The H3C WX2580X-LI is a gateway-type wireless controller (AC) based on the Comware platform from H3C Technologies Co., Ltd. The WX2580X-LI offers a wide range of services, integrating sophisticated user control and management, comprehensive RF resource management, 24/7 wireless security control, fast Layer 2 and 3 roaming, flexible QoS control, and IPv4 & IPv6 dual-stack functionality, providing powerful wired and wireless integrated access capabilities.

The H3C WX2580X-LI wireless controller is specifically designed for branch offices and small campus wireless network deployments. Integrating gateway and AC functions, it reduces the types and number of devices businesses need to purchase for network setup, thus reducing investment. When used with the H3C Fit AP product series, it supports WIPS, firewall, and other functions. It also features a variety of port types, notably a built-in USB interface for connecting relevant enterprise peripherals.

The H3C WX2580X-LI wireless controller, when used in conjunction with the H3C Fit AP product series, can meet typical wireless application needs such as WLAN access in small business campuses and hotspot coverage in branch offices.

1. Provides management of 802.11ax APs.

The WX2580X-LI wireless controller supports the management of traditional 802.11a/b/g/n/ac APs, and can also be used in conjunction with H3C APs based on the 802.11ax protocol to form a network. This breaks through the traditional serial communication mechanism of wireless networks, resulting in a significant increase in the utilization of wireless spectrum resources, a substantial increase in the number of effective access users, a reduction in the deployment cost of wireless networks, and a greatly improved user experience in high-density user environments.

2. Provides flexible data forwarding methods

Traditional wireless controller deployments typically employ a centralized forwarding model. While the AC (Access Controller) provides comprehensive control and security over packets, all wireless traffic requires unified processing at the AC, making core link bandwidth and AC forwarding capabilities bottlenecks. This is particularly problematic when APs and ACs are connected via a wide area network (WAN). With APs deployed as data access devices in branch offices and ACs at headquarters, all user data is sent from the APs to the ACs for centralized forwarding, resulting in low forwarding efficiency. The WX2500X series wireless controllers support centralized forwarding, distributed forwarding, and policy-based forwarding, allowing users to flexibly configure forwarding methods based on business needs and network conditions.

The WX2580X-LI wireless controller also supports a centralized authentication and local forwarding networking mode, providing centralized authentication and management of 802.1X and Portal when the data stream is forwarded locally.

3. Wireless 4i Technology System

In the construction and operation of enterprise wireless networks, "network optimization" is an indispensable part. Effective network optimization not only ensures the user experience and performance but also increases the number of users connected to devices, extends device lifespan, and thus protects existing investments to a certain extent, maximizing the value of the wireless network. Against this technological trend, H3C focuses on enhancing its "experience optimization" capabilities, independently developing iRadio, IStation, iEdge, and iHeal technologies to deeply optimize wireless networks in various aspects such as air interface performance, roaming access, application protection, and network automation, resulting in a significant improvement in user experience.

iRadio: Intelligent Radio Frequency Management

Due to the openness of Wi-Fi frequency bands and the priority of spectrum resources, wireless signals are highly susceptible to various interferences. In the same wireless environment, different terminals, locations, and times can all result in different user experiences. iRadio technology uses the following techniques to intelligently schedule radio frequency resources, thereby reducing wireless signal interference, improving air interface performance, reducing packet loss and latency, and improving user experience while enhancing overall network performance.

1) Automatic optimization of radio frequency resources

This technology automatically and intelligently adjusts channel, power, and bandwidth modes according to changes in the wireless environment, ensuring that wireless signal coverage is always at the optimal level, effectively reducing interference, and eliminating the need for manual configuration by maintenance personnel throughout the process, thus achieving fully automated and intelligent optimization of radio frequency resources.

