Huawei NetEngine AR8700‑12 Enterprise Router Full Product Description

1. Short Overview

Naming & Variant Breakdown

• AR8700‑12: Mainstream AC‑powered flagship SKU, 3U chassis, dual hot‑swappable MPUs,12×SIC slots, high‑density fixed 40GE/10GE/GE composite ports, dual 1+1 redundant AC power supplies
• AR8700‑12‑DC: Negative DC telecom‑grade power variant for IDC and central‑office cabinet deployment

Note: AR8700‑12 does not come with native TPM 2.0 hardware chip. If hardware‑protected key storage is required, select AR8140‑T series. Compared with AR8700‑8, AR8700‑12 provides more SIC expansion slots, higher switching capacity and improved service processing capability for larger‑scale hub‑spoke SD‑WAN tunnel termination.

Core Differentiators vs AR8700‑8

1. Multi‑service forwarding throughput reaches40 Gbps (NAT+ACL+QoS, IMIX); SD‑WAN IPsec throughput up to 32 Gbps (IMIX)
2. High‑density fixed uplink: 2×40GE QSFP+, 12×10GE SFP+, 12×GE Combo; all ports configurable as WAN/LAN interfaces
3. Separated control‑forwarding plane, dual hot‑swappable MPU for control‑plane redundancy, 3+1 redundant fan design
4. 12×SIC expansion slots, supporting up to 6 WSIC wide slots, providing massive legacy interface access capability
5. Built‑in WAC wireless controller: default manages 32 APs, maximum supports 1024 Wi‑Fi5/Wi‑Fi6/Wi‑Fi7 APs with license upgrade
6. Supports external 5G‑RU for high‑bandwidth 5G cellular uplink backup
7. 3U rack‑mount chassis for super‑large enterprise headquarters and mega‑campus egress scenarios

2. Hardware Interface & Physical Specifications

Modular Expansion Slots

1. 12 × SIC (Smart Interface Card) slots: can be combined into maximum 6 WSIC wide slots for flexible service extension

• Legacy WAN access: E1/T1, fractional E1, serial, G.SHDSL interface modules
• Broadband access: GPON / xGSPON, DSL interface cards
• Wireless backup: 4G‑LTE SIC modules; supports external 5G‑RU for high‑speed 5G WAN uplink
• Auxiliary service: clock synchronization card, BITS timing module for enterprise time‑sync deployment

1. Dual hot‑swappable MPU control units, independent SPU service processing unit; security, VPN and SD‑WAN functions are hardware‑accelerated by onboard NP chipset.

Built‑in Rear Physical Ports

1. Fixed high‑density composite port array

• 2 × 40GE QSFP+ optical ports
• 12 × 10GE SFP+ optical ports
• 12 × GE Combo ports (copper RJ45 or SFP fiber selectable)

All ports support software‑switchable WAN/LAN role, IEEE 802.1Q VLAN trunking, LACP link aggregation, port isolation, storm‑control.

1. 1 × RJ45 Console port for out‑of‑band CLI management (115200 baud default)
2. 1 × USB 3.0 Type‑A port (backward‑compatible USB2.0): configuration backup, log export, system software upgrade via USB storage device
3. No dedicated AUX modem port; remote emergency access is implemented via SIC serial module
4. Chassis ground terminal, rack mounting brackets included
5. Dual hot‑swappable power supply slots (AC or DC power modules); no built‑in PoE output; PoE access depends on downstream PoE switches or PoE‑capable SIC cards.

Memory & Performance Benchmarks

• Processor: ARM multi‑core CPU + dedicated NP forwarding chip with hardware crypto acceleration engine
• Main memory (SPU): 32 GB DDR4; Flash storage (MPU): 8 GB onboard flash for OS image and configuration files
• Switching fabric: non‑blocking large‑capacity architecture
• Forwarding performance (NAT + ACL + QoS, IMIX):40 Gbps
• IPsec VPN throughput: 30 Gbps (IMIX); up to 42 Gbps under 512‑byte packets
• SD‑WAN IPsec performance (IMIX): 32 Gbps; up to 44 Gbps under 512‑byte packets
• Maximum concurrent IPsec / SD‑WAN overlay tunnels: supports ultra‑large‑scale hub‑spoke SD‑WAN tunnel termination
• Supported OS: Huawei V600R022 / V600R023 consolidated system image
• WAC capability: Built‑in wireless access controller, default 32 managed APs, licensed maximum 1024 APs, supports Fit‑AP management, seamless roaming, radio resource scheduling, wireless user authentication

Physical & Power Parameters

• Form factor: 3U standard 19‑inch IEC rack‑mount chassis
• Dimensions (H × W × D, without brackets): 132.5 mm × 442.0 mm × 520.0 mm
• Weight (empty chassis without service cards): approx 21 kg
• Power supply: Dual hot‑swappable power modules with 1+1 redundancy; AC version input 100‑240 V AC 50/60 Hz
• Typical power consumption: 340 W; maximum power consumption: 440 W with full‑loaded service cards
• Redundancy design: dual MPU 1:1 backup, power 1+1 backup, fan 3+1 redundant design
• Operating environment:
  • Operating temperature: 0 °C ~ +45 °C; performance derating above 1800 m altitude
  • Operating humidity: 5 % ~ 95 % non‑condensing
  • Max operating altitude: 5000 m
  • Storage temperature: −40 °C ~ +70 °C
• Acoustic noise: typical 63.5 dB(A)

