The H3C WX3500H-LI is a new generation of high-performance wired and wireless integrated controller (AC, Access Controller) product series independently developed by H3C Technologies Co., Ltd. (hereinafter referred to as H3C). Positioned for the domestic enterprise network market, the WX3500H-LI series wireless controllers feature large capacity, high reliability, and a wide range of service types. In terms of hardware, the WX3500H-LI series is equipped with a high-performance multi-core CPU, enabling full-size packet line-rate forwarding in wireless tunnels. On the software side, it adopts H3C's new generation Comware V7 network operating system platform (hereinafter referred to as the V7 system). In addition to supporting the original system's refined user control management, comprehensive RF resource management, 24/7 wireless security management, Layer 2 and 3 fast roaming, flexible QoS control, IPv4 & IPv6 dual-stack, and many other functions, it also supports multi-core control plane, next-generation wireless positioning, Bonjour, Hotspot 2.0, and other emerging wireless software features. Compared to traditional wireless controllers, the WX3500H-LI series supports a variety of flexible networking methods such as cloud computing management, hierarchical AC, and IRF.

The H3C WX3500H-LI series wireless controllers include two models: WX3510H-LI and WX3520H-LI*. When used in conjunction with the H3C Fit AP product series, they can meet typical application needs in wireless scenarios such as WLAN access in large and medium-sized enterprise campuses, wireless metropolitan area network coverage, and hotspot coverage.

1. Provides management of 802.11ax APs.

The WX3500H-LI series wireless controller supports the management of traditional 802.11a/b/g/n/ac APs, and can also be networked with H3C APs based on the 802.11ax protocol, thus providing wireless access speeds several times higher than those of traditional 802.11a/b/g/n/ac protocols, covering a wider area and making wireless multimedia applications a reality.

2. Based on a brand new operating system

The WX3500H-LI series wireless controllers are developed using H3C's new generation V7 system. This new operating system significantly improves product performance and reliability, enabling it to meet the increasingly complex network applications in the enterprise market. Compared to the previous generation operating system, the V7 system offers several advantages:

Multi-core control: In the V7 system, the allocation ratio of CPU control cores and forwarding cores can be adjusted as needed to achieve an optimal balance, which can fully enhance the CPU's control and data computing capabilities, while providing powerful concurrent computing capabilities.

Support for user-mode multitasking: The V7 system adopts a brand-new software execution permission control method. The vast majority of network services run in user mode. Different network services occupy different tasks, and each task occupies independent resources. If a task fails, the error is limited to that task and does not affect other tasks, enabling the system to maintain safe and reliable operation.

User-mode task monitoring: The V7 system has a task monitoring function. The system specifically monitors the running status of each user-mode task. If an abnormal situation occurs in a user-mode task, the system will reload the task so that the business can be quickly restored.

A new approach to individual service upgrades is adopted: The V7 system supports individual service upgrades, allowing only a single service module to be upgraded without updating the entire software. Compared to the company's previous generation operating system, this significantly reduces the number of restarts required for upgrades, ensures upgrade security, and effectively improves network stability.

3. Provides powerful wired and wireless processing performance

The WX3500H-LI series wireless controllers adopt a new high-performance multi-core CPU. The WX3520H-LI controller's CPU has 4 independent cores and can virtualize 16 cores, while the WX3510H-LI has 2 independent cores and can virtualize 8 cores. Relying on powerful computing capabilities, the devices can not only manage more users and improve concurrent performance, but also respond in a timely manner, thus improving the user experience.

4. Provide high-density port access

The WX3500H-LI series wireless controllers offer high-density port access for enhanced wired and wireless integrated access (including management of user access, authentication, and billing; unified management of wired and wireless users). Different models offer varying service interfaces to meet the requirements of different markets. By providing high-density ports and multiple port types, the products enable users to flexibly configure networks and access the network.

The WX3510H-LI provides 6 GE ports, 2 GE Combo ports, and 1 USB port.

The WX3520H-LI offers 8 GE Combo ports and 2 SFP+ ports.

Users can flexibly choose products based on the external interfaces and processing performance provided by the equipment.

5. Supports star-shaped IRF

The WX3500H-LI series wireless controllers support H3C's latest star-topology IRF model. Compared to the standard cascaded IRF model, the star topology uses a Layer 2 network (virtualized as a central point) to connect multiple devices, making networking more flexible and convenient. The core idea of ​​the star IRF model is to connect multiple devices together in a star topology, virtualizing them into a single distributed device, offering the following advantages:

Simple networking: Star IRF does not require dedicated stacking cables and dedicated stacking ports. Stacking can be established simply by connecting through a switch or by direct connection at Layer 2.

