLAN. The VLAN ID on the local end must be the same as that configured on the peer end.
• LTE link sub-interface
  • Sub-interface number: You need to plan a number for a sub-interface. A maximum of two sub-interfaces can be created. One LTE link is divided into two logical links for dialup to access the LTE network. The CPE at the site needs to support dialup through two channels on the LTE interface.
• ATM sub-interface
  • Sub-interface number: You need to plan a number for a sub-interface.
• Public IP address

  Public IP address used by an edge site to access an RR site.

• Interface uplink and downlink capacity

  The uplink and downlink bandwidths of an interface need to be configured based on the actual requirements. The unit is Mbit/s. If the configured bandwidths are too small, packet loss occurs when the outgoing traffic exceeds the configured values, interrupting services.

• Link ID

  You can plan a unique ID for each link in an SD-WAN network. This helps you query link information by ID during maintenance.

Y

VLAN ID (This parameter is configurable only when Sub-interface is enabled.)

VLAN ID of a sub-interface.

-

VN instance

VN instance name. It specifies the name of the VN instance on the underlay network to which the interface is to be added. The value is a character string starting with underlay_, for example, underlay_1.

Y

IPv4 Overlay tunnel

Whether to enable the overlay tunnel function. If this function is enabled, an overlay tunnel is created on the WAN link.

-

APN (This parameter needs to be set only when Interface is set to LTE.)

Multi-Access Point Name (APN) function of an LTE cellular interface used to implement data and VoIP communication.

-

PVC(VPI/VCI) (This parameter needs to be set only when Interface is set to xDSL(ATM).)

PVC with specified VPI or VCI values.

-

Interface protocol (This parameter needs to be set only when Interface is set to GE, FE, XGE, xDSL(PTM), xDSL(ATM), or Eth-Trunk.)

Interface protocol used by the physical link between the CPE and WAN. WAN link parameters to be planned vary according to the interface type specified in the site plan.

GE, FE, XGE, and xDSL (PTM) interfaces support the following protocols:

• IPoE
• PPPoE

xDSL (ATM) interfaces support the following protocols:

• IPoA
• IPoEoA
• PPPoA
• PPPoEoA

Eth-Trunk interfaces support the following protocol:

• IPoE

Y

IP address access mode (This parameter needs to be set only when Interface protocol is set to IPoE or IPoEoA.)

Mode for assigning an IP address for the interface connecting the CPE to the WAN. The following options are supported:

• Static: You need to configure a static IP address for the interface.
• DHCP: DHCP is used to dynamically allocate IP addresses.

-

IP address (This parameter needs to be set only when Interface protocol is set to IPoE or IPoEoA and IP address access mode is set to Static or when Interface protocol is set to IPoA.)

IP address statically assigned to the interface connecting the CPE to the WAN. In the NAT scenario, for RR or edge sites, this parameter must be set to the private IP address of the device corresponding to the public IP address.

-

Subnet mask (This parameter needs to be set only when Interface protocol is set to IPoE or IPoEoA and IP address access mode is set to Static.)

-

Gateway (This parameter needs to be set only when Interface protocol is set to IPoE or IPoEoA and IP address access mode is set to Static.)

IP address of the interface used by the PE on the WAN side to communicate with the current site.

-

Mapping peer IP (This parameter needs to be set only when Interface is set to xDSL(ATM) and Interface protocol is set to IPoA.)

Peer IP address mapped to the PVC.

Different ATM interfaces or sub-interfaces on a device cannot be configured with the same mapped IP address. Otherwise, traffic forwarding fails.

-

User name (This parameter needs to be set only when Interface is set to LTE or Interface protocol is set to PPPoE, PPPoA, or PPPoEoA.)

User name and password allocated by the carrier to connect to the WAN.

-

Password (This parameter needs to be set only when Interface is set to LTE or Interface protocol is set to PPPoE, PPPoA, or PPPoEoA.)

-

Negotiation mode

You need to pay attention to the negotiation mode only for Ethernet interfaces. Interfaces on both ends of a link must use the same negotiation mode. If an interface working in auto-negotiation mode frequently alternates between Up and Down, disable auto-negotiation and set the same rate and duplex mode on interfaces at both ends of a link.

• Auto-negotiation: The interface rate and duplex mode are determined through negotiation with the peer interface.
• Manual: In non-auto-negotiation mode, you need to adjust the following configurations according to the actual interface status:
  • Interface working mode: An interface can be configured to work as an electrical or optical interface.
  • Duplex mode: An interface can work in either full-duplex or half-duplex mode.
  • Rate: An interface can work at a rate of 10, 100, or 1000, in Mbit/s.

Y

Working mode (This parameter needs to be set when Negotiation mode to set to Manual.)

Whether an interface works as an optical or electrical interface. Only combo interfaces support both optical and electrical interface modes. You can select either of the two modes for combo interfaces based on networking requirements. For interfaces of other types, set this parameter based on the working mode supported by the interfaces.

-

Duplex mode (This parameter needs to be set only when Negotiation mode to set to Manual.)

Interfaces on both ends of a link must have the same duplex mode.

For optical interfaces, the duplex mode is fixed at the full duplex mode. For electrical interfaces, you can select the full-duplex or half-duplex mode according to the actual situation.

-

Speed (This parameter needs to be set only when Negotiation mode to set to Manual.)

Interface rate. Interfaces on both ends of a link must have the same rate.

-

Optical Module Type (This parameter needs to be set only when Interface is set to XGE.)