2) Time fairness technology

Wi-Fi wireless transmission operates on a shared channel and shared bandwidth model. Therefore, in multi-user scenarios, while traditional rate fairness methods can prevent high-bandwidth terminals from monopolizing wireless resources, they are ineffective in addressing the issue of other, less capable terminals occupying air interface resources for extended periods. iRadio's time fairness technology allocates the same-length time window for each terminal to send packets, preventing individual terminals from arbitrarily preempting wireless resources, ensuring a good experience for all terminals, and improving the utilization rate of wireless spectrum resources.

3) Broadcast multicast optimization

The difference in transmission rates between unicast, broadcast, and multicast messages has widened with the advancement of Wi-Fi standards. The lower transmission rates of broadcast and multicast messages have severely impacted wireless transmission efficiency. iRadio's broadcast/multicast optimization technology accurately identifies broadcast and multicast messages and implements different strategies in different usage scenarios to minimize their impact and significantly improve wireless air interface performance. Simultaneously, it can also increase the transmission rate of broadcast and multicast messages in appropriate scenarios.

4) Low latency guarantee

The post-pandemic era has spurred enterprises to improve management and operational efficiency through cloud collaboration, with cloud-based office work, remote conferencing, and live video streaming becoming the norm. Unlike previous wireless office needs that merely met basic requirements like coverage and low bandwidth, these low-latency service scenarios place higher demands on wireless networks. Low-latency assurance technologies can effectively identify these types of services and, through a comprehensive control approach including prioritizing, calculating optimal message transmission rates, and using more reasonable frame lengths, ensure faster transmission speeds, effectively reduce air interface latency, and guarantee the normal operation of real-time services.

iStation: Smart Terminal Management

During Wi-Fi usage, the interaction between the device and the terminal is bidirectional. iRadio optimizes radio frequency resources and air interface performance through intelligent intervention on the wireless network device side (AC or AP) to improve the user experience. iStation improves access, roaming, traffic control and other aspects through intelligent management of the terminal.

1) Optimal Access

Terminal access to the wireless network is divided into three stages: "scanning-probe detection-association". Zhiyou Access adopts a unique optimization strategy in each stage to form a complete and effective solution, ensuring that each wireless terminal is associated with its surrounding reasonable radio frequency in one go.

2) Fast Roaming

The WLAN protocol does not provide a roaming mechanism for terminals; instead, the terminals themselves decide when to roam. In practice, the roaming mechanisms of different terminals vary significantly. Slow or frequent roaming can lead to a poor user experience while on the move. iStation's fast roaming technology classifies and tags terminals, and then customizes the roaming guidance mechanism based on different tags, making terminal roaming faster, smoother, and providing a better experience.

3) Guaranteed

Compared to traditional business prioritization strategies, VIP protection technology divides users into multiple tiers.

iEdge: Intelligent Edge Computing

iEdge technology empowers W-Fi 6 APs with edge service awareness capabilities, and achieves an ultimate experience of seamless network and terminal awareness through service identification, optimal forwarding, and routing.

1) Edge security protection

Unlike traditional vendors that implement security policies at the network's central access control (AC) or firewall, H3C applies a comprehensive security protection solution at layers 2-7 to its Wi-Fi 6 access points (APs). Performing security analysis and policies at the network edge AP not only provides rapid response but also brings security protection forward to the air interface level, directly isolating threats outside the wireless network.

2) Edge application acceleration

Edge acceleration technology can intelligently identify user applications and save snapshots of these applications. Subsequent user packets are compared with these snapshots, and combined with intelligent sorting technology, identified application packets can be processed at high speed, overcoming the problems of low DPI performance and inaccurate application identification by traditional DFI. Based on this technology, APs can also perform targeted optimizations during roaming to ensure a smooth user experience when using critical services. Furthermore, when the AP detects excessive air interface occupancy, it can strategically suppress non-critical service traffic, achieving a bidirectional application acceleration effect.