Capability stacking: The star-shaped IRF presents itself as a single virtual AC to the outside world. The number of management APs and users of the virtual AC is the sum of the capabilities of multiple ACs.

Simple configuration: Configurations on the virtual AC can be automatically synchronized to all physical ACs.

Highly reliable backup: Supports M+N hot backup, which means backup of all services. The failure of one AC will not affect the function of the virtual AC. The current WX3500H-LI series wireless controllers support stacking up to 2 devices.

Flexible license control: In a star-shaped IRF, if one device installs a license, other devices can share it. The number of access APs in a virtual AC is the sum of the number of licenses installed on the devices in the IRF. In addition, although the license is specifically bound to and installed on the device, it can be easily uninstalled and migrated.

6. Supports layered AC architecture

The hierarchical AC architecture is a novel networking model proposed by H3C to address the multi-level networking needs in the market. It adopts an architecture similar to the centralized control and hierarchical management of large chain enterprises, with a central core management AC and multiple local access layer ACs connected to it. Access layer ACs primarily handle real-time services such as AP access and data forwarding, while core layer ACs handle non-real-time global services such as network management, control, and centralized authentication. Core layer ACs also possess the AP access and data forwarding capabilities of ordinary ACs. The core layer ACs are high-performance ACs deployed at the aggregation layer; while access layer ACs can consist of standard ACs, all-in-one ACs (with routing and DPI functions), or wired/wireless integrated switches, deployed at the same level as the existing network. This hierarchical AC architecture model elevates the wired/wireless integration concept to a new level, making it suitable for large-scale wireless network deployments. The hierarchical AC model naturally supports headquarters and branch office application scenarios. Core link bandwidth and core layer AC forwarding capabilities are no longer bottlenecks. Centralized control by the core layer AC allows access layer ACs and connected APs to easily achieve automatic upgrades and configuration synchronization, greatly simplifying version upgrades. In roaming scenarios, the access layer AC is responsible for switching between APs, which greatly improves roaming performance.

7. Supports Cupid positioning

The WX3500H-LI series supports CUPID wireless positioning, also known as the Cupid positioning system due to its high accuracy. The Cupid positioning system uses a principle similar to radar detection: the access point (AP) actively sends detection messages to the client, and the client's location is calculated by determining the time difference between the sent and received messages.

8. Provide next-generation intelligent business perception

Intelligent Application Aware (ICA) provides wired and wireless users with application-layer security, QoS, and forwarding policies based on user roles. Through ICA, it's possible to specify who can access the network, the network range accessible to their various applications (such as HTTP, FTP, etc.), and the allowed network bandwidth. Compared to the previous generation, the new generation of ICA adds Deep Packet Analysis (DPI) functionality, expanding application identification and statistical capabilities. The previous generation primarily relied on coarse identification based on Ethernet Layer 4 port numbers (e.g., port 80 for HTTP, 20/21 for FTP, port 8000 for QQ, etc.), allowing users to bypass access restrictions by setting up proxies. The new generation directly identifies access based on the seven-layer characteristics of Ethernet packets, using a feature library specific to each application. This precise identification allows for complete restrictions. DPI eliminates the need to individually block websites (e.g., JD.com, Taobao, Yihaodian), allowing blocking of shopping websites, simplifying configuration and improving efficiency.

9. Provides flexible data forwarding methods

Traditional wireless controller deployments typically employ a centralized forwarding mode. While the AC (Access Controller) can provide comprehensive control and security over packets, all wireless service traffic requires unified processing at the AC, making core link bandwidth and AC forwarding capabilities bottlenecks. This is particularly problematic when APs and ACs are connected via a wide area network (WAN). With APs deployed as data access devices in branch offices and ACs at headquarters, all user data is sent from the APs to the ACs for centralized forwarding, resulting in low forwarding efficiency. The WX3500H-LI series wireless controllers support centralized forwarding, distributed forwarding, and policy-based forwarding, allowing users to flexibly configure forwarding methods based on business needs and network conditions.

The WX3500H-LI series wireless controllers also support a centralized authentication and local forwarding networking mode, providing centralized authentication and management of 802.1X and Portal when data streams are forwarded locally.

10. Supports carrier-grade wireless user access control and management.

User-based access control is a key feature of the WX3500H-LI series wireless controllers. The User Profile provides a configuration template that can save preset configurations (a collection of configurations). Users can configure different content for their User Profile according to different application scenarios, such as CAR (Committed Access Rate) policies and QoS (Quality of Service) policies.

