introduction - comten

Introduction

The Quidway® NetEngine 20 series multi-service router (abbreviated as NE20) is among Huawei's 5th generation routers

and adopts centralized forwarding design. The NE20 router can be deployed at the edge of carriers' IP networks, or at the

core and the convergence layers of various business and enterprise networks. The NE20 series router includes three

models: NE20-8, NE20-4 and NE20-2, and all of them adopt modular architecture, providing many kinds of optional

multifunctional interface modules such as High-speed Interface Card (HIC) and Flexible Interface Card (FIC). All the

interface modules and key modules of the NE20 router support hot swap, so that it has carrier-class availability, wire-

speed forwarding performance, and feature-rich services (QoS, VPN, MPLS, traffic engineering, multicast, etc.) process-

ing capability. In practical networking applications, the NE20 router can provide all-around service processing and flexible

network solutions, which effectively guarantee the value added service for the network and save costs during constructing

networks.

HU

AW

EI

TE

CH

NO

LO

GI

ES

1

Q u i d w a y ® N e t E n g i n e 2 0M u l t i - S e r v i c e R o u t e r s

Figure 1-1 NE20-8 Figure 1-2 NE20-4 Figure 1-3 NE20-2

2

Product Features

High Forwarding Performance

As a member of Huawei's 5th generation router family, the NE20 adopted Network Processor (NP) technology, taking

advantages of both ASIC and CPU. So it features hardware-based high performance (4.5 Mpps) and software-based high

flexibility. The NE20 router can support fast packet-forwarding on all kinds of interfaces, including the packet with QoS

and security information.

Supporting IPv4 and IPv6 Protocol Stacks

The NE20 supports IPv4 and IPv6 protocol stacks.

The NE20 also supports IPv4-to-IPv6 transition technologies such as manually configured tunnel, automatically config-

ured tunnel, 6to4 tunnel, Network Address Translation-Protocol Translation (NAT-PT), and IPv6 Provider Edge (6PE).

Flexible Network Interconnection

Provides high forwarding capability, abundant access methods and service features, and can be placed on convergence

layers of national IP networks or Metropolitan Area Networks (MANs), or can act as the core device of enterprise

networks.

Supports Wide Area Network (WAN) protocols such as Ethernet, PPP/MP, PPPoE, ATM, Frame Relay, X.25, HDLC and

LAPB.

Supports many unicast dynamic routing protocols such as RIP, OSPF, BGP/MBGP and IS-IS as well as powerful routing

policy and policy routing mechanism.

Provides high multicast routing capability, completely supports multicast routing protocols such as Internet Group Man-

agement Protocol (IGMP), Protocol-Independent Multicast Sparse Mode/Dense Mode (PIM-SM/PIM-DM), Multicast Source

Discovery Protocol (MSDP) and Multi-protocol Extensions for BGP-4 (MBGP)

Abundant Service

Supports L2TP-based layer 2 tunnel and GRE-based layer 3 tunnel, provides a complete suit of network security schemes,

such as access control, connectionless integrality and data source authentication, encryption as well as traffic classification,

combined with IPSec technologies;

Provides powerful MPLS VPN functions, such as L2/L3 MPLS VPN, traditional L2 VPN, transparently transmitting L2

data of users on MPLS networks, and PE hierarchical architecture (Hierarchy of PE, HoPE);

Supports standard Differentiated Service (Diff-Serv) consisting of complex traffic classification, Traffic Policing (TP),

Traffic Shaping (TS), congestion management (PQ/CQ/WFQ/CBQ) and congestion avoidance (WRED), accurately as-

HU

AW

EI

TE

CH

NO

LO

GI

ES

sures the bandwidth and delay for various services. supports advanced congestion control algorithms such as SARED,

Provides authentication, authorization and accounting (AAA) such as RADIUS and HWTACACS, supports data trans-

mission using plain-text and Message-Digest Algorithm 5 (MD5) methods. Supports packet filtering (interface-based

ACL and ACL based on time range);

Supports NAT.

