Home / Engineering Notes
Engineering Notes
Field notes from 18 years in ICT, 13 of them in carrier networks, cross-checked against vendor documentation.
New notes are added continuously — latest: July 2026
Buyer's Guides
Buyer's GuidesHow to Import CCTV from ChinaSamples first, MOQ myths, LCL sea freight vs air, customs prep and regional versions — explained by the factory side.→Buyer's GuidesGrow Your CCTV Installation BusinessThe two-leg strategy, five moves to the next tier, and the skill that separates installers from integrators.→Buyer's GuidesSolar 4G Cameras for Off-Grid SitesHow panel, battery, SIM and TF card work together, cloudy-day autonomy, band matching and the four field failures.→ReferenceCCTV & Networking Glossary62 terms from datasheets, tenders and quotations — PoE budget, ONVIF profiles, WDR, IP67, VLAN, ERPS, Incoterms, RMA — each in two or three sentences with the number that matters.→Engineering ToolsPoE Power Budget CalculatorCameras by type × watts → switch budget, port count and the models that fit, with 20% headroom.→Engineering ToolsNVR Storage CalculatorChannels × bitrate × hours × days → terabytes, drive combination, bandwidth and NVR models with enough bays.→Buyer's GuidesHow to Choose a PoE Switch for IP CamerasPort count, PoE budget, 250m extend mode and the four mistakes that kill CCTV projects.→Buyer's GuidesSecurity Camera Guide: PoE, WiFi or 4G Solar?Power and network first, resolution second, night vision third — with the DORI habit that saves projects.→Buyer's GuidesTracking Large Model: Auto-Tracking That Holds OnWhy trackers drift and lose IDs behind obstacles — and how attention, distillation and confidence-based updates fix it.→Buyer's GuidesHow to Choose an NVR: Channels, PoE, Bays and AIRetention math, incoming bandwidth and when AI on the recorder is actually worth paying for.→Buyer's GuidesLED Display Guide: Pitch, Brightness, LocationMetres≈millimetres, the shop-window trap, COB vs SMD, and the five numbers a complete enquiry needs.→Buyer's GuidesCCTV Storage: HDDs and MicroSD Done RightRetention day math, P/E endurance cycles, and the silent failures that eat footage.→
Cross-Vendor Interop
Cross-Vendor InteropHuawei-to-Cisco IPSec VPN TunnelConfiguring a Huawei-to-Cisco IPSec tunnel — and the 5 cross-vendor gotchas that break traffic even after it shows “up”.→Cross-Vendor InteropIPSec Behind NAT / Dynamic IP: Huawei to CiscoBuilding a stable branch tunnel to a Cisco HQ when the branch sits on a dial-up dynamic IP behind NAT — aggressive mode, NAT-T and policy templates.→Cross-Vendor InteropDSVPN over IPSec: Huawei Spokes, Cisco HubHub-spoke branch VPN with direct spoke-to-spoke traffic — mGRE, NHRP registration and IPSec profile binding on both vendors.→Cross-Vendor InteropIPSec via Virtual Tunnel InterfaceRoute-driven IPSec with a VTI instead of policy ACLs — when to choose it, full Huawei + Cisco configs, and why “tunnel up” still isn't proof.→Cross-Vendor InteropHuawei AR to Fortinet FortiGate IPSecAligning IKE/IPSec parameters between a Huawei branch router and a FortiGate HQ firewall — the naming differences that break negotiation.→Cross-Vendor InteropOSPF Between Huawei and CiscoBroadcast-network OSPF across vendors — network-type defaults, timers, DR/BDR election and reference-bandwidth cost pitfalls.→
Troubleshooting