When a user accesses a device, authentication is required. During authentication, the authentication server sends a User Profile name to the device, and the device immediately activates the specific settings configured in the User Profile. When a user successfully accesses the device, the device uses these settings to restrict the user's access behavior. When a user logs off, the system automatically disables the configuration items under the User Profile, thus removing the restrictions imposed by the User Profile on the user. Therefore, User Profiles are suitable for restricting the access behavior of online users. When no user is online (e.g., no user accesses the device, the user fails authentication, or the user logs off), the User Profile remains in its default configuration and is ineffective.

In addition, the WX3500H-LI series wireless controllers also support MAC-based authentication access control. This method not only allows customers to configure and modify user group permissions on the AAA server, but also supports the configuration of permissions for specific users. This fine-grained user permission control greatly enhances the availability of the wireless network, and network administrators can easily assign access permissions to different levels of people or groups of people through this method.

MAC-based VLANs are also a major feature of the WX3500H-LI series wireless controllers. In terms of control policies, administrators can group users with the same MAC address into the same VLAN and configure security policies on the controller based on VLANs. This simplifies system configuration and enables fine-grained management at the user level.

For security or billing reasons, system administrators may want to control where wireless users access the network. The WX3500H-LI series wireless controllers support AP location-based user access control. When a wireless user accesses the network, the authentication server can send a list of APs that allow user access to the AC, and access control can be performed on the AC to restrict wireless users to accessing only APs in specified locations.

11. Supports intelligent channel switching

In wireless LANs, channels are a very scarce resource. Each access point (AP) can only operate on a very limited number of non-overlapping channels. For example, in a 2.4G network, there are only three non-overlapping channels. Therefore, how to intelligently allocate channels to APs is the key to wireless applications.

The frequency bands in which wireless LANs operate contain numerous potential sources of interference, such as radar and microwave ovens. Their presence in the network can interfere with the normal operation of access points (APs). Intelligent channel switching ensures that each AP is assigned the optimal channel, minimizing and avoiding interference from adjacent channels. Furthermore, real-time channel interference detection allows APs to avoid interference sources such as radar and microwave ovens in real time.

12. Supports intelligent AP load balancing

The 802.11 protocol delegates wireless roaming decisions to the wireless client, which typically selects an access point (AP) based on its signal strength (RSSI). This can easily lead to a large number of clients connecting to the same AP simply because it has a strong signal. Since these clients share the wireless medium, the network throughput for each client is significantly reduced.

The intelligent load balancing method can analyze the location of wireless clients in real time and dynamically determine which access points (APs) can share the load with each other at the current time and location. Load balancing among these APs is achieved by controlling which APs the wireless clients connect to. The system supports load balancing not only based on the number of online user sessions but also based on user traffic load.

13. Supports Layer 7 mobile security detection/defense (wIDS/wIPS)

The WX3500H-LI series wireless controllers support mobile security defense modes including: blacklist, whitelist, rogue defense, malformed packet detection, unauthorized user disconnection, and attack detection and countermeasures based on the pre-set and upgradeable Signature MAC layer (e.g., DoS attacks, Flood attacks, man-in-the-middle attacks). Combined with the massive intelligent expert knowledge base built into the wireless application console, it provides flexible basis for wireless security policy judgments, enabling visual physical location tracking and monitoring, and removal of physical ports on switches for clearly identified unauthorized attack sources (APs or terminals, etc.).

By working in conjunction with H3C's professional core layer firewall/IPS equipment, it can achieve a 7-layer three-dimensional security defense for mobile campuses, meeting the true end-to-end security protection needs from wireless (802.11) to wired (802.3).

14. Supports 802.1x authentication, MAC address authentication, Portal authentication, etc.

The WX3500H-LI series wireless controllers support multiple authentication methods:

802.1x Authentication: The WX3500H-LI series wireless controllers support multiple 802.1x authentication methods, including TLS, PEAP, TTLS, MD5, and SIM card authentication. They also support local 802.1x authentication, providing support for mainstream authentication methods such as MD5, TLS, and PEAP, eliminating the need for users to configure an additional AAA server. The WX3500H-LI series wireless controllers also support dynamic VLAN and ACL authorization after 802.1x authentication. User policies can be pre-configured, and the system automatically configures client permissions during authentication.

MAC Address Authentication: The WX3500H-LI series wireless controller supports MAC address authentication. For some handheld terminals (such as Wi-Fi phones, handheld mobile terminals, etc.), it is inconvenient to use computer authentication methods. MAC address authentication can easily solve this problem. By configuring valid MAC addresses on the controller or AAA server, terminals corresponding to these MAC addresses can be allowed to access the network, while unauthorized terminals that have not been configured beforehand cannot access the wireless network. This function greatly facilitates applications such as wireless medical systems. MAC address authentication can ensure that only hospital PDA work terminals can access the wireless network, while denying patients' wireless PDAs the use of the dedicated wireless network.