Carrier-class Reliability

Adopts dual-power redundancy (1+1 backup) module, supports AC-input or DC-input power supplies as well as hot

swap. All service interface cards as well as the fan support hot swap. The fan can automatically adjust its speed accord-

ing to the environment condition;

Provides Backup Center function and Virtual Router Redundancy Protocol (VRRP) technologies to assure unblocked

data communication by providing a backup scheme in the event of faults occurring to communication lines or devices,

effectively enhancing the network robustness and reliability. The Backup Center supports the backup load balancing

function;

Convenient Maintenance Management

Supports local or remote maintenance via Console port, AUX dial-in and Telnet as well as Secure Shell (SSH), prevent-

ing attacks such as IP spoofing and plain-text password intercept

Supports SNMP (V1/V2c/V3) and Client/Server architecture, and can be managed by Network Management System --

iManager N2000;

Supports the automatic fault diagnosis function, which assists the maintenance engineer in locating the system-level

fault quickly and accurately via the fault diagnosis software running on the PC computer;

3

Software Specifications

Performance Packet forwarding rate: 4.5Mpps

Layer 2 Protocol Ethernet, PPP/MP, PPPoE, ATM, Frame Relay, X.25, HDLC and LAPB

IPv4 Routing Protocol Unicast: static routing, RIP, OSPF, IS-IS and BGP4

Upgradeable for IPv6 protocol suite

IPv6 Routing Protocol Support for IPv4 and IPv6 dual stacks

Support for basic transition technologies from IPv4 to IPv6: manually configuration tunnels,

automatic configuration tunnels, 6to4 tunnels, NAT-PT (based on hardware), etc

Support for IPv6 static routing and dynamic routing protocols such as BGP4+, RIPng ,

OSPFv3 and ISISv6

Support for ICMPv6 MIB, UDP6 MIB, TCP6 MIB, IPv6 MIB, etc

Multicast Internet Group Management Protocol (IGMP)

Protocol Independent Multicast-Dense Mode (PIM-DM)

Protocol Independent Multicast-Sparse Mode (PIM-SM)

Multi-protocol Border Gateway Protocol (MBGP)

MPLS VPN Support for MPLS L2 VPN (Martini, Kompella)

Support for MPLS L3 VPN

Support for MPLS TE

Support for Hierarchy of PE (HoPE)

Support for MPLS QoS

Support for L2TP VPN (serve as LAC and LNS)

Support for GRE VPN

QoS Features Support for simple traffic classification

Support for classification of complex traffic composed of L2, L3 and L4 packet information

Support for CAR, shaping based on EF and AF services of Diff-Serv

Support for LLS, NLS, PQ, CQ, WFQ, CBQ and PBS

Support for RED, WRED and SARED

Support for route redirection and LSP explicit route assignment of MPLS

Specifications

4

Security & Authentication Support for AAA, RADIUS and HWTACACS protocol

Support for AAA domain

Support for local user management, local accounting

Support for packet filtering (interface-based ACL and ACL based on time range)

Support for firewall (packet filtering firewall)

Support for users in LAN to access external networks by using IP addresses in address

group

Support for associating ACL with address group

Support for associating ACL with interface

Support for hosts on external networks to access servers on internal networks

Support for configuring valid period for address translation

Support for NAT and many ALGs

Support for terminal access security

Support for IPSec

Support for IKE

Support for multi-dimensional traffic statistics

Network Management Support for the inter-operation with Huawei's IPTN (IP Telecom Network) operation

framework

Support for the inter-operation with Huawei's carrier-class MPLS VPN Management

System

Support for SNMP V1,V2 and V3 and RMON

Support for SSH

Maintenance Support for automatic fault diagnosis function

Support for remote configuration and maintenance via AUX

Reliability Support for Backup Center and VRRP

Support for power redundancy

Support for hot swap of power, fan and service interface module, as well as automatic

adjustment of fan speed

HU

AW

EI

TE

CH

NO

LO

GI

ES

5

1.3.2 Hardware Specifications

Description NE20-8 NE20-4 NE20-2

Processor PowerPC750FX 733MHz

Boot ROM 512KB

SDRAM 256MB/512MB

Flash 32MB

Service slots 8 4 2

maximum HIC: 3 maximum HIC: 3 maximum HIC: 2

maximum FIC: 8 maximum FIC: 4 maximum FIC: 2

Fixed ports 2 10/100M Ethernet ports 2 10/100M Ethernet ports 2 10/100M Ethernet ports

1 AUX port 1 AUX port 1 AUX port

1 Console port 1 Console port 1 Console port

Backplane capacity 8G (2G PCI shared bus, 6G distributed switch bus)

Forwarding capability 4.5Mpps

Dimensions (mm) 436.2x420x219.5 436.2x420x130.5 436.2x420x130.5

(W X H X D)

Weight 28Kg 18.7Kg 18kg

Power Rated voltage range: 100-240V AC; 50/60Hz

Maximum voltage range: 90-264V DC; 50/60Hz

Rated voltage range: -48- -60V DC.