TroubleshootingIPSec Tunnel TroubleshootingA fault-tree flowchart and the 6 root causes behind most “tunnel's up but traffic won't pass” IPSec tickets.→TroubleshootingOSPF Neighbor TroubleshootingReading the OSPF neighbor state machine to find the fault — and the 5 root causes behind most stuck neighbors and route flaps.→TroubleshootingDSVPN Spoke Won't RegisterNHRP registration fault tree with real debug traces — the root causes behind spokes that never appear on the hub.→TroubleshootingRouter Password RecoveryConsole, Telnet and BootROM recovery paths compared — a decision tree for getting back in without losing the config.→TroubleshootingLocked Out: When All Logins FailTelnet, SSH and Console all dead on a live router — layer-by-layer triage to restore access while protecting running services.→TroubleshootingVPN Tunnel Up but Ping FailsGRE encapsulation vs routing: the diagnosis order that finds why tunnel interfaces can't reach each other.→
Configuration
ConfigurationEasy IP NAT for Small OfficesOne public IP, a whole office online — Easy IP step by step, plus NAT Server port mapping done right.→ConfigurationDual-WAN Failover and Load SharingTwo uplinks, zero single point of failure — primary/backup vs load-sharing configs and how to prove the switchover works.→ConfigurationSite-to-Site VPN Options ComparedL2TP, GRE, DSVPN, IPSec or MPLS? A decision tree with the core config skeleton for each of the 7 technologies.→ConfigurationBranch VPN: Wired Primary + 4G BackupStores, ATMs and vending terminals that must never drop — dual-tunnel VPN with NQA-tracked automatic failover.→ConfigurationSmall Office Network from ScratchRouter, switch and wireless for a 10–30 person site in one pass — VLANs, DHCP, Wi-Fi and the order that avoids rework.→ConfigurationOSPF Basic ConfigurationSingle area to multi-area with ABR and stub — area planning, network statements and verification.→
Maintenance
MaintenanceFault Info to Collect Before You EscalateThe command outputs and logs that make any troubleshooting — or vendor support case — twice as fast, by fault type.→MaintenanceDangerous Commands ChecklistThe router and switch operations that can take a live network down — risk tiers, safer alternatives, change-window discipline.→MaintenanceSwitch Routine Health CheckA 5-step inspection routine — environment, basics, running status, ports, services — with pass criteria for each step.→MaintenanceNetwork Acceptance TestingFrom delivery check to final sign-off — what to test at each stage and what counts as a pass.→MaintenanceTaking Over an Unknown NetworkThe first-day checklist — version and config baselines, health snapshot, risk scan and handover records.→MaintenanceFirewall Upgrade Without DowntimeBackup, upgrade and rollback discipline — hot-standby sequencing and the post-upgrade verification list.→
Security
SecurityAntiDDoS Defense Not WorkingDiversion state, detection thresholds and resource exhaustion — the full chain that decides whether attacks actually get scrubbed.→SecurityAntiDDoS Device Shows OfflinePassword expiry, account lockout and SSH algorithm mismatch — the six-layer diagnosis that brings management back.→SecurityAntiDDoS CLI Diagnostics ToolkitAlarms, the 12 real interface-down reasons, session tables, license states and BGP diversion — grouped by scenario.→SecurityAntiDDoS Blocking Good TrafficEmergency bypass for out-of-path and in-line deployments — stop the bleeding first, tune thresholds after.→SecurityWAF Blocking Your Web AppSite down or rule false-positive? The two-branch diagnosis — 403s, silent blocks and URL whitelisting done right.→SecurityWAF SSL Certificate ConversionJKS, PFX and PEM — the real keytool/openssl commands to convert, chain and verify certificates for import.→
All articles
- Tracking Large Model: Auto-Tracking That Holds On
- How to Import CCTV from China
- Grow Your CCTV Installation Business
- Solar 4G Cameras for Off-Grid Sites
- How to Choose a PoE Switch for IP Cameras
- Security Camera Guide: PoE, WiFi or 4G Solar?