Set this parameter based on the transmission rate requirements. GE and 10GE types are available. A GE optical module transmits traffic at a rate of 1000 Mbit/s, and a 10GE optical module transmits traffic at a rate of 10000 Mbit/s. If 10GE is selected, the negotiation mode cannot be configured. The optical modules on the interfaces at both ends of a link must be of the same type.

-

Public IP (This parameter needs to be set only when Interface is set to GE, FE, or XGE.)

IP address used by the CPE to connect to the WAN. In the EVPN tunnel mode, this parameter needs to be set only at RR sites.

The public IP address is an external accessible IP address on the current link. An edge site can register with an RR site through this address. In a carrier network scenario, this parameter is allocated by the carrier in a unified manner. In enterprise network scenarios, an enterprise administrator selects one public IP address from the network segment assigned by the carrier.

In NAT scenarios, this parameter must be set to a public IP address that is mapped to external networks.

-

NAT traversal

Whether to enable NAT traversal. This parameter needs to be configured only for links at IWG sites.

After this function is enabled, external network users can access internal servers and internal network users can access the external network in the NAT scenario.

-

Uplink bandwidth

Maximum uplink and downlink rates. Set the parameters based on the actual link bandwidth.

-

Downlink bandwidth

-

URL-based deployment

Whether to enable URL-based deployment for the current link.

• If this function is enabled, the interface parameter settings are loaded to the device through URL-based deployment.
• If this function is disabled, interface parameter settings are delivered to devices through NETCONF.

By default, URL-based deployment is enabled for all links configured for the first time at the current site, and is disabled for links added later.

-

Set as southbound device access address (This parameter needs to be set only when URL-based deployment is enabled.)

Whether to use the primary IP address of the controller southbound access service specified for the link as the controller southbound IP address to be delivered in deployment emails for the device to register with the controller. If the southbound access services configured for links on a single device are different, you can toggle on Set as southbound device access address for only one link. In this way, the device can register with the controller by using the primary cluster's IP address of the controller southbound access service configured only for the link enabled with Set as southbound device access address.

-

Southbound interface service

Southbound access service. By default, the southbound IP address used during controller installation is used. If the system administrator has customized and enabled other southbound access services, you can select customized access services for the WAN links as needed. The southbound access services applied to WAN links cannot be changed after deployment.

-

Link ID

ID of a WAN link.

-

Time zone

Time zone of devices at a site.

DST

Whether to enable DST of the time zone.

Configure mode (configurable when DST is enabled)

The options include Auto and Manual. When Manual is selected, manually set Name, Offset, Time type, Start time, and End time.

Configurations of a site when it functions as an NTP server

NTP authentication

Whether to enable a site as an NTP server and enable NTP authentication. On a network that requires high security, NTP authentication needs to be enabled. During authentication, the authentication password and authentication ID configured on the client are matched with those on the server. If they are the same, the authentication succeeds. You can configure password authentication between the NTP client and NTP server, so that the NTP client only synchronizes with authenticated servers, improving network security.

By default, the system uses the HMAC-SHA256 encryption algorithm because it is more secure.

Authentication password

Password used for NTP authentication.

Authentication key ID

Key ID used for NTP authentication. When a site functions as both the NTP client and server, the authentication key ID for the NTP server and that for the NTP client must be different.

Configurations of a site when it functions as an NTP client

NTP client mode

Mode in which a site functions as an NTP client:

• Manual Configuration: A site functions as an NTP client and the NTP server needs to be manually specified. In EVPN tunnel mode, configure an RR site as an NTP client which synchronizes its clock with the NTP server on the public network.
• Synchronize with the RR Site: A site functions as an NTP client and its parent site functions as the NTP server. By default, this mode is used. Retain the default setting for edge sites in EVPN tunnel mode.
• Disabled: A site does not function as an NTP client and does not perform clock synchronization.

NTP client (These parameters are configurable only when NTP client mode is set to Manual Configuration.)

Device

CPE that functions as an NTP client.

Server Network

Network where the NTP server is located. Set this parameter based on the actual situation. By default, Underlay is selected.

WAN Link(VN Instance)

WAN-side link connecting the site to the NTP server.

NTP Server Type

Type of the NTP server. The value can be IPv4.

NTP Server IP Address

NTP server address.

Preferential NTP Server

Whether the NTP server is specified as the preferred server. If multiple NTP servers are specified as preferred servers, the system randomly selects a preferred NTP server.

Authentication

Whether to enable authentication. If NTP authentication is enabled on the NTP server, the authentication function must also be enabled on the NTP client. Otherwise, clock synchronization cannot be performed.

Authentication Mode

Authentication mode, which can be MD5 or HMAC-SHA256. The authentication mode selected here must be the same as that enabled on the NTP server. HMAC-SHA256 is recommended, because it is more secure than MD5.

Authentication Password

Password used for NTP authentication.

The rules for verifying the authentication password are as follows:

For AR600&6100&6200&6300&SRG series and AR1000V devices, the authentication password can contain 6 to 255 characters and must contain at least two types of the following characters: special characters (\"`!@#$%^&()_+=-[]{},.;), uppercase letters (A to Z), lowercase letters (a to z), and digits (0 to 9).

Authentication Key ID

Key ID used for NTP authentication. This authentication ID is irrelevant to the NTP server. The authentication ID configured for an NTP client must be different from that for the NTP server.

The rules for verifying the authentication ID are as follows:

For AR600&6100&6200&6300&SRG series and AR1000V devices, if NTP Server Type is set to IPv4, the value must be in the range from 1 to 4294967295.