Maximum voltage range: -36- -72V DC.

Operating Temperature 00C to 450C

Humidity 10% - 90%, no condensing

6

HU

AW

EI

TE

CH

NO

LO

GI

ES

ModulesThe NE20 router supports the following multifunctional interface modules.

I. FIC interface module 2-port 10/100Base-TX Ethernet electrical interface module (2FE)

1-port 100Base-FX Ethernet multi-mode optical interface module (1MFX)

1-port 100Base-FX Ethernet single-mode optical interface module (1SFX)

4-port Multi-protocol enhanced synchronous serial interface module (4SAE)

4-port channelized E1 module (4CE1)



4-port channelized T1 module (4CT1)



4-port non-channelized E1 module (4E1-F)

8-port non-channelized E1 module (8E1-F)

1-port ATM 155M multi-mode optical interface module (ATM-OC3MM)

1-port ATM 155M single-mode optical interface module (ATM-OC3SM)

1-port ATM 155M single-mode long-distance optical interface module (ATM-OC3SML)

4/8-port ATM over E1 module (AE1)

4/8-port ATM over T1 module (AT1)

1-port ATM over E3 module (AE3)

1-port ATM over T3 module (AT3)

1-port channelized POS optical interface module (1CPOS-E)

1-port channelized POS optical interface module (1CPOS-T)

II. HIC interface module 2-port 10/100Base-TX Fast Ethernet electrical interface module (RT-HIC-2FE)

4-port 10/100Base-TX Fast Ethernet electrical interface module (RT-HIC-4FE)

8-port 10/100Base-TX Fast Ethernet electrical interface module (RT-HIC-8FE)

2-port 10/100Base-TX Fast Ethernet optical interface module (RT-HIC-2FE-SFP)



1-port 1000Base-LX/Base-SX Gigabit Ethernet optical interface module (RT-HIC-1GE)

7

2-port 1000Base-LX/Base-SX Gigabit Ethernet optical interface module (RT-HIC-2GE)

1-port non-channelized POS 155M optical interface module (RT-HIC-1POS)



1-port 155M ATM interface module




8

HU

AW

EI

TE

CH

NO

LO

GI

ES

9

Applications

Application in ISP Network

Figure 1-4 Application of NE20 in ISP network

ISPs take the NE20 as an edge access router on their service networks for the following reasons:

With core routers or ATM switches, the backbone network implements high-speed packet forwarding, while the NE20

can be deployed at the edge of the network to implement service access and high-speed forwarding with high-perfor-

mance QoS, MPLS, VPN and security features.

The NE20 can provide GE, ATM or POS (STM-1/OC-3) interfaces and support many access modes such as Frame

Relay, ATM and DDN, meeting all-around requirements of users.

The NE20 can provide Backup Center and VRRP features, meeting the high-reliability requirement of carrier-class

network devices.

Application in Industry and Super-large Enterprise Network

The NE20 can be placed at the convergence layer or core layer of industry or super-large enterprise networks. When

located on a convergence layer, the NE20 is used to connect the core layer and the access layer to implement hierarchical

network interconnecting.

Campus network

Office building

NE20

NE20

NE20

NE20

NE20

BackboneA BackboneB

Internet

BackboneC

Enterprise�branch

Enterprise�branch

BackboneD

NE20

NE20

NE20

WWW

LAN

NAS

AAA

Cafe bar

10

Figure 1-5 Application of NE20 in industry and super-large enterprise network

Take the NE40/80 routers as the core devices in the local network of an industry headquarters, connect each local

network together through GE or 100M FE interfaces and connect branches to the headquarters through 155M ATM/

POS lines.

Use the NE20 to connect each branch to the headquarters as well as its regional offices so that it can converge traffic and

manage the network. The network segments within a local branch network are interconnected with nx2M interfaces.