- How to Choose an NVR: Channels, PoE, Bays and AI
- LED Display Guide: Pitch, Brightness, Location
- CCTV Storage: HDDs and MicroSD Done Right
- Huawei-to-Cisco IPSec VPN Tunnel
- IPSec Behind NAT / Dynamic IP: Huawei to Cisco
- DSVPN over IPSec: Huawei Spokes, Cisco Hub
- IPSec via Virtual Tunnel Interface
- Huawei AR to Fortinet FortiGate IPSec
- OSPF Between Huawei and Cisco
- IPSec Tunnel Troubleshooting
- OSPF Neighbor Troubleshooting
- DSVPN Spoke Won't Register
- Router Password Recovery
- Locked Out: When All Logins Fail
- VPN Tunnel Up but Ping Fails
- SD-WAN Tunnel Won't Come Up
- Portal Authentication Fails
- Slow Internet Behind NAT
- OSPF Convergence: Broadcast vs P2P
- Layer 2 Loop Storm
- PoE Camera or AP Won't Power Up
- Devices Can't Get an IP Address
- Switch CPU Utilization High
- Ethernet Port Physically Down
- 4G/5G Backup Link Won't Connect
- Router Won't Boot
- Wi-Fi Users Can't Authenticate
- Firewall Session, NAT and Policy Faults
- 802.1X / NAC Authentication Failures
- Network Packet Loss Diagnosis
- VXLAN Overlay Faults
- M-LAG Faults and Split-Brain
- PEN Optical Module Diagnostics
- PEN Port Won't Link Up
- PEN Dual-Uplink Eth-Trunk Errors
- IPTV Freezing & CCTV Mosaic
- PIM Neighbor Down & Dual-DR
- Chassis Failover Killed All APs
- BGP Neighbor Down & Route Flapping
- MPLS L3VPN PE-CE Faults
- IS-IS Neighbor & MTU Mismatch
- GRE Tunnel Won't Establish
- ARP Spoofing & Learning Failures
- NAT Server Mapping Dead
- EVPN Route Not Learned
- VXLAN Tunnel Won't Establish
- Spine-Leaf Fabric Packet Loss
- VXLAN Tunnel Up→Down Runbook
- SSH Login Failures Decoded
- Device Won't Onboard to Controller
- Switch & AP Registration Error Codes
- Wi-Fi Clients Dropping Randomly
- Mass AP Disconnection: TC-BPDU Storm
- Authentication “Fake Offline” Diagnosis
- VRRP Dual-Master & Failover Faults
- BFD One-Arm Echo Won't Come Up
- Router CPU & Memory High
- Terminal Fingerprinting Gone Wrong
- Finding Rogue Hubs and Routers
- Microbursts: Invisible Congestion
- CRC Errors: The Three-Step Swap
- SOHO Gear Won't Reach the Cloud
- Why Is the Wi-Fi Slow?
- IP Source Guard Dropping Good Packets
- ACL Resources Exhausted
- Traffic Policy Not Taking Effect
- App Recognition Slowing Your Switch
- Switch Won't Power On
- Replacing Another Vendor's Switch
- Easy IP NAT for Small Offices
- Dual-WAN Failover and Load Sharing
- Site-to-Site VPN Options Compared
- Branch VPN: Wired Primary + 4G Backup
- Small Office Network from Scratch
- OSPF Basic Configuration
- Policy-Based Routing
- WLAN Deployment from Zero
- Seamless Wi-Fi Roaming
- Hospital Wi-Fi + IoT on One Network
- Firewall Security Policy + IPSec VPN
- Fault Info to Collect Before You Escalate
- Dangerous Commands Checklist
- Switch Routine Health Check
- Network Acceptance Testing
- Taking Over an Unknown Network
- Firewall Upgrade Without Downtime
- Data Center Switch Health Check
- DC Switch Diagnostic Commands
- License Activation Failures
- Replacing a Faulty Stack Member
- Zero-Loss M-LAG Pair Upgrade
- Optical Module Selection Handbook
- AntiDDoS Defense Not Working
- AntiDDoS Device Shows Offline
- AntiDDoS CLI Diagnostics Toolkit
- AntiDDoS Blocking Good Traffic
- WAF Blocking Your Web App
- WAF SSL Certificate Conversion
- WAF Link Aggregation Bypass Gotcha
- WAF HA: Heartbeat & Site Faults
- WAF HTTPS Site Faults
- WAF Emergency Bypass Procedures
Have a specific interop or fault problem?
Send it on WhatsApp — I'll point you to the fix.