AR6280+SRU-400H

1000

AR6280+SRU-600H

1000

AR6300+SRU-400H

1000

AR6300+SRU-600H

1000

AR1000V(4vCPU)

500

AR1000V(8vCPU)

1000

AR1000V(16vCPU)

1000

AR8140-12G10XG

6000

AR8140-T-12G10XG

6000

Interface

Name of a Layer 3 interface.

Sub-interface

Sub-interface

Whether to create a sub-interface.

VLAN ID

The value ranges from 1 to 4094 for Layer 3 sub-interfaces. The value of Dot1q Vlan is the number of a sub-interface.

IP address

IP address of an interface or a sub-interface.

MTU

Maximum transmission unit (MTU) of an interface. This parameter cannot be configured for xDSL physical interfaces.

The size of data packets sent each time is limited at the network layer. When a network layer device receives an IP packet, it determines the outbound interface and obtains the MTU supported by the interface. The device then compares the IP packet length with the MTU. If the IP packet length is longer than the MTU, the device fragments the IP packet. Each fragment has a length less than or equal to the MTU.

• If the MTU is too small whereas the packet size is large, the packet is probably fragmented to many pieces. Therefore, the packet may be discarded due to the insufficient QoS queue length.
• If the MTU is too large, packets are transmitted slowly or even lost.

MSS

Maximum segment size (MSS) of TCP packets on an interface. The MSS is an option defined in the TCP protocol and refers to the maximum length of TCP packets that can be received by a device. When setting up a TCP connection, the local and peer devices negotiate an MSS value. If the length of a TCP packet received from the peer device exceeds the negotiated MSS value, the packet is fragmented.

Peer IP

IP address of the peer device. In most cases, a BGP peer relationship is established with a legacy site.

Peer AS

AS number of the peer device.

Local AS

Fake AS number of the local device. If this parameter is not configured, the AS number in the global configuration is used by default.

Typically, a device supports only one BGP process. That is, a device supports only one AS number. In some special cases, for example, when AS numbers need to be changed during a network migration, you can set a fake AS number for a specified peer to ensure successful network migration.

Keepalive time

Interval for sending Keepalive messages to the peer. After establishing a BGP connection, two peers periodically send Keepalive messages to each other to detect the status of the BGP connection. If a device receives no Keepalive message or any other type of message from its peer within the specified hold time, the device considers the BGP connection interrupted and tears down the BGP connection.

Hold time (s)

Interval after which a device, having not received a Keepalive message, declares a BGP peer dead. The hold time needs to be at least three times the Keepalive time.

Authentication type

Authentication type for BGP packets.

• Keychain: Keychain authentication is used. Keychain authentication must be pre-configured on devices using CLI. The keychain name must be the same as that configured on the devices.
• MD5 Encrypt: MD5 authentication is used. If this function is enabled, you need to enter a password in ciphertext. MD5 is an insecure encryption algorithm. To reduce security risks that may occur when MD5 is used, you are advised to periodically change the MD5 authentication password.
• No Encryption: No authentication is performed.

Routing policy

Routing Policy

Export

When an SD-WAN site needs to communicate with a legacy site, BGP can be used to control access paths.

Ensure that a peer relationship has been established between an SD-WAN site and a legacy site. You can configure a routing policy to control the advertisement of underlay BGP routes. Controlled by such a policy, a site advertises only the routes it wants to advertise or the routes required by the peer. As such, the access of the legacy site to the LAN side of the SD-WAN site is restricted.

Index

Index

Index of a routing policy.

Currently, routes can be filtered only by IP prefix.

Goto Index

After this parameter is set, routes to match the routing policy first match the conditions with Index as this specific Goto Index value. The Goto Index value must be larger than the Index value.

Match

IP Prefix

Community Filter

Community filter.

• Name: specifies the name of a community filter.
• Whole Match: When this function is enabled, the route matches the filter only when all community attributes are met.
• Match Mode: specifies matching mode of the community filter. It can be either permit or deny.
• Members: specifies a community number.

Apply

Filtering type

Mode for filtering BGP routes. After this parameter is set, the current site does not advertise BGP routes in a specified network segment to the underlay network.

• Blacklist: The site is allowed to advertise only BGP routes not in the network segment specified by IP prefix.
• Whitelist: Only BGP routes in the network segment specified by IP Prefix can be advertised.

MED (This parameter is available only when Filtering type is set to Whitelist.)

MED value to be set for BGP routes in the network segment specified by IP Prefix.

Similar to the cost (or metric) used by an IGP, the MED is used to determine the optimal route when traffic enters an AS. When a BGP-enabled device receives multiple routes to the same destination address but with different next hops from EBGP peers, it selects the route with the smallest MED value as the optimal route.

Community (This parameter needs to be set only when Filtering type is set to Whitelist.)

Community attribute to be added to BGP routes in the network segment specified by IP Prefix.

The community attribute is a private BGP attribute. It is transmitted between BGP peers and is not restricted within an AS. The community attribute allows a group of BGP-enabled devices in multiple ASs to share the same routing policies. This allows routing policies to be flexibly used and makes it simple to maintain and manage routing policies.

ExtCommunity (This parameter is available only when Filtering type is set to Whitelist.)

Extended community filter.

Local Preference (This parameter is available only when Filtering type is set to Whitelist.)

Default local preference to be set for BGP routes.

AS_Path (This parameter is available only when Filtering type is set to Whitelist.)

