Home / Engineering Notes
Engineering Notes
Field notes from 13 years of carrier & enterprise deployments, cross-checked against vendor documentation.
New notes are added continuously — latest: July 2026
Buyer's Guides
Buyer's GuidesHow to Import CCTV from ChinaSamples first, MOQ myths, LCL sea freight vs air, customs prep and regional versions — explained by the factory side.→Buyer's GuidesGrow Your CCTV Installation BusinessThe two-leg strategy, five moves to the next tier, and the skill that separates installers from integrators.→Buyer's GuidesSolar 4G Cameras for Off-Grid SitesHow panel, battery, SIM and TF card work together, cloudy-day autonomy, band matching and the four field failures.→ReferenceCCTV & Networking Glossary62 terms from datasheets, tenders and quotations — PoE budget, ONVIF profiles, WDR, IP67, VLAN, ERPS, Incoterms, RMA — each in two or three sentences with the number that matters.→Engineering ToolsPoE Power Budget CalculatorCameras by type × watts → switch budget, port count and the models that fit, with 20% headroom.→Engineering ToolsNVR Storage CalculatorChannels × bitrate × hours × days → terabytes, drive combination, bandwidth and NVR models with enough bays.→Buyer's GuidesHow to Choose a PoE Switch for IP CamerasPort count, PoE budget, 250m extend mode and the four mistakes that kill CCTV projects.→Buyer's GuidesSecurity Camera Guide: PoE, WiFi or 4G Solar?Power and network first, resolution second, night vision third — with the DORI habit that saves projects.→Buyer's GuidesHow to Choose an NVR: Channels, PoE, Bays and AIRetention math, incoming bandwidth and when AI on the recorder is actually worth paying for.→Buyer's GuidesLED Display Guide: Pitch, Brightness, LocationMetres≈millimetres, the shop-window trap, COB vs SMD, and the five numbers a complete enquiry needs.→Buyer's GuidesCCTV Storage: HDDs and MicroSD Done RightRetention day math, P/E endurance cycles, and the silent failures that eat footage.→
Cross-Vendor Interop
Cross-Vendor InteropHuawei-to-Cisco IPSec VPN TunnelConfiguring a Huawei-to-Cisco IPSec tunnel — and the 5 cross-vendor gotchas that break traffic even after it shows “up”.→Cross-Vendor InteropIPSec Behind NAT / Dynamic IP: Huawei to CiscoBuilding a stable branch tunnel to a Cisco HQ when the branch sits on a dial-up dynamic IP behind NAT — aggressive mode, NAT-T and policy templates.→Cross-Vendor InteropDSVPN over IPSec: Huawei Spokes, Cisco HubHub-spoke branch VPN with direct spoke-to-spoke traffic — mGRE, NHRP registration and IPSec profile binding on both vendors.→Cross-Vendor InteropIPSec via Virtual Tunnel InterfaceRoute-driven IPSec with a VTI instead of policy ACLs — when to choose it, full Huawei + Cisco configs, and why “tunnel up” still isn't proof.→Cross-Vendor InteropHuawei AR to Fortinet FortiGate IPSecAligning IKE/IPSec parameters between a Huawei branch router and a FortiGate HQ firewall — the naming differences that break negotiation.→Cross-Vendor InteropOSPF Between Huawei and CiscoBroadcast-network OSPF across vendors — network-type defaults, timers, DR/BDR election and reference-bandwidth cost pitfalls.→
Troubleshooting
TroubleshootingIPSec Tunnel TroubleshootingA fault-tree flowchart and the 6 root causes behind most “tunnel's up but traffic won't pass” IPSec tickets.→TroubleshootingOSPF Neighbor TroubleshootingReading the OSPF neighbor state machine to find the fault — and the 5 root causes behind most stuck neighbors and route flaps.→TroubleshootingDSVPN Spoke Won't RegisterNHRP registration fault tree with real debug traces — the root causes behind spokes that never appear on the hub.→TroubleshootingRouter Password RecoveryConsole, Telnet and BootROM recovery paths compared — a decision tree for getting back in without losing the config.→TroubleshootingLocked Out: When All Logins FailTelnet, SSH and Console all dead on a live router — layer-by-layer triage to restore access while protecting running services.→TroubleshootingVPN Tunnel Up but Ping FailsGRE encapsulation vs routing: the diagnosis order that finds why tunnel interfaces can't reach each other.→
Configuration
ConfigurationEasy IP NAT for Small OfficesOne public IP, a whole office online — Easy IP step by step, plus NAT Server port mapping done right.→ConfigurationDual-WAN Failover and Load SharingTwo uplinks, zero single point of failure — primary/backup vs load-sharing configs and how to prove the switchover works.→ConfigurationSite-to-Site VPN Options ComparedL2TP, GRE, DSVPN, IPSec or MPLS? A decision tree with the core config skeleton for each of the 7 technologies.→ConfigurationBranch VPN: Wired Primary + 4G BackupStores, ATMs and vending terminals that must never drop — dual-tunnel VPN with NQA-tracked automatic failover.→ConfigurationSmall Office Network from ScratchRouter, switch and wireless for a 10–30 person site in one pass — VLANs, DHCP, Wi-Fi and the order that avoids rework.→ConfigurationOSPF Basic ConfigurationSingle area to multi-area with ABR and stub — area planning, network statements and verification.→
Maintenance
MaintenanceFault Info to Collect Before You EscalateThe command outputs and logs that make any troubleshooting — or vendor support case — twice as fast, by fault type.→MaintenanceDangerous Commands ChecklistThe router and switch operations that can take a live network down — risk tiers, safer alternatives, change-window discipline.→MaintenanceSwitch Routine Health CheckA 5-step inspection routine — environment, basics, running status, ports, services — with pass criteria for each step.→MaintenanceNetwork Acceptance TestingFrom delivery check to final sign-off — what to test at each stage and what counts as a pass.→MaintenanceTaking Over an Unknown NetworkThe first-day checklist — version and config baselines, health snapshot, risk scan and handover records.→MaintenanceFirewall Upgrade Without DowntimeBackup, upgrade and rollback discipline — hot-standby sequencing and the post-upgrade verification list.→
Security
SecurityAntiDDoS Defense Not WorkingDiversion state, detection thresholds and resource exhaustion — the full chain that decides whether attacks actually get scrubbed.→SecurityAntiDDoS Device Shows OfflinePassword expiry, account lockout and SSH algorithm mismatch — the six-layer diagnosis that brings management back.→SecurityAntiDDoS CLI Diagnostics ToolkitAlarms, the 12 real interface-down reasons, session tables, license states and BGP diversion — grouped by scenario.→SecurityAntiDDoS Blocking Good TrafficEmergency bypass for out-of-path and in-line deployments — stop the bleeding first, tune thresholds after.→SecurityWAF Blocking Your Web AppSite down or rule false-positive? The two-branch diagnosis — 403s, silent blocks and URL whitelisting done right.→SecurityWAF SSL Certificate ConversionJKS, PFX and PEM — the real keytool/openssl commands to convert, chain and verify certificates for import.→
Have a specific interop or fault problem?
Send it on WhatsApp — I'll point you to the fix.