H3C WX2580X-LI New Generation Enterprise Core Multi Service Wireless Controller
H3C WX2580X-LI is a gateway type wireless controller (AC, Access Controller) developed by H3C Technology Co., Ltd. (hereinafter referred to as H3C) based on the Comware platform. The WX2580X-LI wireless controller has a wide range of service types, integrating fine user control management, comprehensive RF resource management, 7X24 hour wireless security control, second and third layer fast roaming, flexible QoS control, IPv4&IPv6 dual stack and other functions, providing powerful integrated wired and wireless access capabilities.
The H3C WX2580X-LI wireless controller is specifically designed for deployment in branch offices and small campus wireless networks. Integrating gateway and AC functions reduces the types and quantities of equipment purchased by enterprises in networking, thereby reducing investment. In conjunction with the H3C Fit AP product series, it supports functions such as WIPS and firewall. At the same time, it has a rich variety of port types, especially with a built-in USB interface, which can connect to enterprise related peripherals.
*The H3C WX2580X-LI wireless controller, combined with the H3C Fit AP product series, can meet typical wireless applications such as WLAN access in small business parks and hotspot coverage in branch offices.
Product Features
Provide management for 802.11ax APs
The WX2580X-LI wireless controller not only supports the management of traditional 802.11a/b/g/n/ac APs, but also can cooperate with H3C APs based on the 802.11ax protocol to network, breaking through the traditional wireless network serial communication mechanism, promoting the doubling of wireless spectrum resource utilization, greatly increasing the number of effective access users, effectively reducing the deployment cost of wireless networks, and greatly improving the user experience in high-density user environments.
Provide flexible data forwarding methods
Traditional wireless controller deployment generally adopts a centralized forwarding mode, where AC can comprehensively control and securely supervise messages. However, all wireless business traffic needs to be processed uniformly by AC, and the core link bandwidth and AC forwarding capability can easily become bottlenecks. Especially when AP and AC are connected through a wide area network, AP is deployed as a data access device in branch offices, while AC is deployed at headquarters. All user data is sent from AP to AC, and then forwarded centrally by AC, resulting in low forwarding efficiency. The WX2500X series wireless controller can support centralized forwarding, distributed forwarding, and policy forwarding. Users can flexibly set forwarding methods according to business needs and network conditions.
The WX2580X-LI wireless controller supports centralized authentication and local forwarding networking, providing centralized authentication and management of 802.1X and Portal in the case of local forwarding of data streams.
Wireless 4i technology system
In the process of enterprise wireless network construction and operation, "network optimization" is an indispensable part. Effective network optimization can not only ensure the effectiveness and ultimate experience of user use, but also increase the number of device access users, extend the service life of devices, and protect customers' existing investments to a certain extent, maximizing the value of wireless network usage. In the context of this technological trend, H3C focuses on improving its "experience optimization" capabilities and independently develops technologies related to iRadio, VNet, iEdge, and iReal. It deeply optimizes wireless networks in various aspects such as air interface performance, roaming access, application security, and network automation, bringing great improvements to user experience.
IRadio: Intelligent RF Management
Due to the openness of Wi Fi frequency bands and the priority of spectrum resources, wireless signals are highly susceptible to various interferences. In the same wireless environment, different terminals, locations, and times may result in different user experiences. IRadio technology achieves intelligent scheduling of RF resources through the following technologies, reducing wireless signal interference, improving air interface performance, reducing packet loss and latency, improving user experience, and enhancing overall network performance.
1) Automatic optimization of RF resources
This technology automatically and intelligently adjusts the channel, power, and bandwidth modes based on changes in the wireless environment, ensuring that wireless signal coverage is always at the optimal level, effectively reducing interference, and eliminating the need for maintenance personnel to manually configure the entire process, achieving comprehensive automation and intelligent RF resource optimization.
