Huawei Network Devices in Practice: Complete Model Guide and Configuration Handbook

When building enterprise networks, the most common question is "How to configure a specific Huawei device?" The author stresses that while models and commands evolve, the fundamentals remain: identify the model, master basic commands, then apply experience.

Huawei Switch Model Overview

The CloudEngine S series covers access, aggregation, and core layers. Common models include:

S5735-L : Gigabit access for SMBs, four 10 Gbps uplinks, cheap and robust.

S5735-S : Upgraded ACL/QoS, optional PoE++ for APs.

S5735-V2 : Cost‑effective variant promoted through Huawei’s Kunling channel.

S5731-S : All‑gigabit access with 10 Gbps uplinks, strong L3 routing for aggregation.

S5732-H : Multi‑rate (2.5/5/10 Gbps) for Wi‑Fi 6/7 deployments.

S7700 and S12700 : Box‑type and frame‑type cores for medium to large campuses.

CE5880/CE6865 : 25/100 Gbps data‑center access.

CE16800 : Frame core with up to 400 Gbps per slot.

Selection rule: users < 200 → S5735‑S; 200‑1000 → S5731‑S or S7700; > 1000 → S12700 or CE series .

Huawei Router Model Overview

The NetEngine AR series, now in the AR6000 generation, is split by throughput:

AR6100 series (SOHO): AR6120/AR6121 – 1‑2 WAN ports, 4‑8 LAN ports, 100‑300 users.

AR6140 – adds four 10 Gbps SFP+ ports for small‑branch SD‑WAN.

AR6280 – chassis with 2 control slots + 4 SIC slots, supports 5G/PoE modules, 500‑1500 users; most common for medium branches.

AR6300/AR6300‑S – three‑times forwarding performance, 5 Gbps uplink, full SD‑WAN/IPSec/SSL‑VPN; used at headquarters or data‑center edges.

NE40E/NE8000 – carrier‑grade, not covered further.

Experience note: an AR6280 can comfortably handle a 1000‑user branch with dual ISP and VPN.

Huawei Firewall Model Overview

The HiSecEngine USG series spans from low‑end to T‑class devices:

USG6300E series – 1‑2 Gbps, 200‑500 users (small sites).

USG6355E/USG6365E – 4‑8 Gbps for medium enterprises.

USG6500E series – AI engine, APT defense, suitable for large chains.

USG6600E series – 20‑80 Gbps for data‑center or large‑campus edges.

USG12000 series – T‑class, 100+ Gbps, AI‑driven, deployed in carrier cores.

In practice, USG6300E devices are most frequently seen; a USG6555E can protect 2000‑3000 users with all IPS/AV/URL filters enabled.

Basic Device Initialization (Example: S5735 Switch)

First, connect via console (USB‑to‑RJ45 or RS232) using SecureCRT/Xshell at 9600 8N1. The default account is empty; set a password on first login.

system-view
sysname SW-Core-01
undo info-center enable
vlan batch 10 20 30 100
interface Vlanif 10
ip address 192.168.10.1 255.255.255.0
aaa
local-user admin password cipher Admin@123
local-user admin privilege level 15
local-user admin service-type ssh
stelnet server enable
ssh authentication-type default password
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
return
save

Warning: Use mixed‑case, numbers, and symbols in passwords; do not grant level 15 lightly; enable only SSH, disable Telnet.

Remember to run save before rebooting.

Routing Configuration (OSPF + Static) on AR6280

Typical enterprise design uses OSPF inside and a default static route to the ISP.

system-view
sysname RT-Gateway-01
undo info-center enable
interface GigabitEthernet0/0/0
description Link-To-ISP
ip address 203.0.113.2 255.255.255.252
interface GigabitEthernet0/0/1
description Link-To-CoreSwitch
ip address 10.0.0.1 255.255.255.252
interface GigabitEthernet0/0/2
description Link-To-ServerFarm
ip address 10.0.1.1 255.255.255.252

Static default route and backup:

ip route-static 0.0.0.0 0.0.0.0 203.0.113.1 description Default-Route-To-ISP
ip route-static 0.0.0.0 0.0.0.0 198.51.100.1 preference 80 description Backup-ISP

OSPF configuration:

ospf 1 router-id 1.1.1.1
default-route-advertise always
area 0.0.0.0
network 10.0.0.0 0.0.0.255
network 10.0.1.0 0.0.0.255

Warning: Manually set router-id; otherwise it may change after reboot, causing neighbor flaps.