The NE20 offers many optional interface modules to provide flexible interconnection for industry-users and large-

enterprises. Regional offices can select low-speed interfaces such as n°¡2M to save cost, and headquarters can select

high-speed interfaces such as ATM or POS interface to improve forwarding rate.

Application in Large/Middle-sized Enterprise Network

The NE20 can be deployed as the core device in large/middle-sized enterprise networks to connect internal network

branches and act as a gateway to provide services such as internal server and accessing Internet with ACL, NAT, and

other features.

Figure 1-6 Application of NE20 in large/middle-sized enterprise network

NE20

NE20

NE20

nx 2M

nx 2M2M

155M

155M

155M

155M

100M

100M

100M Core�router

LAN

LAN

LAN

Data center

Headquarters

Province-level�fiber network

Branch

Branch

Branch

Office

Office

Office

Office

OfficeOffice

NE20

nx 2M

nx 64k

nx 2M

nx 2M

nx 2M

nx 2M

155M

100

100

100

Data center

Headquarters�local network

Branch1

Branch2

Branch3

DDN

DDN

PSTN/ISDN

Remote stuff

Office

LAN

LAN

LAN

HU

AW

EI

TE

CH

NO

LO

GI

ES

11

As the core router of the large/middle-sized enterprise network, the NE20 is connected with the local network segments

in the headquarters through 100M optical/electrical interfaces and is connected with branches through n?2M interfaces

or synchronous serial interfaces.

With many optional interface modules, the NE20 provides flexible interconnection methods for enterprises.

Application in VPN Implementation

Serving as the gateway of VPN, the NE20 can assure QoS and security for transmitting network information with such

technologies as L2TP, GRE, IPSec, NAT, firewall and QoS.

Figure 1-7 Application of NE20 in VPN implementation

The NE20 is deployed as the L2TP Access Concentrator (LAC) or L2TP Network Server (LNS) of VPN tunnel to provide

multiple VPN access modes:

The VPN implementation provides employees on errands with network access services. The traveling stuff can set up a

private tunnel connection with the VPN server of the headquarters using PSTN or Asymmetric Digital Subscriber Line

(ADSL) access service provided by the local ISP.

Intranet VPN provides approaches for oversea institutes, branches and offices to access the headquarters. With tunnel

and encryption technologies, it offers interconnection based on Internet and guarantees security for information trans-

mitted on the entire intranet VPN.

Extranet VPN provides approaches for cooperators and customers to access the enterprise intranets and guarantees

network security.

Extranet VPN

NE 20 NE 20

Headquarters

Intranet VPN

Other company

VPN tunnel

Internet Firewall

VPN tunnelVPN tunnel

LAC

LAC Router

Branch

NAS

LNS

Access VPN

SOHO

SOHO SOHO

VPN tunnel

ADSL�PSTN/ISDN

12

MPLS VPN Solution

Traditional VPN employs Permanent Virtual Circuit (PVC) and tunneling technologies and achieves a great deal in

applications. Nowadays, the scope of connection is becoming wider and wider, and the traditional VPN is facing more and

more challenges in scalability, management and QoS.

� MPLS is developed by integrating routing and switching solutions together. It integrates the flexibility of IP routing and

the simplicity of Layer 2 switching, and it has extraordinary advantages in constructing VPN networks. On a MPLS network,

VPN services can be easily carried out based on IP technology, meeting the requirements of the scalability and manage-

ment of VPN. Security measures can be taken for MPLS VPN to ensure information isolation of different VPNs. The

powerful QoS mechanism of MPLS network can guarantee the quality of services such as the bandwidth, transmission

quality and delay for VPN users.

I. Typical Networking Scheme of MPLS VPN

Figure 1-8 Networking diagram of MPLS VPN

Provide users with MPLS VPN services in the local network or even across ASs.

The NE20 can provide intranet-based and extranet-based MPLS VPN access as well as the Internet egresses for

VPN users. A VPN in which all sites belong to only one enterprise is called intranet; a VPN with sites belonging to

different enterprises is called extranet.

The NE20 is deployed as the Provider Edge (PE) device. It is connected directly with a Customer Edge (CE) device to

provide the VPN access. Moreover, they exchange routing information with each other by running IBGP. A PE can

provide VPN access for many CEs.

