eNSP Setup Guide - HUAWEI

eNSP is Huawei’s free network simulator. If you are studying for HCIA, it is the easiest way to try routers and switches without buying hardware. But installing it is not just “Next, Next, Finish”. I wiped my laptop and installed everything from scratch, and I hit an error at almost every step. In this post I put the downloads first, then what it does and how to use it, and finally everything that went wrong for me.

Downloads

The 5 tricky points first

If you don’t want to read the rest, remember these:

1. Install VirtualBox 5.2.x; a newer version (6.x, 7.x) makes eNSP say “not supported”.
2. WinPcap must be the real 4.1.3. When installing Wireshark, leave “WinPcap API-compatible Mode” unchecked on the Npcap screen, or it overwrites the real WinPcap.
3. Turn off Memory integrity and VBS/the hypervisor. This is the most common cause of Error 40 (section 7).
4. Grant write permission on C:\Program Files\Huawei\eNSP\VBoxServer, otherwise the VM closes before it starts.
5. Allow two files in the firewall (eNSP_Client.exe, eNSP_VBoxServer.exe), on both Private and Public networks.

When you get an error, ignore eNSP’s “Error 40”; it tells you nothing. Open VirtualBox, click AR_Base, and press Start. The real error shows up there.

What is eNSP and what is it for?

Think of eNSP as a shop window: the interface where you drag routers and draw cables. Every router behind the window is actually a small virtual machine running inside VirtualBox. When you say “start AR1”, VirtualBox quietly boots a VM in the background. VirtualBox is the engine room, eNSP is the window.

What it’s good for:

• Practicing the command line (VRP) of Huawei routers, switches, firewalls and WLAN devices without real hardware.
• Practicing the lab parts of exams like HCIA: VLAN, OSPF, ACL, NAT and so on.
• Saving a topology and continuing later.

What it isn’t good for:

• It doesn’t give you real hardware performance, only command and behavior simulation.
• The images for carrier-class devices like the NE40E don’t ship with the installer; you have to get them separately. The AR series works out of the box.

Details: installation and errors

1. VirtualBox version: 5.2.x only

eNSP was built to work with VirtualBox 5.2.x. If you install a newer version, it may say “VirtualBox version is not supported” on startup. After installing, open VirtualBox and check Help → About to confirm the version.

2. Install order and the WinPcap/Npcap clash

The order is: WinPcap 4.1.3 → Wireshark → VirtualBox 5.2.44 → eNSP. Leave eNSP for last because its installer checks the other three.

This is where I got my first error. The eNSP installer said:

It is detected that WinPcap has not been installed on your computer.

When I tried to install WinPcap, I got:

A newer version of WinPcap (internal version 5.1.78.1018) is already installed on this machine.

The cause: Npcap, which ships with Wireshark, presents itself as a newer WinPcap when installed in “WinPcap compatible mode” and blocks the real WinPcap from installing. It also doesn’t show up as “WinPcap” in the installed programs list.

Fix:

1. Remove Npcap (and WinPcap/Wireshark if present) from Settings → Apps, then reboot.
2. Install WinPcap 4.1.3 first, as administrator.
3. Then install Wireshark, and on the Npcap screen leave “WinPcap API-compatible Mode” unchecked.

3. No special characters in install paths

The eNSP installer says it plainly: do not install VirtualBox into a folder with non-English characters (like Turkish ş, ı, ğ, ü, ö, ç). If your user folder has such characters, move VirtualBox’s VM folder (File → Preferences → General) to a plain path like C:\VBoxVMs.

4. Windows 11 says “This app can’t run on your device”

After the format, opening the VirtualBox 5.2.44 installer gave me:

This app can’t run on your PC because it causes security or performance problems on Windows.

This is Windows blocking it, not VirtualBox. According to Microsoft’s documentation, Windows 11 has a compatibility hold for older VirtualBox versions because they can’t start VMs while Hyper-V/the hypervisor is present. Oracle fixed this in 6.1.28 and later, so 5.2.x stays on the blocked list.

5. Firewall permission

On first launch, eNSP says:

Please add eNSP related applications to the list of Windows firewall’s allowed programs, and allow them to run on a public network!

Fix: Control Panel → Windows Defender Firewall → “Allow an app” → Change settings → Allow another app. Add these two files:

• eNSP_Client.exe
• vboxserver\eNSP_VBoxServer.exe

Both should have Private and Public checked in the list.

6. Write permission on Program Files

I started a router and got Error 40. When I started AR_Base directly from VirtualBox, I saw:

The VM session was closed before any attempt to power it on.

The real cause was in VirtualBox’s log file (C:\Users\<user>\.VirtualBox\VBoxSVC.log): eNSP installs its base VMs under C:\Program Files\Huawei\eNSP\VBoxServer, and VirtualBox can’t write the .vbox settings file there (Access denied).

Fix (administrator PowerShell; I used a SID instead of the group name because my Windows is in Turkish):

icacls "C:\Program Files\Huawei\eNSP\VBoxServer" /grant "*S-1-5-32-545:(OI)(CI)M" /T /C /Q

After this command the error changed, which meant we had moved on to the next blocker.

7. The real monster: Error 40 and Hyper-V/VBS

When I started AR_Base in VirtualBox, the real error showed up:

Raw-mode is unavailable courtesy of Hyper-V. (VERR_SUPDRV_NO_RAW_MODE_HYPER_V_ROOT)

Windows virtualization-based security (VBS) runs a hypervisor in the background, and VirtualBox 5.2 cannot reach hardware virtualization. Turning off Hyper-V in Windows Features was not enough, because something else was keeping the hypervisor alive. After a fresh install, VBS comes back enabled.

To check the state:

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select VirtualizationBasedSecurityStatus

If it says 2, VBS is running. My fix (administrator PowerShell):

bcdedit /set hypervisorlaunchtype off
bcdedit /set vsmlaunchtype off
reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f

On top of these, turn off Memory integrity under Windows Security → Device security → Core isolation, then reboot. The check command should now return 0.

Warning: These settings turn off some of Windows’ security layers (including the advanced protection of Windows Hello; you may need to set up your PIN again). Do this only on a lab machine. If someone manages policy on your work computer, ask them first.

Checklist

• WinPcap 4.1.3 (the real one, not Npcap)
• VirtualBox 5.2.44, no special characters in the path
• eNSP installed last
• Firewall: eNSP_Client.exe and eNSP_VBoxServer.exe allowed (Private + Public)
• Write permission granted on the VBoxServer folder
• Memory integrity off, VBS/hypervisor off (VirtualizationBasedSecurityStatus = 0)
• AR_Base starts from VirtualBox
• Two AR routers start in eNSP and the console shows <Huawei>