2) Time Fairness Technology
Wi Fi wireless transmission is a shared channel and shared bandwidth mode. Therefore, in multi-user scenarios, although traditional rate fairness methods can curb the situation where high traffic terminals monopolize wireless resources, they are powerless against other problems such as weak capacity terminals occupying air interface resources for a long time. IRadio's time fairness technology allocates the same length of time window for each terminal to send messages, preventing individual terminals from randomly occupying wireless resources, ensuring that all terminals have a good experience, and improving the utilization of wireless spectrum resources.
3) Broadcast multicast optimization
The difference in transmission rate between unicast, broadcast, and multicast messages has been increasing with the improvement of Wi Fi standards. Broadcast and multicast messages transmitted at lower rates have seriously affected the efficiency of wireless transmission. IRadio Broadcast Multicast Optimization Technology accurately identifies broadcast and multicast messages, executes different strategies in different usage scenarios, minimizes the impact of broadcast and multicast messages, and significantly improves wireless air interface performance. At the same time, in appropriate scenarios, it will also increase the sending rate of broadcast and multicast messages.
4) Low latency guarantee
In the post pandemic era, enterprises are catalyzed to improve management and operational efficiency through cloud collaboration, and cloud office, remote meetings, and video live streaming have become the norm for enterprise office work. Unlike traditional wireless office requirements that only meet coverage and low traffic, these low latency business scenarios pose higher demands on wireless networks. Low latency guarantee technology can effectively identify this type of business and ensure faster transmission speed, effectively reduce air interface latency, and ensure the normal operation of real-time business through comprehensive control methods such as increasing priority, calculating better message transmission rates, and more reasonable frame lengths.
IStation: Intelligent Terminal Management
During the use of Wi Fi, the interaction between the device and the terminal is bidirectional. iRadio optimizes RF resources, air interface efficiency, and other aspects through intelligent intervention on the wireless network device side (AC or AP) to enhance user experience, while iStation improves access, roaming, traffic stability, and other effects through intelligent management of the terminal.
1) Zhiyou Access
Terminal access to wireless networks is divided into three stages: "scanning probe association". Optimal access adopts unique optimization strategies in each stage to form a complete and effective solution, ensuring that each wireless terminal is associated with its surrounding reasonable RF at once.
2) Quick Roaming
The WLAN protocol does not provide a mechanism for terminal roaming, but rather allows the terminal to decide when to roam. In practical applications, there are significant differences in roaming mechanisms among different terminals, and roaming stickiness or frequent roaming can lead to poor user experience during movement. IStation's fast roaming technology classifies and manages terminals based on tags, and then customizes the roaming mechanism according to different tags, making terminal roaming faster, smoother, and better.
3) To ensure high security
Compared to traditional business priority strategies, VIP protection technology divides users into multiple levels,
IEdge: intelligent edge computing
IEdge technology endows W-Fi 6 AP with edge service perception capabilities, and achieves the ultimate seamless experience of network and terminal perception through service identification, optimal forwarding, and routing.
1) Edge security protection
Unlike traditional vendors who implement security policies in AC or firewalls located at the network center, H3C applies a comprehensive security protection scheme of 2-7 layers to Wi Fi 6 APs. Performing security analysis and policies on the AP at the edge of the network not only responds quickly, but also advances security protection to the air interface level, directly isolating threats outside the wireless network.
2) Edge application acceleration
Edge acceleration technology can intelligently identify users' applications and save snapshots of the identified applications. Users' subsequent messages will be compared with the snapshots, and combined with intelligent sorting technology, the identified application messages can be processed at high speed. Traditional DPI performance is low, and DFI identification of applications is inaccurate. Based on this technology, APs can also perform targeted optimization during roaming and other processes to ensure that users always maintain a smooth experience when using critical services. At the same time, when APs discover that the air interface occupancy rate is too high, they will also have strategies to suppress non critical service traffic, achieving the effect of bidirectional acceleration for applications.