The NE20 is deployed as the PE at the edge of MPLS VPNs and labels IP packets. The P routers can determine the

Extranet VPN

NE 20 NE 20

Headquarters

Intranet VPN

Other company

VPN tunnel

Internet Firewall

VPN tunnelVPN tunnel

LAC

LAC Router

Branch

NAS

LNS

Access VPN

SOHO

SOHO SOHO

VPN tunnel

ADSL�PSTN/ISDN

HU

AW

EI

TE

CH

NO

LO

GI

ES

13

destination of the packets according to the labels for further forwarding. In this way, high-speed packet forwarding is

achieved and large-size VPNs can be constructed.

II. HoPE Solution

In BGP-based MPLS VPN, it is possible that bottleneck occurs when there are a large number of access users and at

the same time the capacity of the PE device is relatively small. To solve such problems, Huawei Technologies Co., Ltd.

works out the Hierarchy of PE (HoPE) solution. HoPE is to divide the PE devices in an MPLS VPN into several hierar-

chies to form a hierarchical MPLS VPN network architecture. These PEs on different hierarchies play different roles.

For instance, PE devices on a higher MPLS VPN hierarchy should have higher routing and forwarding performances to

implement interconnection between backbone networks and the access of users of large-size VPNs. The routing and

forwarding performance of PE devices on a lower MPLS VPN hierarchy is relatively lower since these PEs mainly

implement the access of edge VPN users. The HoPE solution supports endless nesting of networks, which greatly

improves the scalability of MPLS VPN.

Figure 1-9 Networking diagram of HoPE solution

PEs can be classified into Superstratum PE (SPE), Middle-level PE (MPE) and Underlayer PE (UPE) by the hierarchy.

PEs in different hierarchies forward packets by labeling them and can directly connect with each other through inter-

faces/subinterfaces or tunnels.

UPE provides a great number of interfaces and only maintains routes of VPN sites which are connected directly with

it, excluding routes from the remote sites. Furthermore, UPE assigns inner labels to the directly connected sites and

advertises them to SPE.

The SPE maintains all routes of the VPN in which the sites are connected with UPEs, including routes of local and

remote sites. However, SPEs only advertise VPN default routes with labels to the UPE.

The MP-BGP protocol is run between the SPE and the UPE. When the SPE and the UPE belong to a same ISP, MP-

SPESPE

SPE Core router

NE 20City

MPE

County

VPN1 Site1 VPN1 Site2

UPE UPE UPE UPE

Router Router Router Router

MPLS backbone

ProvinceLSP GRE tunnel

LSP GRE tunnel

14

iBGP is adopted between them. In this case, SPE acts as Route Reflector (RR). When the SPE and the UPE belong

to different ISPs, the MP-eBGP protocol is adopted between them.

NAT Networking Application

The NE20 provides high-performance NAT using NP mechanism. In addition, depending on ACL and policy routing, it can

implement load balancing with multiple egresses.

Figure 1-10 NAT networking application

The NE20 is connected to different public networks such as the Internet, educational network and governmental network

through different egresses. It configures NAT functions to implement multi-egress load balancing and backup depending

on ACL rules and policy routing. Users access different public networks from different network egresses. Meanwhile,

when an egress fails, traffic can be automatically switched to another egress to guarantee uninterrupted services. In

addition, it can perform the configuration to allow some users to only access specific networks such as educational

network.

The NE20 provides address translation application of internal servers and improves system processing capacity and

response speed by using load balancing. To implement this, it maps the addresses of several internal servers into a

same public network address, and make the internal servers share network traffic using load balancing algorithm.

QoS Networking Application

The NE20 is applicable to interconnecting headquarters with branches for a large/middle-size enterprise, implementing

multimedia flow forwarding, such as voice, data and video.

Intranet

Intranet

Education�network

Government�network

Server3

NE20

Server2

Server1

HU

AW

EI

TE

CH

NO

LO

GI

ES

15

Figure 1-11 QoS networking application

The NE20 provides class-based QoS mechanism and implements traffic monitoring with Traffic Policy (TP) and Commit-

ted Access Rate (CAR). That is, the system will take restriction or punishment measures when traffic exceeds the speci-

fication so that ISP commercial profits and network resources will be protected against damage.

The NE20 provides Traffic Shaping (TS) to automatically adjust outgoing traffic rate in order to accommodate to network

resources required by downstream routers.