AS_Path value to be set for BGP routes in the network segment specified by IP Prefix.

The AS_Path attribute records the numbers of all ASs that a route passes through, from the source to the destination, in the vector order. You can configure the AS_Path attribute to implement flexible route selection.

Import

Import

When an SD-WAN site needs to communicate with a legacy site, BGP can be used to control access paths.

Ensure that a peer relationship has been established between an SD-WAN site and a legacy site. You can configure a routing policy to control the import of underlay BGP routes. Controlled by the policy, a site receives only the routes that it wants to receive. As such, the access of the SD-WAN site to the LAN side of the legacy site is restricted.

Index

Index

Index of a routing policy. Currently, routes can be filtered only by IP prefix.

Goto Index

After this parameter is set, routes to match the routing policy first match the conditions with Index as this specific Goto Index value. The Goto Index value must be larger than the Index value.

Match

IP Prefix

Community Filter

Community filter.

• Name: specifies the name of a community filter.
• Whole Match: When this function is enabled, the route matches the filter only when all community attributes are met.
• Match Mode: specifies matching mode of the community filter. It can be either permit or deny.
• Members: specifies a community number.

Apply

Filtering type

Mode for filtering BGP routes. After this parameter is set, the current site does not receive BGP routes in a specified network segment from the underlay network.

• Blacklist: Only BGP routes not in the network segment specified by IP Prefix can be received.
• Whitelist: Only BGP routes in the network segment specified by IP Prefix can be received.

MED (This parameter is available only when Filtering type is set to Whitelist.)

MED value to be set for BGP routes in the network segment specified by IP Prefix.

Similar to the cost (or metric) used by an IGP, the MED is used to determine the optimal route when traffic enters an AS. When a BGP-enabled device receives multiple routes to the same destination address but with different next hops from EBGP peers, it selects the route with the smallest MED value as the optimal route.

Community (This parameter needs to be set only when Filtering type is set to Whitelist.)

Community attribute to be added to BGP routes in the network segment specified by IP Prefix.

The community attribute is a private BGP attribute. It is transmitted between BGP peers and is not restricted within an AS. The community attribute allows a group of BGP-enabled devices in multiple ASs to share the same routing policies. This allows routing policies to be flexibly used and makes it simple to maintain and manage routing policies.

ExtCommunity (This parameter is available only when Filtering type is set to Whitelist.)

Extended community filter.

Local Preference (This parameter is available only when Filtering type is set to Whitelist.)

Default local preference to be set for BGP routes.

AS Path (This parameter is available only when Filtering type is set to Whitelist.)

AS_Path value to be set for BGP routes in the network segment specified by IP Prefix.

The AS_Path attribute records the numbers of all ASs that a route passes through, from the source to the destination, in the vector order. You can configure the AS_Path attribute to implement flexible route selection.

Priority

Priority of a static route. The value is an integer from 1 to 255, and a smaller value indicates a higher priority.

If you specify the same priority for static routes with the same destination, load balancing can be implemented among these routes. If you specify different priorities for multiple static routes with the same destination, backup can be implemented among these routes.

Destination address/mask

Destination network segment and mask of the static route.

Next-Hop

Next-hop type

Type of the next hop in a static route.

• IP address
• black_hole: indicates that the packets destined for the destination network segment will be discarded. For example, it can be used to block packets destined for a particular Internet website.

IP address (This parameter needs to be set only when Next-hop type is set to IP address.)

Next-hop IP address of the static route.

Track (This parameter needs to be set only when Next-hop type is set to IP address.)

Whether to associate the static route with a network quality analysis (NQA) test instance.

Target

If a static route is associated with an NQA test instance, only ICMP test instances can be used to check whether there are reachable routes between the source and destination. This parameter specifies the destination address of an NQA test instance.

VLAN ID

This VLAN is used for Layer 2 communication between the site and the LAN network. The value cannot be the same as the VLAN ID of the WLAN or the VLAN ID of the interlink between dual gateways.

The system automatically creates VLANIF interfaces based on VLAN IDs. For a dual-gateway site, if the CPEs are directly connected to a Layer 2 switch in the downstream direction, to implement the VRRP function on the LAN side, the two CPEs must use the VLANIF interfaces with the same VLAN ID to communicate with the LAN side.

Physical interfaces

Type of the interface to be added and its number (for example, 0 or 0/0/0). Tag and Untag options are available.

• Tag: The interface allows packets with VLAN tags to pass through.
• Untag: The interface allows untagged packets to pass through and adds VLAN tags to the packets before forwarding them.

IP address

IP address to be set for the VLANIF interface.

Advanced Settings

MTU

MTU of the interface. This parameter cannot be configured for xDSL physical interfaces.

The size of data packets sent each time is limited at the network layer. When a network layer device receives an IP packet, it determines the outbound interface and obtains the MTU supported by the interface. The device then compares the IP packet length with the MTU. If the IP packet length is longer than the MTU, the device fragments the IP packet. Each fragment has a length less than or equal to the MTU.

• If the MTU is too small whereas the packet size is large, the packet is probably fragmented to many pieces. Therefore, the packet may be discarded due to the insufficient QoS queue length.
• If the MTU is too large, packets are transmitted slowly or even lost.

MSS

MSS of TCP packets on an interface. The MSS is an option defined in the TCP protocol and refers to the maximum length of TCP packets that can be received by a device. When setting up a TCP connection, the local and peer devices negotiate an MSS value. If the length of a TCP packet received from the peer device exceeds the negotiated MSS value, the packet is fragmented.