3) Historical Retrospection of the Margins

Access, authentication, DHCP interaction, ARP interaction, and DNS resolution are fundamental for terminal online processes, and these steps are also highly prone to problems and extremely difficult to reproduce. Based on H3C Wi-Fi AP's key protocol snapshot technology, the entire process of terminal access, authentication, DHCP interaction, ARP interaction, and DNS resolution is fully restored, accurately recording each key moment, providing support for judging terminal user experience and the overall network device status.

iHeal: Intelligent Network Healing

H3C iHeal technology assists users in achieving more efficient, seamless, fully automatic, and intelligent wireless network optimization by combining three major functions: automatic problem discovery, automatic problem resolution, and gradual network optimization, thereby comprehensively improving the wireless user experience.

1) Automatic problem detection

iHeal technology introduces Telemetry technology to enrich operation and maintenance data, enabling the identification of hundreds of problems and root cause analysis of terminal online failures, as well as automatic closure of multiple types of problems. This allows users to proactively discover problems before they are reported, achieving intelligent and proactive operation and maintenance.

2) Problems are solved automatically.

After automatically identifying a problem, iHeal technology further analyzes and locates the root cause to confirm the reason for the problem. Once the root cause is identified, iHeal automatically selects and deploys a suitable handling strategy from its expert strategy library, monitors the problem's progress in real time, and dynamically adjusts strategy parameters to ultimately achieve a closed-loop problem resolution. This truly realizes a fully automated closed-loop operation and maintenance system without human intervention, resulting in truly intelligent operation and maintenance that significantly improves efficiency and productivity.

3) Gradual optimization of the entire network

Wireless networks are dynamic and ever-changing networks. iHeal's progressive optimization technology enables the network to adapt to changes in a timely manner, continuously optimize itself, and always maintain a high-performance, low-interference state, thereby fundamentally reducing the number of problems and evolving towards a truly high-experience, zero-maintenance system.

4. Supports carrier-grade wireless user access control and management

User-based access control is a key feature of the WX2580X-LI wireless controller. The User Profile provides a configuration template that can save preset configurations (a collection of configurations). Users can configure different content for their User Profile according to different application scenarios, such as CAR (Committed Access Rate) policies and QoS (Quality of Service) policies.

When a user accesses a device, authentication is required. During authentication, the authentication server sends a User Profile name to the device, and the device immediately activates the specific settings configured in the User Profile. When a user successfully accesses the device, the device uses these settings to restrict the user's access behavior. When a user logs off, the system automatically disables the configuration items under the User Profile, thus removing the restrictions imposed by the User Profile on the user. Therefore, User Profiles are suitable for restricting the access behavior of online users. When no user is online (e.g., no user accesses the device, the user fails authentication, or the user logs off), the User Profile remains in its default configuration and is ineffective.

In addition, the WX2580X-LI wireless controller also supports MAC-based authentication access control. This method not only allows customers to configure and modify user group permissions on the AAA server, but also supports the configuration of permissions for specific users. This fine-grained user permission control greatly enhances the availability of the wireless network, and network administrators can easily assign access permissions to different levels of people or groups of people through this method.

MAC-based VLANs are also a major feature of the WX2580X-LI wireless controller. In terms of control policies, administrators can group users with the same MAC address into the same VLAN and configure security policies on the controller based on VLANs. This simplifies system configuration and enables fine-grained management at the user level.

For security or billing reasons, system administrators may want to control where wireless users access the network. The WX2580X-LI wireless controller supports AP location-based user access control. When a wireless user accesses the network, the authentication server can send a list of APs that allow user access to the AC, and access control can be performed on the AC to restrict wireless users to accessing only APs in specified locations.

4. Provide reliable gateway functionality

The WX2580X-LI is positioned as a gateway for small and medium-sized enterprises and branch offices, integrating both gateway and AC functions. Its dual WAN port design provides a foundation for uplink backup. Furthermore, compared to the previous generation, the WAN ports utilize a 2.5G multi-rate interface, significantly improving uplink efficiency. The WX2580X-LI supports common gateway functions such as PPPoE, NAT gateway functionality, dynamic IP address, and static IP address settings.

5. Supports Bonjour Gateway

The WX2580X-LI wireless controller supports Bonjour Gateway functionality, making it easy for small businesses to use Apple devices such as printers, TVs, and tablets.