Besides providing such congestion management methods as CQ, PQ and WFQ, the NE20 also provides Class-Based

Queuing (CBQ) and Low Latency Queuing (LLQ) to solve resource competition when congestion occurs. In addition, it

supports EF, AF and BE services in DiffServ as well as IP Precedence, DSCP and EXP signaling.

The NE20 provides the mapping between IP QoS and MPLS QoS, implementing end-to-end QoS solution.

The NE20 provides WRED and SARED technologies to avoid overload occurring in network.

Application in IPv6 Backbone Network

Figure 1-12 Application of NE20 in IPv6 backbone network

In IPv6 backbone solutions, the former IPv4 services in the backbone network should not be affected, and the IPv4

LAN LAN

LAN

Router Router

Router

Provide TP and TSProvide TP and TS

Provide TP and TS

Provide PQ/CQ/WFQ/�CBQ/WRED Provide PQ/CQ/WFQ/�

CBQ/WRED

Backbone network

NE20

NE20

NE20

NE20

IPv6/IPv4

DSLAM

SOHO IPv6 SOHO IPv6

PE

L3 L3

L2

PE

NAT-PT

IPv4�Internet

IPv6�Internet

NE20

NE20

NE20MPLS�CORE

MPLS�EDGE

NE20

P

PP

PE/�NAT-PT

IPv6

16

forwarding and MPLS VPN functions should also be implemented. So there are two problems to be solved:

Interworking between IPv6 islands

Interworking between IPv6 and IPv4 network

To accomplish this, the NE20 supports key technologies used in the IPv6 network to make the following solutions:

All the routers on the backbone network support the IPv4/IPv6 dual-stack. IPv4 services are IPv4-forwarded, and IPv6

services are IPv6-forwarded.

IPv6 islands can interwork through Layer 3 tunnel technology. You can configure the tunnel manually or through the 6to4

tunnel technique. The core router only needs to support IPv4 forwarding and does not need upgrade. IPv4 networks are

interconnected with IPv6 networks through a gateway that supports NAT-PT.

Huawei End-to-End Solutions

VoIP Products and SolutionQuidway A8010 Expert VoIP Gateway

Quidway A8010 Mini-Expert VoIP Gateway

Quidway A8010 VoIP GateKeeper

BRASQuidway MA5200G Broadband Intelligent Access Server

Quidway MA5200F Compact Broadband Intelligent

Access Server

Access ServersQuidway A8010 Expert Remote Access Server

Quidway A8010 Mini-Expert Remote Access Server

WLAN Products and SolutionHuawei C9012 WLAN Authentication Server

Quidway W1006E WLAN Access Point

Quidway W1003 WLAN Access Point

Quidway W1003A WLAN Access Point

Quidway WL100M WLAN Cardbus Adapter

Huawei WG202 GPRS+WLAN Combo Card

Network Management SolutioniManager N2000 Datacomm Management System

iManager NSM VPN Manager

iManager NSM QoS Manager

iTellin AAA System

Router SeriesQuidway NetEngine 5000E Terabit Switching Router

Quidway NetEngine 80/80E Core Switching Router

Quidway NetEngine 40/40E Series Universal Switching

Routers

Quidway NetEngine 20/20E Series High-Performance Edge

Routers

Quidway NetEngine 16E/08E/05 Series Multi-Service Edge

Routers

Quidway AR 46 Series Enterprise Core Routers

Quidway AR 28 Series Modular Branch Routers

Quidway AR 18 Series Access Routers

LAN Switch Series Quidway S8500 Series 10G Core Routing Switches

Quidway S8016 Multi-Service Backbone Routing Switch

Quidway S6500 Series Gigabit Routing Switches

Quidway S5516 Gigabit Routing Switch

Quidway S5000 Series Gigabit Intelligent Layer 2 Ethernet

Switches

Quidway S3900 Series Intelligent Routing Switches

Quidway S3500 Series Intelligent Routing Switches

Quidway S3000 Series Intelligent Layer 2 Ethernet Switches

Quidway S2000 Series Enterprise Desktop Switches

Security & VPN ProductsQuidway Eudemon 1000/500/200/100 Series Firewalls

Quidway Eudemon 2000 Series Session Border Conctrollers

Quidway SecPath Series Security Gateways

introduction - comten

Documents