Local VTEP IP

Local VTEP IP address of the VXLAN tunnel. The options include Interface and IP.

Select Interface (needs to be set only when Local VTEP IP is set to Interface)

Select an existing Layer 3 interface.

IP (needs to be set only when Local VTEP IP is set to IP)

VTEP IP address on the local end

Peer VTEP IP

VTEP IP address on the peer end.

Interface

Interconnection interface type and number. In VLAN interconnection mode, set interconnection interface parameters. Currently, GE, FE, xGE, and Eth-Trunk interfaces are supported.

Interface Mode

Mode in which an interconnection interface works. An interconnection interface can work as a Layer 3 interface or a Layer 2 interface.

Physical Network

Select the RR source.

• Tenant RR: Select this option if a tenant requires site interconnection only on the WAN side and uses its own RR. The tenant RR is deployed at an edge site.
• MSP RR: Select this option if a tenant requires communication between the WAN network and legacy MPLS VPN network. The MSP RR is deployed at an independent RR site.

Y

Routing Domain

Routing Domain

A routing domain defines whether routes between different transport networks are reachable. Physical links of different transport networks that belong to the same routing domain are reachable to each other. Generally, if the transport networks that are of the same type and are provided by different carriers can communicate with each other, they are defined in the same routing domain. For example, the Internet of carrier A and that of carrier B can be defined in the same routing domain.

iMaster NCE-Campus provides the following types of routing domains by default:

• MPLS: MPLS leased line, which carries normal services of users in wired mode.
• Internet: public Internet, which carries normal services of users in wired mode.

If the default types of routing domains cannot meet requirements, set a routing domain according to actual situations.

Y

IPSec Encryption

Whether to enable IPsec encryption for the current routing domain. The options are as follows:

• OFF: indicates that IPsec encryption is disabled. In this case, enable protocol 47 of all devices on the firewall.
• ON: indicates that IPsec encryption is enabled. In this case, the encryption algorithm and password set in IPSec Encryption Parameters are used for encryption.
  NOTE:

  IPsec encryption must be enabled in the NAT traversal scenario.

Y

Transport Network

Type of the transport network to which a WAN-side physical link belongs. This parameter describes the transport networks with the same link quality attributes. It is used to identify networks of the same type provided by an ISP.

A transport network defines the physical network between a site and the WAN. The following lists the data to be planned for each transport network. The defined transport network name can be directly referenced when physical links are specified for site WAN links and policies.

• Transport Network: defines the type of a physical WAN link of a site and is determined by the type of a WAN access network provided by carriers. Generally, a type of network provided by a carrier is defined as a transport network. For example, the Internet of carrier A is defined as a transport network, and the Internet of carrier B is defined as another transport network.
• Routing Domain: specifies the routing domain to which the transport network belongs.
• Priority: specifies the priority of the transport network. It is used as a metric for tunnel coloring in intelligent traffic steering.

By default, the system provides the following transport networks: Internet, Internet1, MPLS, and MPLS1. The Internet transport networks belong to the Internet routing domain, and the MPLS transport networks belong to the MPLS routing domain. If the MSP RR is selected, the transport networks defined by the MSP are automatically displayed for selection. If the preset transport networks do not meet your requirements, you can create a transport network as needed.

-

IPSec Encryption Parameters

Protocol

Security protocol. The default value is ESP.

Y

Authentication algorithm

Authentication algorithm. Both SHA2-256 and SM3 are supported. SHA2-256 is used by default.

Y

Encryption algorithm

Encryption mode of a link. AES128, AES256, and SM4 are supported. When the authentication algorithm is set to SM3, the encryption algorithm can only be SM4.

If the authentication algorithm is set to SHA2-256, you are advised to select the AES-256 encryption algorithm. This is because the key length of AES-256 is 256 bits, having a higher security level than AES-128.

Y

Life time

Global IPsec SA lifetime.

A security association (SA) defines the encryption algorithm, digest, and keys for secure data transmission between IPsec peers. You can configure the IPsec SA lifetime to update the SA in real time. This reduces the risk of SA cracking and enhances security.

Y

IPSec SA generation mode

Whether to enable the IPsec SA generation mode. By default, the mode is disabled.

Y

DH group

Diffie-Hellman (DH) public key algorithm. It is used to dynamically negotiate encryption keys between two sites to prevent traffic monitoring between tenants in the same RR in multi-tenant scenarios.

After IPSec SA generation mode is toggled on, you can select a DH group. Currently, DH group can be set only to GROUP19, GROUP20, or GROUP21. The DH group security levels are as follows: GROUP21 > GROUP20 > GROUP19.

-

Device Activation Security Settings

Encryption

Whether to encrypt the URL for email-based deployment. You are advised to enable this function. This function must be enabled if email-based deployment needs to be used for deploying AR5700&6700&8000 series devices.

Y

URL encryption key

Key for encrypting the URL in a deployment email. Email-based deployment will be successful only after you click the URL in the received email on your PC and enter this key. After configuring the key, keep it secure to prevent email-based deployment from being affected.

Y

URL opening validity period

Validity period for a device to register its ESN with iMaster NCE-Campus. The timer starts once a deployment email is sent.

If the device ESN is not obtained, the device is added to iMaster NCE-Campus based on the device model. After a site is created and a deployment email is sent, the device checks whether the URL is valid. If so, the device registers its ESN with iMaster NCE-Campus.