6. Supports 7-layer mobile security detection/defense (WIDS/WIPS)

The WX2580X-LI wireless controller supports mobile security defense modes including: blacklist, whitelist, rogue defense, malformed packet detection, unauthorized user disconnection, and attack detection and countermeasures based on the pre-set and upgradeable Signature MAC layer (e.g., DoS attacks, Flood attacks, man-in-the-middle attacks). Combined with the massive intelligent expert knowledge base built into the wireless application console, it provides flexible basis for wireless security policy judgments, enabling visual physical location tracking and monitoring, and removal of physical ports on switches for clearly identified unauthorized attack sources (APs or terminals, etc.).

By working in conjunction with H3C's professional core layer firewall/IPS equipment, it can achieve a 7-layer three-dimensional security defense for mobile campuses, meeting the true end-to-end security protection needs from wireless (802.11) to wired (802.3).

7. Supports RealTime Spectrum Guard mode

RealTime Spectrum Guard (RTSG) is a professional monitoring solution for the spectrum status of wireless environments, innovatively proposed by H3C. The entire series of wireless controllers can be deeply integrated with Sensor APs that have built-in RF acquisition modules to achieve RF monitoring and real-time spectrum protection.

The RTSG console is integrated into the H3C iMC Intelligent Management Center. Through the CAPWAP management tunnel, it communicates with Sensor APs and collects data, enabling 24/7 wireless environment quality monitoring, wireless network capability trend assessment, and unlicensed interference alarms. Graphically, it proactively detects and identifies all RF interference sources (Wi-Fi or non-Wi-Fi) in the 2.4GHz/5GHz bands, providing real-time FFT plots, spectrum density plots, spectrum plots, duty cycle plots, event spectrum plots, channel power, interference power, etc. It can automatically identify interference sources, pinpoint the location of problematic wireless devices, and ensure optimal wireless network performance. Combined with the H3C iAR intelligent reporting component, it enables the storage, tracing, and playback of historical RF quality data across the entire coverage area, automatically generating customized trend, compliance, and audit reports.

To meet the different levels of user wireless environment monitoring needs, the RTSG solution can be flexibly deployed in either Local mode or Monitor mode. When operating in Local mode, it can maintain normal user access and packet forwarding while achieving effective spectrum protection.

8. Built-in RF Optimization Engine (ROE)

The WX2580X-LI wireless controller features a built-in RF Optimizing Engine for access points (APs). Through feature- and protocol-based RF optimization, it effectively enhances application acceleration and quality assurance in high-density access and streaming media transmission scenarios in wireless deployments. This includes features such as multi-user fair scheduling, fair hybrid access, interference filtering, rate optimization, spectrum navigation, multicast enhancement (IPv4/IPv6), per-packet power control, and intelligent bandwidth guarantee.

9. Supports 802.1x authentication, MAC address authentication, Portal authentication, etc.

The WX2580X-LI wireless controller supports multiple authentication methods:

802.1x Authentication: The WX2580X-LI wireless controller supports multiple 802.1x authentication methods, including TLS, PEAP, TTLS, MD5, and SIM card authentication. It also supports local 802.1x authentication, providing support for mainstream authentication methods such as MD5, TLS, and PEAP, eliminating the need for users to configure an additional AAA server. The WX2580X-LI wireless controller also supports dynamic VLAN and ACL authorization after 802.1x authentication. User policies can be pre-configured, and the system automatically configures client permissions during authentication.

MAC Address Authentication: The WX2580X-LI wireless controller supports MAC address authentication. For some handheld terminals (such as Wi-Fi phones and handheld mobile terminals), which are not convenient to use computer-based authentication methods, MAC address authentication can easily solve this problem. By configuring valid MAC addresses on the controller or AAA server, terminals corresponding to these MAC addresses can be allowed to access the network, while unauthorized terminals that have not been configured beforehand cannot access the wireless network. This function greatly facilitates applications such as wireless medical systems. MAC address authentication can ensure that only hospital PDA work terminals can access the wireless network, while denying patients' wireless PDAs the use of the dedicated wireless network.

