Home / Engineering Notes

Engineering Notes

Real field notes from 13 years of carrier & enterprise deployments — every command here was run on real equipment.

By the AtlasCommTech engineering team · WhatsApp +86 18611683168

New notes are added continuously — latest: July 2026

Cross-Vendor Interop

Cross-Vendor InteropHuawei-to-Cisco IPSec VPN TunnelConfiguring a Huawei-to-Cisco IPSec tunnel — and the 5 cross-vendor gotchas that break traffic even after it shows “up”.→Cross-Vendor InteropIPSec Behind NAT / Dynamic IP: Huawei to CiscoBuilding a stable branch tunnel to a Cisco HQ when the branch sits on a dial-up dynamic IP behind NAT — aggressive mode, NAT-T and policy templates.→Cross-Vendor InteropDSVPN over IPSec: Huawei Spokes, Cisco HubHub-spoke branch VPN with direct spoke-to-spoke traffic — mGRE, NHRP registration and IPSec profile binding on both vendors.→Cross-Vendor InteropIPSec via Virtual Tunnel InterfaceRoute-driven IPSec with a VTI instead of policy ACLs — when to choose it, full Huawei + Cisco configs, and why “tunnel up” still isn't proof.→Cross-Vendor InteropHuawei AR to Fortinet FortiGate IPSecAligning IKE/IPSec parameters between a Huawei branch router and a FortiGate HQ firewall — the naming differences that break negotiation.→Cross-Vendor InteropOSPF Between Huawei and CiscoBroadcast-network OSPF across vendors — network-type defaults, timers, DR/BDR election and reference-bandwidth cost pitfalls.→

Troubleshooting

TroubleshootingIPSec Tunnel TroubleshootingA fault-tree flowchart and the 6 root causes behind most “tunnel's up but traffic won't pass” IPSec tickets.→TroubleshootingOSPF Neighbor TroubleshootingReading the OSPF neighbor state machine to find the fault — and the 5 root causes behind most stuck neighbors and route flaps.→TroubleshootingDSVPN Spoke Won't RegisterNHRP registration fault tree with real debug traces — the root causes behind spokes that never appear on the hub.→TroubleshootingRouter Password RecoveryConsole, Telnet and BootROM recovery paths compared — a decision tree for getting back in without losing the config.→TroubleshootingLocked Out: When All Logins FailTelnet, SSH and Console all dead on a live router — layer-by-layer triage to restore access while protecting running services.→TroubleshootingVPN Tunnel Up but Ping FailsGRE encapsulation vs routing: the diagnosis order that finds why tunnel interfaces can't reach each other.→

Configuration

ConfigurationEasy IP NAT for Small OfficesOne public IP, a whole office online — Easy IP step by step, plus NAT Server port mapping done right.→ConfigurationDual-WAN Failover and Load SharingTwo uplinks, zero single point of failure — primary/backup vs load-sharing configs and how to prove the switchover works.→ConfigurationSite-to-Site VPN Options ComparedL2TP, GRE, DSVPN, IPSec or MPLS? A decision tree with the core config skeleton for each of the 7 technologies.→ConfigurationBranch VPN: Wired Primary + 4G BackupStores, ATMs and vending terminals that must never drop — dual-tunnel VPN with NQA-tracked automatic failover.→ConfigurationSmall Office Network from ScratchRouter, switch and wireless for a 10–30 person site in one pass — VLANs, DHCP, Wi-Fi and the order that avoids rework.→ConfigurationOSPF Basic ConfigurationSingle area to multi-area with ABR and stub — area planning, network statements and verification.→

Maintenance

MaintenanceFault Info to Collect Before You EscalateThe command outputs and logs that make any troubleshooting — or vendor support case — twice as fast, by fault type.→MaintenanceDangerous Commands ChecklistThe router and switch operations that can take a live network down — risk tiers, safer alternatives, change-window discipline.→MaintenanceSwitch Routine Health CheckA 5-step inspection routine — environment, basics, running status, ports, services — with pass criteria for each step.→MaintenanceNetwork Acceptance TestingFrom delivery check to final sign-off — what to test at each stage and what counts as a pass.→MaintenanceTaking Over an Unknown NetworkThe first-day checklist — version and config baselines, health snapshot, risk scan and handover records.→MaintenanceFirewall Upgrade Without DowntimeBackup, upgrade and rollback discipline — hot-standby sequencing and the post-upgrade verification list.→

Security

SecurityAntiDDoS Defense Not WorkingDiversion state, detection thresholds and resource exhaustion — the full chain that decides whether attacks actually get scrubbed.→SecurityAntiDDoS Device Shows OfflinePassword expiry, account lockout and SSH algorithm mismatch — the six-layer diagnosis that brings management back.→SecurityAntiDDoS CLI Diagnostics ToolkitAlarms, the 12 real interface-down reasons, session tables, license states and BGP diversion — grouped by scenario.→SecurityAntiDDoS Blocking Good TrafficEmergency bypass for out-of-path and in-line deployments — stop the bleeding first, tune thresholds after.→SecurityWAF Blocking Your Web AppSite down or rule false-positive? The two-branch diagnosis — 403s, silent blocks and URL whitelisting done right.→SecurityWAF SSL Certificate ConversionJKS, PFX and PEM — the real keytool/openssl commands to convert, chain and verify certificates for import.→

Have a specific interop or fault problem?

Send it on WhatsApp — I'll point you to the fix.

WhatsApp an engineer →