Portal Authentication: The WX3500H-LI series wireless controllers offer a built-in Portal authentication server. This authentication method requires no client cooperation, directly using the browser's web portal page as the authentication channel. Once the user is successfully authenticated, they can be flexibly redirected to a designated access homepage and the corresponding authorization and billing processes can be initiated. Customized portal pages can also be flexibly pushed according to policy requirements to achieve advertising and information dissemination purposes, making it widely used in wireless campuses, wireless cities, and visitor access applications.

15. Supports IPv4/IPv6 dual protocol stack (Native IPv6)

The WX3500H-LI series wireless controllers support IPv6 access for wireless clients. At the tunnel origin AP, because the device is aware of IPv6, it can perform IPv6 priority mapping to tunnel priority, etc.; on the AC side, it can also perform complex control and filtering such as ACL filtering on IPv6 packets.

The WX3500H-LI series wireless controllers can also be deployed in IPv6 networks, with the AC and AP automatically negotiating an IPv6 tunnel. Even when the AC and AP are fully operational in IPv6 mode, the wireless controller can still correctly perceive IPv4 and process IPv4 packets from wireless clients. The WX3500H-LI series wireless controllers' flexible IPv4/6 adaptability can meet the various complex applications customers face during the migration from IPv4 to IPv6 networks. It can provide IPv4 services to customers in IPv6 silos while simultaneously allowing users in IPv4 silos to easily log in to the network via the IPv6 protocol.

To address the rampant IPv6 packet spoofing attacks on campus networks, the WX3500H-LI series wireless controllers support IPv6 SAVI (Source Address Validation) technology. By monitoring the address allocation protocol to obtain the user's IP address, it ensures that the correct address can be used to access the internet in subsequent applications, and prevents the spoofing of other people's IP addresses, thus guaranteeing the reliability of the source address. Furthermore, the combination of IPv6 SAVI and Portal technology further ensures the authenticity and security of all internet user packets.

16. Provide end-to-end QoS

The WX3500H-LI series wireless controllers are developed based on the new generation V7 system, which not only fully supports the Diff-Serv standard, but also adds QoS support for the IPv6 protocol.

The QoS Diff-Serv model mainly includes flow classification, traffic policing, queue management, and queue scheduling. It fully implements the six PHB groups and services defined in the standard, namely EF, AF1 to AF4, and BE, enabling network operators to provide users with service guarantees with different service quality levels, and making the Internet a truly integrated network that simultaneously carries data, voice, and video services.

17. Supports fast 2nd and 3rd layer roaming.

H3C's centralized wireless architecture not only facilitates Layer 2 roaming but also greatly benefits Layer 3 roaming. WLAN networks deployed with Fat APs face significant challenges in implementing Layer 3 roaming due to limited information exchange between APs. The centralized architecture easily solves this problem. The WX3500H-LI series wireless controllers support both Layer 2 and Layer 3 roaming, with roaming domains unrestricted by subnets. This excellent roaming feature allows customers to focus on wireless signal coverage rather than extensively planning their existing networks, significantly simplifying initial network planning and reducing costs.

In traditional mode, when wireless user terminals use 802.1x as the means of 802.11 access authentication and key exchange, the number of communication messages between the wireless user terminal and the access point (AP) is very high. When a wireless user terminal roams between two APs, if the wireless user terminal completely follows the full 802.1x interaction process during the access process to a new AP, it will inevitably result in excessively long roaming handover times. For some services that are sensitive to roaming handover time (such as voice services), such long handover times are unacceptable. The WX3500H-LI series wireless controller uses key caching technology to enable fast handover for users during roaming. Key caching technology strikes a good balance between secure access and fast roaming, allowing wireless user terminals to avoid repeating the full 802.1x authentication interaction process when roaming between two APs, while ensuring the continuity of user identification and key usage. Wireless users use fast roaming, with a roaming time of no more than 50ms within a single AC, meeting the stringent requirements of voice services.

18. Supports remote access scenarios for various branch offices.

When AC and AP are connected via WAN link, users can flexibly choose centralized forwarding or local forwarding mode to improve the performance of services such as LAN printing access and terminal mutual access in branch offices.

When a WAN link or AC fails, online users will not be disconnected and can continue to access local resources. The AC escape function is also supported.

When a branch office AP is deployed within a private network, the AC can communicate with the AP by traversing NAT.

Hardware Specifications

Software Specifications