Portal Authentication: The WX2580X-LI wireless controller provides a built-in Portal authentication server. This authentication method requires no client cooperation, directly using the browser's web portal page as the authentication channel. Once the user is successfully authenticated, they can be flexibly redirected to a designated access homepage and the corresponding authorization and billing processes can be initiated. Customized portal pages can also be flexibly pushed according to policy requirements to achieve advertising and information dissemination purposes, making it widely used in wireless campuses, wireless cities, and visitor access applications.

10. Supports IPv4/IPv6 dual protocol stack (Native IPv6)

The WX2580X-LI wireless controller supports IPv6 access for wireless clients. At the tunnel origin AP, because the device is IPv6 aware, it can perform IPv6 priority mapping to tunnel priority, etc. At the AC side, it can also perform complex control and filtering such as ACL filtering on IPv6 packets.

The WX2580X-LI wireless controller can also be deployed in IPv6 networks, automatically negotiating an IPv6 tunnel between the AC and AP. Even when the AC and AP are fully operational in IPv6 mode, the wireless controller can still correctly perceive IPv4 and process IPv4 packets from wireless clients. The WX2580X-LI wireless controller's flexible IPv4/6 adaptability can meet the complex application needs of customers migrating from IPv4 to IPv6 networks. It can provide IPv4 services to customers in IPv6 silos while also allowing users in IPv4 silos to easily log in to the network via IPv6 protocols.

To address the rampant IPv6 packet spoofing attacks on campus networks, the WX2580X-LI wireless controller supports IPv6 SAVI (Source Address Validation) technology. By monitoring the address allocation protocol to obtain users' IP addresses, it ensures that the correct address is used for subsequent internet access and prevents the spoofing of other users' IP addresses, thus guaranteeing the reliability of the source address. Furthermore, the combination of IPv6 SAVI and Portal technology further ensures the authenticity and security of all internet user packets.

11. Provide end-to-end QoS

The WX2580X-LI wireless controller is developed based on the Comware platform, which not only fully supports the Diff-Serv standard, but also adds QoS support for the IPv6 protocol.

The QoS Diff-Serv model mainly includes flow classification, traffic policing, queue management, and queue scheduling. It fully implements the six PHB groups and services defined in the standard, namely EF, AF1 to AF4, and BE, enabling network operators to provide users with service guarantees with different service quality levels, and making the Internet a truly integrated network that simultaneously carries data, voice, and video services.

12. Supports fast 2nd and 3rd layer roaming.

H3C's centralized wireless architecture not only facilitates Layer 2 roaming but also greatly benefits Layer 3 roaming. WLAN networks deployed with Fat APs face significant challenges in implementing Layer 3 roaming due to limited information exchange between APs. The centralized architecture easily solves this problem. The WX2500X wireless controller supports both Layer 2 and Layer 3 roaming, with roaming domains unrestricted by subnets. This excellent roaming feature allows customers to focus on wireless signal coverage rather than extensively planning their existing networks, significantly simplifying initial network planning and reducing costs.

In traditional mode, when wireless user terminals use 802.1x as the means of 802.11 access authentication and key exchange, the number of communication messages between the wireless user terminal and the access point (AP) is very high. When a wireless user terminal roams between two APs, if the wireless user terminal completely follows the full 802.1x interaction process during the access process to a new AP, it will inevitably result in excessively long roaming handover times. For some services that are sensitive to roaming handover time (such as voice services), such long handover times are unacceptable. The WX2500X wireless controller uses key caching technology to enable fast handover for users during roaming. Key caching technology strikes a good balance between secure user access and fast roaming, allowing wireless user terminals to avoid repeating the full 802.1x authentication interaction process when roaming between two APs, while ensuring the continuity of user identification and key usage. Wireless users use fast roaming, with a roaming time of no more than 50ms within a single AC, meeting the stringent requirements of voice services.

Hardware Specifications

Software Specifications