Y

Web login

Whether the URL for email-based deployment carries web user information.

-

Username

Web username A username must contain at least six characters.

Y

Password

Password of the web user. The password must meet the following requirements:

• Must contain at least eight characters, and can contain digits, uppercase letters, lowercase letters, and special characters.
• Cannot be the same as the username or the reverse of the username.
• Cannot be the same as any of the most recent 10 passwords.

Y

Link Failure Detection Parameter Configuration

Modify detection parameters

Gateways at WAN sites of the same tenant periodically send Keepalive packets to detect link connectivity.

If this function is disabled, a device sends Keepalive packets at the default interval. If the number of detection failures exceeds the default value, the link is considered faulty. If this function is enabled, you can define the interval for sending Keepalive packets and the maximum number of detection failures permitted.

-

Detection packet sending interval

Interval at which the master device of an overlay tunnel sends Keepalive packets. The value ranges from 10 to 10000 ms for AR600&6100&6200&6300&SRG series and AR1000V devices and from 10 to 2000 ms for AR5700&6700&8000 series devices. The value must be an integer multiple of 10. The default interval is 1000 ms.

Y

Number of failed detections

After sending a Keepalive packet, the master device checks whether it receives a Keepalive packet from the slave device at intervals. If the master device does not receive Keepalive packets from the slave device for the consecutive number of times, the master device considers the overlay tunnel faulty and sets the overlay tunnel status to Down. Number of detection failures permitted before an AR automatically switches the link. The value ranges from 3 to 10.

If Modify detection parameters is disabled, the default value of this parameter is 6.

Y

Priority of detection packets

Priority in the IP header of a Keepalive packet. A numerically higher value indicates a higher priority.

Y

Traffic Steering Policy Configuration

Modify period parameters

Whether to customize parameters in intelligent traffic steering policies.

Exercise caution when you set the global parameters for traffic steering policies because they affect the real-time route selection of the intelligent traffic steering policy. You are advised to modify these parameters when no service traffic is transmitted.

-

Switching period

If the quality of a link cannot meet requirements of a certain service or the bandwidth usage exceeds the threshold, the CPE starts the link switching timer. When the timer times out, the service traffic is switched to another link. The default value of the switching period is 5 seconds.

Y

Statistics period

Interval for checking link quality. The value of this parameter ranges from 1 to 3600 and must be less than or equal to the value of Switching period.

-

Flapping suppression

Unstable network link quality may result in frequent link switchovers at the sites where an intelligent traffic steering policy is applied. To prevent this situation, the system requires that services be transmitted on a new link for at least one flapping suppression period before the services are switched back from the new link to the original link. The value range is from 2 to 131070, and the default value is 30 seconds. The value must be at least twice the switching period.

Y

Enhanced flapping suppression

After this function is enabled, service traffic is switched back only when the link quality meets the switchback requirements in every measurement period before the flapping suppression period ends. This reduces network flapping caused by frequent switchovers. This function is disabled by default. V300 series devices support this function since V300R022C00SPC100. V600 series devices do not support this function.

Assume that in the global traffic steering configuration, the flapping suppression period is set to 30s, and both the measurement period and switchover period are set to 5s. Take a site with an Internet link and an MPLS link as example. When the quality of the site's Internet link deteriorates and fails to meet requirements, service traffic is switched to the MPLS link. After the switchover, iMaster NCE-Campus calculates the Internet link's quality at an interval of 5s (measurement period) until the flapping suppression period ends.

With enhanced flapping suppression disabled, as long as the Internet link's quality calculated in the last measurement period meets requirements, service traffic is switched back to the Internet link.

With enhanced flapping suppression enabled, only if the Internet link's quality calculated in all the six measurement periods before the flapping suppression period ends meets requirements, service traffic is switched back to the Internet link.

-

Bandwidth usage detection

Whether to detect bandwidth utilization of links.

For AR5700&6700&8000 series devices, this function is enabled by default. Enabling or disabling this function does not take effect on these devices.

For AR600&6100&6200&6300&SRG series devices running V300R021C10 and later versions, Maximum bandwidth utilization (%) does not take effect after this function is disabled. AR600&6100&6200&6300&SRG series devices running a version earlier than V300R021C10 do not support this function.

This function takes effect when the Load balance mode is configured for intelligent traffic steering, and does not take effect in the Preference mode.

Y

Maximum bandwidth utilization (%)

This parameter applies to intelligent traffic steering in load balancing mode. When the service traffic of a link has occupied the maximum bandwidth, the traffic is steered in load balancing mode. You can set the maximum bandwidth usage as required. By default, the maximum bandwidth usage is 95%. The value ranges from 50% to 100%. V600 devices support this function since V600R22C00.

Y

Symmetric forward

To prevent link congestion in the inbound direction and ensure a single path for incoming and outgoing traffic, intelligent traffic steering supports symmetric routing. The service receiving site forwards services based on the route selection result of the sending site, without proactively selecting a route. Symmetric routing is enabled by default. Tenants can disable symmetric routing. After symmetric routing is disabled, devices at both ends select paths based on traffic steering rules.

This function determines whether the forward and return traffic is forwarded along the same path.