3) Edge history retrospective
Access, authentication, DHCP interaction, ARP interaction, and DNS resolution are the foundation of terminal deployment, and these steps are also processes that are likely to cause problems and are extremely difficult to reproduce. Based on H3C Wi Fi AP's key protocol snapshot technology, the terminal access, authentication, DHCP interaction, ARP interaction, and DNS resolution processes are all restored, accurately recording each critical time and providing support for judging the terminal usage experience and the device status of the entire network.
ISeal: Intelligent Network and Intelligent Healing
H3C iSeal technology assists users in achieving more efficient, seamless, fully automated, and intelligent wireless network optimization through the coordination of three major functions: automatic problem discovery, automatic resolution, and gradual optimization of the entire network, comprehensively enhancing the wireless user experience.
1) Automatic problem discovery
ISeal technology introduces Telemetry technology to assist in enriching operation and maintenance data, enabling identification of hundreds of problems and root cause analysis of terminal launch failures, automatic closure of multiple types of problems, and enabling users to proactively detect problems before reporting them, achieving intelligent and proactive operation and maintenance.
2) Automatic problem-solving
After automatically identifying the problem, iSeal technology will further analyze and locate the root cause of the problem, and confirm the cause of the problem. After identifying the root cause of the problem, iSeal will automatically select suitable processing strategies from the expert strategy library for distribution, monitor the problem situation in real time, dynamically adjust the strategy parameters, and ultimately achieve a closed-loop problem solving process. This truly achieves a fully automatic closed-loop operation and maintenance without human intervention, and a truly intelligent operation and maintenance without human intervention, greatly improving operation and maintenance efficiency and productivity.
3) Progressive optimization of the entire network
Wireless network is a dynamically changing network, and iHealth's incremental optimization technology enables the network to adapt to changes in a timely manner, continuously self optimize, and remain in a high-performance, low interference state at all times, thereby fundamentally reducing the frequency of problems and evolving towards true high experience, zero operation and maintenance.
Support operation level wireless user access control and management
User based access control is a major feature of the WX2580X-LI wireless controller product, and the User Profile provides a configuration template that can save preset configurations (a collection of configurations). Users can configure different content for their User Profile based on different application scenarios, such as CAR (Committed Access Rate) policies and QoS (Quality of Service) policies.
When users access devices, they need to perform identity authentication first. During the authentication process, the authentication server will issue the User Profile name to the device, and the device will immediately enable the specific content configured in the User Profile. When a user accesses the device through authentication, the device will restrict the user's access behavior based on these specific contents. When a user goes offline, the system will automatically disable the configuration items under the User Profile, thereby removing the restrictions on the user under the User Profile. Therefore, User Profile is applicable to restrict the access behavior of online users. When no user is online (which may be due to no user accessing, user not being authenticated, or user being offline), User Profile is a preset configuration and does not take effect.
In addition, the WX2580X-LI wireless controller also supports MAC based authentication access control, which not only allows customers to configure and modify user groups' permissions on AAA servers, but also supports the configuration of specific user permissions. This refined user permission control greatly enhances the availability of wireless networks, and network administrators can easily allocate access permissions to people of different levels or groups through this method.
MAC based VLAN is also a major feature of the WX2580X-LI wireless controller. In terms of control strategy, administrators can assign users with the same nature (MAC) to the same VLAN, and configure security policies based on VLAN on the controller. This simplifies system configuration and achieves fine-grained management at the user level.
For security or billing considerations, system administrators may wish to control the location of wireless users accessing the network. The WX2580X-LI wireless controller supports user access control based on AP location. When wireless users access the network, the authentication server can issue a list of APs that allow users to access to the AC, and access control can be performed on the AC to limit wireless users to only access APs at designated locations.
Provide reliable gateway functionality
WX2580X-LI is positioned as a gateway for small and medium-sized enterprises and branch offices, integrating both gateway and AC functions. The dual WAN port design provides the basic conditions for uplink backup. Meanwhile, compared to the previous generation product, the WAN port adopts a 2.5G multi rate interface, greatly improving the uplink efficiency. The WX2580X-LI supports gateway general functions such as PPPOE, NAT gateway, dynamic IP address, and static IP address settings.