NAT Configuration

Two typical scenarios:

Easy IP – use the outbound interface IP for translation (single public IP).

Address‑pool NAT – allocate a pool of public IPs.

Easy IP example:

acl number 3000
rule 5 permit ip source 192.168.0.0 0.0.255.255
interface GigabitEthernet0/0/0
nat outbound 3000

Address‑pool example:

acl number 3000
rule 5 permit ip source 192.168.0.0 0.0.255.255
nat address-group 1 203.0.113.10 203.0.113.20
interface GigabitEthernet0/0/0
nat outbound 3000 address-group 1

One‑to‑one NAT (static mapping) for a server:

# Map internal 192.168.1.100 to public 203.0.113.50
nat static global 203.0.113.50 inside 192.168.1.100
acl number 3001
rule 5 permit tcp destination 192.168.1.100 0 destination-port eq 80
interface GigabitEthernet0/0/0
nat inbound 3001

Warning: After NAT, check the session table with display nat session all; no sessions usually mean the ACL didn’t match.

IPSec VPN (Site‑to‑Site) on USG6300E

Typical headquarters‑to‑branch tunnel:

ike proposal 10
encryption-algorithm aes-256
authentication-algorithm sha2-256
authentication-method pre-share
dh group14
sa duration 86400

ipsec proposal hq-branch
transform esp
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256

Define ACL for interesting traffic:

acl number 3100
rule 5 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255

Configure IKE peer and bind the IPSec policy:

ike peer hq-branch
pre-shared-key %^%#Secure@2025%^%#
ike-proposal 10
remote-address 203.0.113.65
nat traversal
ipsec policy hq-branch 10 isakmp
proposal hq-branch
ike-peer hq-branch
security acl 3100
interface GigabitEthernet0/0/0
ipsec policy hq-branch

Verification commands:

display ike sa
display ipsec sa
display ipsec statistics

Warning: Both ends must have mirrored IKE/IPSec proposals, ACLs, and PSK; mismatches cause the tunnel to stay down.

Firewall Policy Configuration (USG)

USG uses a zone‑based policy model.

interface GigabitEthernet0/0/0
ip address 203.0.113.1 255.255.255.252
alias GE0/0/0
interface GigabitEthernet0/0/1
ip address 10.0.0.254 255.255.255.0
alias GE0/0/1
firewall zone trust
add interface GigabitEthernet0/0/1
set priority 85
firewall zone untrust
add interface GigabitEthernet0/0/0
set priority 5

Security policies:

security-policy
rule name trust-to-untrust
source-zone trust
destination-zone untrust
source-address 192.168.0.0 16
action permit
rule name untrust-to-trust-dns
source-zone untrust
destination-zone trust
destination-address 192.168.1.10 32
service dns
action permit
rule name deny-all
source-zone any
destination-zone any
action deny

Firewall‑side NAT policy:

nat address-group 1 203.0.113.10 203.0.113.20
nat-policy
rule name nat-outbound
source-zone trust
destination-zone untrust
source-address 192.168.0.0 16
action source-nat address-group 1

Warning: The default action is "deny all"; ensure a final deny‑all rule exists, otherwise unintended traffic may be allowed.

Security Hardening Checklist (Pre‑Go‑Live)

Accounts & Authentication : Remove default credentials, enforce passwords ≥12 characters with complexity, create three‑level AAA (admin, operator, read‑only).

Remote Management : Disable Telnet, enable only SSH v2, restrict management‑plane ACL to the O&M subnet, disable SNMPv1/v2, use SNMPv3 with authentication.

Control‑Plane Protection : Enable cpu-defend policy to rate‑limit BPDU, ARP, DHCP, ICMP; enable storm-control to suppress broadcasts.

Logging & Auditing : Turn on info-center and forward logs to a central ELK/Syslog server; log critical actions (reboot, config changes); schedule daily config backups via TFTP/SFTP.

Conclusion

Choosing the right Huawei model covers about half the success; the other half is disciplined configuration. For switches pick S5735 / S5731 / S7700 based on user count, for routers use AR6280 for branches and AR6300 for headquarters, and start with USG6300E firewalls for small sites, scaling to USG6600E for larger deployments.

Key configuration takeaways: initial AAA + SSH, OSPF + static routing, prefer Easy‑IP NAT for simplicity, ensure IPSec VPN endpoints are mirrored, and always end firewall policies with a deny‑all rule. The upcoming article will show how to manage all these devices with iMaster NCE for true operational efficiency.