3. V600 OS Feature Suite

Core Routing & Multi‑WAN Connectivity

• Full IPv4 / IPv6 dual‑stack routing: Static route, RIP, OSPFv2/v3, EIGRP, BGP4/BGP4+, IS‑IS, PIM‑SM‑DM multicast, BFD fast link failure detection
• WAN encapsulation: PPP, HDLC, Frame‑Relay, PPPoE, multi‑link PPP, MPLS L2VPN / L3VPN
• Enterprise‑grade SD‑WAN full feature set: Zero‑Touch Provisioning(ZTP), centralized policy orchestration by iMaster NCE‑Campus, intelligent application‑aware traffic steering, multi‑link link‑quality detection, millisecond‑level link switching, WAN optimization including data‑deduplication and payload compression, SRv6 support with license activation
• NAT services: Static NAT, dynamic PAT, NAT pool, NAT64, CGNAT large‑scale address translation
• Layer‑2 functions: 802.1Q VLAN, LACP link aggregation, MAC address table management, storm‑control, port‑isolation

Integrated Security Features (License‑controlled)

1. Stateful zone‑based firewall, deep L7 application identification and filtering
2. IPS intrusion prevention system: signature‑based threat detection, attack blocking and threat logging; signature database requires subscription license for periodic updates
3. Hardware‑accelerated VPN suite: IKEv1/IKEv2 IPsec site‑to‑site VPN, overlay tunnel, SSL VPN remote access, GET‑VPN, MACsec link‑layer encryption
4. AAA authentication: Local user database, RADIUS, HWTACACS+ for authentication, authorization and accounting
5. Anti‑DDoS defense, ACL filtering, control‑plane protection, URL filtering, threat‑intelligence‑based traffic‑sanitization

Note: TPM 2.0 hardware chip is not equipped on AR8700‑12. Select AR8140‑T for hardware‑protected key‑certificate storage.

QoS & WAN Optimization

• Rich QoS toolkit: CBWFQ, LLQ low‑latency priority queuing, traffic policing & shaping, DSCP / 802.1p marking and re‑marking, application‑aware traffic classification
• SD‑WAN‑oriented link‑efficiency functions: packet compression, data redundancy elimination, FEC forward‑error‑correction for unstable public‑network links
• IFIT in‑situ flow telemetry: end‑to‑end real‑time quality measurement for SD‑WAN paths (requires corresponding license package)

Wireless Controller (Built‑in WAC)

• Centralized management for Fit Wi‑Fi5 / Wi‑Fi6 / Wi‑Fi7 APs
• Capabilities: AP auto‑discovery, radio resource auto‑optimization, seamless 802.11r fast roaming, wireless user access authentication, SSG wireless‑wired gateway function
• AP quantity: default 32 APs free‑of‑charge; expand to maximum 1024 APs via WAC‑user‑quantity license

Management & Automation

• Local management: CLI via RJ45 console port; Web‑GUI web management interface
• Secure remote management: SSHv2, HTTPS, SNMPv2c / v3, NETCONF / YANG open‑API, Telemetry real‑time streaming telemetry
• SD‑WAN orchestration: iMaster NCE‑Campus controller for centralized deployment, policy delivery and whole‑network O&M
• File operations: USB‑based configuration backup/restore, auto‑install remote batch upgrade, system log storage, NTP time synchronization
• Device monitoring: real‑time CPU, memory, port‑traffic, tunnel‑status statistics, alarm reporting

4. Typical Deployment Scenarios

1. Large‑scale SD‑WAN Hub Gateway for group‑enterprise headquarters: AR8700‑12 acts as central hub node terminating massive‑quantity branch SD‑WAN IPsec tunnels. Dual‑MPU, power and fan redundancy guarantees 7×24 non‑stop critical‑service operation. High‑density 40GE/10GE ports connect core switches and multi‑ISP WAN links; built‑in WAC manages headquarters Wi‑Fi APs. iMaster NCE‑Campus delivers unified whole‑network security and SD‑WAN policy for all branches.
2. Super‑large regional‑headquarters egress convergence gateway: Deployed at mega regional hub site, connects MPLS private‑line, broadband internet and 5G‑RU cellular backup link; implements security firewall, remote SSL VPN employee access and local wired‑wireless convergence.
3. Mega‑scale campus network egress router: Serves as internet exit gateway for super‑large campus, undertakes ultra‑high‑volume user NAT, multi‑ISP link load‑balancing, internet‑access security filtering, connects downstream campus core switches.
4. Large multi‑tenant MSP SD‑WAN hub site: For managed‑service providers, provides high‑performance multi‑tenant SD‑WAN hub access for numerous enterprise customers, supports N1 subscription licensing model for flexible service billing.

5. Standard Package Contents of AR8700‑12

Separately‑Sold Optional Accessories

• SIC / WSIC interface cards: E1/T1, serial, GPON/xGSPON, 4G‑LTE, timing‑synchronization modules
• 5G‑RU remote 5G radio unit for high‑speed 5G WAN uplink
• SFP / SFP+ / QSFP+ optical transceivers
• DC power supply modules for DC‑power‑version chassis
• License entitlements: SD‑WAN basic / advanced package, WAC AP‑quantity upgrade license, IFIT telemetry license, threat‑protection signature‑update subscription service

Software Licensing Information

1. SD‑WAN Basic License: ZTP basic orchestration, basic traffic steering, base IPsec VPN capability, base IFIT telemetry
2. SD‑WAN Advanced License: Adds intelligent policy recommendation, advanced application‑aware steering, WAN compression and data‑deduplication, enhanced IFIT function
3. SRv6 Expansion License: Activates SRv6 forwarding capability for next‑generation segment‑routing WAN
4. WAC AP Scale‑up License: Increase maximum manageable AP count from default 32 up to 1024 units
5. Threat‑Protection Subscription License: Periodic signature updates for IPS, URL‑filtering and antivirus function

Short Commercial Catalog Summary