Support Bonjour Gateway
The WX2580X-LI wireless controller supports Bonjour Gateway functionality, making it easy for small businesses to use Apple devices such as printers, televisions, and tablets internally.
Support 7-layer mobile security detection/defense (WIDS/WIPS)
The WX2580X-LI wireless controller supports mobile security defense modes such as blacklist, whitelist, Rogue defense, abnormal message detection, illegal user offline, and signature MAC layer attack detection and countermeasures based on preset upgrades (such as DoS attacks, Flood attacks, man in the middle attacks). Combined with the massive intelligent expert knowledge base built into the wireless application console, flexible wireless security policy judgment criteria can be obtained. For clear illegal attack sources (APs or terminals, etc.), visual physical location tracking and monitoring can be achieved, as well as physical port removal of switches.
By cooperating with H3C professional core layer firewall/IPS devices, it is possible to achieve a 7-layer three-dimensional security defense for mobile parks, meeting the true end-to-end security protection requirements from wireless (802.11) to wired (802.3).
Support RealTime Spectrum Guard mode
RealTime Spectrum Guard (RTSG) is a professional monitoring solution proposed by H3C for wireless environment spectrum status. The entire series of wireless controllers can be integrated with Sensor APs with built-in RF acquisition modules to achieve deep RF monitoring and real-time spectrum protection.
The RTSG console is integrated and deployed in the H3C iMC intelligent management center. It communicates and collects data with Sensor AP through CAPWAP management tunnel, achieving 7X24 hour wireless environment quality monitoring, wireless network capability trend evaluation, and unauthorized interference alarm. Through graphical representation, actively detect and identify all RF interference sources (Wi Fi or non Wi Fi) in the 2.4GHz/5GHz bands, providing real-time FFT maps, spectral density maps, spectral maps, duty cycle maps, event spectral maps, channel power, interference power, etc; Automatically identify interference sources, determine the location of problematic wireless devices, and ensure optimal performance of the wireless network. By combining H3C iAR intelligent reporting components, it is possible to store, trace, and replay RF quality history records throughout the entire coverage area, and automatically generate customized trend, compliance, and audit reports.
The deployment of RTSG solutions can flexibly adopt Local mode or Monitor mode to meet the different levels of user wireless environment supervision requirements. When working in Local Mode, normal user access and packet forwarding can be maintained while obtaining effective spectrum protection.
Built in RF Optimization Engine (ROE)
The WX2580X-LI wireless controller has a built-in RF Optimization Engine for APs, which effectively enhances the application acceleration capability and quality assurance effect in high-density access, streaming media transmission and other scenarios in wireless deployment through feature and protocol based RF optimization. This includes multi-user fair scheduling, mixed access fairness, interference filtering, rate optimization, spectrum navigation, multicast enhancement (IPv4/IPv6), packet by packet power control, and intelligent bandwidth guarantee.
Support 802.1x authentication, MAC address authentication, Portal authentication, etc
The WX2580X-LI wireless controller supports multiple authentication methods:
802.1x authentication: The WX2580X-LI wireless controller supports multiple 802.1x authentication methods such as TLS, PEAP, TTLS, MD5, SIM card, etc. It also supports local 802.1x authentication methods, providing support for mainstream authentication methods such as MD5, TLS, and PEAP. Users no longer need to configure additional AAA servers. The WX2580X-LI wireless controller also supports dynamic authorization of VLAN and ACL functions after 802.1x authentication. User policies can be pre-set, and the system automatically configures customer permissions during user authentication.
MAC Address Authentication: The WX2580X-LI wireless controller supports MAC address authentication, which is not convenient for some handheld terminals (such as Wi Fi Phone, handheld mobile terminals, etc.) to use on a computer. However, MAC address authentication can easily solve this problem by configuring valid MAC addresses on the controller or AAA server. The terminals corresponding to these MAC addresses can be allowed to access the network, while unauthorized terminals that have not been configured in advance cannot access the wireless network. This function greatly facilitates applications such as wireless medical systems. MAC address authentication can ensure that only PDA working terminals in hospitals can access the wireless network, while rejecting patients' wireless PDAs from using dedicated wireless networks.