• Symmetric routing: A packet traverses from a source to a destination in one path and takes the same path when it returns to the source. The master or slave role of a site is determined based on the global network configuration on iMaster NCE-Campus. The slave site follows the route selection result of the master site to ensure that the same service flow is forwarded and returned along the same path.
• Asymmetric routing: Two communicating sites independently select a forwarding path. In this case, the transmit and receive paths of the same service flow between two sites are different. For example, in the load balancing scenario, the MPLS link in the direction from site1 to site2 is not congested for application A. As such, traffic of application A is forwarded over this MPLS link from site1 to site2. However, when the MPLS link is congested in the direction from site2 to site1 and the Internet link is not congested, the Internet link is selected to transmit traffic of application A from site2 to site1.
  NOTE:

  • When branch sites and IWGs are interconnected and branch sites are selected as the master for route selection, the symmetric routing function does not take effect.
  • Devices running V600 do not support symmetric routing.

Y

Same Transport Network prioritized

If two sites set up multiple tunnel connections, the tunnel connection with both ends in the same TN is colored as the active one whereas the tunnel connection with both ends in different TNs is colored as the standby one. Active tunnel connections are preferentially selected for intelligent traffic steering.

If Same Transport Network prioritized is toggled off, tunnel connections are selected for traffic steering as follows in the descending order of priority: active tunnel connection with a high priority > standby tunnel connection with a high priority > active tunnel connection with a low priority > standby tunnel connection with a low priority.

If Same Transport Network prioritized is toggled on, tunnel connections are selected for traffic steering as follows in the descending order of priority: active tunnel connection with a high priority > active tunnel connection with a low priority > standby tunnel connection with a high priority > standby tunnel connection with a low priority.

By default, Same Transport Network prioritized is toggled off. This function takes effect only in preferential occupation mode and does not take effect in load balancing mode.

Figure 2-9 shows an example. TN1 (blue-colored) has a higher priority than TN2 (red-colored) and the hub site determines tunnel colors. If Same Transport Network prioritized is toggled off, tunnel connections are selected for traffic steering as follows in the descending order of priority: blue-colored active tunnel connection > blue-colored standby tunnel connection > red-colored active tunnel connection > red-colored standby tunnel connection. If Same Transport Network prioritized is toggled on, the tunnel connections are selected for traffic steering as follows in the descending order of priority: blue-colored active tunnel connection > red-colored active tunnel connection > blue-colored standby tunnel connection > red-colored standby tunnel connection.

Figure 2-9 Tunnel connection coloring

-

Coloring rule

By default, tunnel connections are colored based on the following attributes in the descending order of priority: TNP bandwidth > site role > TN priority. You can modify the priorities by clicking .

Y

Smaller site ID prioritized

By default, this function is enabled, that is, the site with a smaller site ID colors tunnel connections for traffic steering.

When this function is disabled, the site with a larger site ID colors tunnel connections.

As shown in the following figure, the hub site has only one uplink and the spoke site has two uplinks, and the hub site determines tunnel connection colors by default. In this situation, the hub site colors the tunnel connections set up with the spoke site in the same color and thereby the tunnel connections have the same priority. As such, the spoke site cannot forward traffic of different applications through different links. To implement traffic steering in this scenario, you are advised to toggle off Smaller site ID prioritized to configure the spoke site to color tunnel connections, so that the tunnel connections can be colored differently.

Figure 2-10 Tunnel connection coloring by different sites

-

NTP

Time zone

Time zone of devices at a site. If DST is observed in the time zone, you can choose whether to apply DST rules to the time zone. You can select a DST rule in either of the following ways: Use the DST rule preset on the system for each time zone, or configure a DST rule by specifying the DST offset, start time, and end time.

Y

NTP client mode

• Manual Configuration: The current site functions as an NTP client and an NTP server needs to be manually specified. You can configure the RR as a client to synchronize its clock with the NTP server on the public network.
• Disabled: The current site does not function as an NTP client and does not perform clock synchronization.

Y

NTP server IP address

IP address of the NTP server.

Y

NTP authentication

This parameter is optional and indicates whether to enable NTP authentication when the gateway at a specified site functions as an NTP server. If NTP authentication is enabled, you need to set an authentication password and an authentication ID. If the gateway at a specified site functions as an NTP client, the authentication password and authentication ID must be the same as those at the parent site of the NTP server. Otherwise, the authentication fails and NTP clock synchronization fails.

Y

Authentication mode

Authentication mode, which can be MD5 or HMAC-SHA256. The authentication mode selected must be the same as that enabled on the NTP server. The MD5 authentication mode may pose potential security risks. As such, the HMAC-SHA256 authentication mode is recommended.

Y

Authentication password

Password used for NTP identity authentication.

Y

Authentication key ID

Key ID for NTP authentication, which must be a number other than 0. The authentication ID is irrelevant to the NTP server. The authentication ID used when the site functions as a client must be different from the authentication ID configured for the NTP server.

Y

Virtual Network

Routing

AS number

Local AS number. Sites that are deployed by the same tenant account on iMaster NCE-Campus belong to the same AS.

The default value is 65001. You do not need to change the value in most cases. If you need to change the AS number in BGP, for example, if the new AS number conflicts with the AS number planned for an existing device on the network, do not use the default AS number.

Y

Routing protocol

Only BGP is supported.

Y

Community pool

This is a resource management pool. You can configure community pool to assign the community attribute values to services.

Currently, the community pool is mainly used in the following configurations: IBGP on the WAN, RR management, Internet access, mutual access, and area management. When the community pool is insufficient, a maximum of 10 community attribute pools can be added. After the configuration, the community pool that has been used cannot be updated or deleted. Unused community pools can be deleted.

When the RR source is set to MSP RR, all community attributes are allocated from the community attribute pool configured by the MSP.