Portal authentication: The WX2580X-LI wireless controller provides a built-in Portal authentication server. This authentication method does not require the cooperation of the client, and directly uses the web portal page of the browser as the authentication channel. After the user passes the authentication, they can flexibly jump to the designated access homepage and initiate corresponding authorization and billing. At the same time, customized Portal pages can be flexibly pushed according to strategic requirements to achieve advertising promotion and information transmission, widely used in application scenarios such as wireless campuses, wireless cities, and visitor access.
Supports IPv4/IPv6 dual stack (Native IPv6)
The WX2580X-LI wireless controller supports IPV6 access for wireless customers. At the starting point of the tunnel AP, due to the device's awareness of IPv6, it is possible to achieve mapping from IPv6 priority to tunnel priority; On the AC side, complex control and filtering such as ACL filtering can also be applied to IPv6 packets.
The WX2580X-LI wireless controller can also be deployed in IPv6 networks, automatically negotiating an IPv6 tunnel between AC and AP. When AC and AP are fully operating in IPv6 state, the wireless controller can still correctly perceive IPv4 and process IPv4 packets from wireless clients. The WX2580X-LI wireless controller has flexible adaptability to IPv4/6, which can meet various complex applications of customers in IPv4 to IPv6 network migration. It can provide IPv4 services to customers in IPv6 islands, and also allow users to easily log in to the network through the IPv6 protocol in IPv4 islands.
The WX2580X-LI wireless controller supports IPv6 SAVI (Source Address Validation) technology to address the rampant IPv6 packet forgery attacks on campus networks. By listening to the address allocation protocol to obtain the user's IP address, it ensures that subsequent applications can use the correct address to access the internet and cannot forge other people's IP addresses, ensuring the reliability of the source address. At the same time, the combination of IPv6 SAVI and Portal technology further ensures the authenticity and security of all online user packets.
Provide end-to-end QoS
The WX2580X-LI wireless controller is developed on the Comware platform, which not only fully supports the Diff Serv standard, but also adds QoS support for the IPv6 protocol.
The QoS Diff Serv model mainly includes flow classification, traffic policing, queue management, queue scheduling, etc. It fully implements the six groups of PHB and services defined in the standard, including EF, AF1~AF4, BE, etc., enabling network operators to provide users with service guarantees of different service quality levels, making the Internet truly a comprehensive network that simultaneously carries data, voice, and video services.
Support fast second and third layer roaming
H3C's centralized wireless architecture not only facilitates layer 2 roaming, but also greatly facilitates cross layer roaming. WLAN networks deployed with Fat APs have limited information transmission between APs, making it difficult to implement layer 3 roaming. The centralized architecture is very easy to solve the problem of cross layer roaming. The WX2500X wireless controller supports layer 2 and layer 3 roaming, and the roaming domain is not limited by subnets. This excellent roaming feature allows customers to plan their wireless network without worrying too much about the existing network, focusing more on wireless signal coverage. This greatly simplifies the early network planning and reduces network planning costs.
In traditional mode, when wireless user terminals use 802.1x as a means of 802.11 access authentication and key exchange, there will be a lot of interaction messages between the wireless user terminal and the AP. When a wireless user terminal roams between two APs, if the wireless user terminal fully follows the complete 802.1x interaction process during the new AP access, it will inevitably cause a long roaming switching time. For some services that are sensitive to roaming switching time (such as voice services), such long switching time is unbearable. The WX2500X wireless controller uses Key caching technology to achieve fast switching of users during roaming. Key caching technology strikes a good balance between secure access and fast roaming for users, allowing wireless user terminals to roam between two APs without the need for a complete 802.1x authentication interaction process, while ensuring user identity recognition and continuity of key usage; Wireless users adopt fast roaming mode, with a roaming time of no more than 50ms within a single AC, meeting the demanding requirements of voice services.