Y

IPv4 Dual-Gateway Interconnection Protocol

Protocol used to connect dual gateways. In the dual-gateway scenario, you can configure a routing protocol (OSPF or IBGP) for exchanging routing information between the two gateways. iMaster NCE-Campus automatically orchestrates route configurations based on the selected routing protocol and delivers the configurations to CPEs.

Figure 2-11 Dual-gateway networking

Y

Routing policy delay configuration

Whether to make routing policies take effect after a specified delay. Devices running V300R021C10 and later versions support this function. AR5700&6700&8000 series devices do not support this function.

A network often has multiple cooperative routing policies. By default, the change of a single routing policy takes effect immediately. However, the overall routing policy modification is not completed. In this situation, route flapping occurs, which results in network instability. To prevent this problem, you can configure a delay for a modified routing policy to take effect.

Y

Routing policy delay

Delay after which routing policies take effect. The value ranges from 1 to 180, in seconds.

Y

IP Pool

IPv4 pool

When iMaster NCE-Campus automatically orchestrates services such as overlay tunnels, overlay WAN routes, and site Internet access, IP addresses need to be allocated. Plan address pools based on the network scale. The number of required addresses increases with the number of sites. For details about the relationship between them, click Details.

The addresses to be configured include tunnel interface addresses, interworking tunnel addresses, CPE addresses, and interface addresses of an interlink between dual gateways.

After you set reserved IP addresses, iMaster NCE-Campus automatically assigns an IP address according to the following rules:

One or more IP address pools can be configured and the IP addresses in these address pools are automatically divided into multiple address segments, which are used by the following interfaces:

• Loopback interfaces of CPEs
• Interfaces of interworking tunnels
• Interfaces of interlinks
• EVPN tunnel interfaces

You can select Simple mode or Advanced mode for an address pool. If Simple mode is selected, all addresses are assigned from the same address pool. If Advanced mode is selected, addresses can be assigned from IP pool, Interworking Tunnel, and Interlink.

For a network as shown in the following figure, in advanced mode, IP addresses in IP pool are assigned to loopback interfaces and EVPN tunnel interfaces on CPEs; IP addresses in Interworking Tunnel are assigned to interfaces at both ends of a tunnel connecting underlay and overlay domains on a single device; IP addresses in Interlink are assigned to interfaces at both ends of an interlink connecting dual gateways.

Determine the mask length of an address pool based on the site quantity. The mask length determines the number of addresses in the address pool.

Y

IPv6 pool

IPv6 address pool. If IPv6 is required on CPEs, interworking tunnels, and interlinks, you need to configure an IPv6 address pool.

• Interworking address pool: allocates unique IPv6 addresses to interfaces of interworking tunnels. Addresses in this pool must be located on the IPv6 address segment with the prefix of FD00::/8.
• Interlink address pool: allocates IPv6 addresses to interfaces of interlinks connecting dual gateways. Addresses in this pool must be located on the IPv6 address segment with the prefix of FD00::/8.
• Link-local address pool: allocates link-local addresses to CPEs. Addresses in this pool must be located on the IPv6 address segment with the prefix of FE80::/10. After an interface obtains a link-local address, it can implement neighbor discovery and automatically configure a global unicast address or a unique local address.

The prefix of IP addresses in the interworking and interlink address pools must be FD00::/8, and the prefix of IP address in the link-local address pool must be FE80::/10.

Y

DNS

DNS Server Group Name

Domain Name System (DNS) used for domain name resolution. The DNS server is usually deployed on a public network. A maximum of 16 DNS groups can be configured for a tenant. A maximum of six DNS server IP addresses can be configured in each group.

Y

DNS Server IP Address

You can plan multiple DNS server IP addresses. A DNS server IP address is used when a LAN interface is configured. If a CPE is enabled as the DHCP server, you can select a DNS server group name for the CPE. The DNS server address is sent to a client on the LAN side via a DHCP response.

Y

Custom Port Configuration

DTLS Server Port

Listening port for a DTLS server.

A CPE registers with an RR through DTLS. An RR establishes a DTLS connection with a CPE to set up a control channel for TNP information exchange between them. When an RR goes online, iMaster NCE-Campus delivers the command for configuring the port checked by the DTLS server to the RR. As such, the RR can set up control channels with CPEs.

By default, the port checked by the DTLS server is 55100. You can modify this setting as needed.

Y

STUN Server Port

In most cases, an RR is configured as a STUN server and the CPE functioning as a branch gateway is configured as a STUN client. To detect whether a NAT device is deployed between the RR and CPE, enable the STUN server function on the RR and configure the IP address and UDP port number listened by the STUN server.

By default, the port checked by the STUN server is 3478. You can modify this setting as needed.

Y

Connection Source Port

After this item is toggled on, you can specify the scanning start port, scanning times, and scanning increment for NAT detection, hole punching, and Keepalive (KA) packets.

Y

Collection Configuration

Application traffic

Whether to enable global traffic statistics collection. After this function is enabled, inter-site traffic and inter-site application traffic at all sites are collected.

-

Application quality

Whether to enable application quality statistics collection. After this function is enabled, AQM distribution statistics of all applications are collected and worst 5 applications by AQM are listed.

-

WAN link traffic

Whether to enable inter-site traffic monitoring. After this function is enabled, traffic passing all inter-site links is monitored in real time.

-

2-10

/23

11-30

/22

31-60

/21

61-120

/20

121-250

/19

251-500

/18

501-1000

/17

1000+

/16