H12-891_V1.0 HCIE-Datacom V1.0 Questions and Answers

Why is Free Mobility Not Based on VLANs or IP Addresses?

Free mobilityin Huawei CloudCampus implementspolicy-based user access controlbased onuser identity (rather than VLANs or IP addresses).

Users canmove across different network locationswhile maintaining their assignedsecurity and access policies.

✅How Free Mobility Works:

Policies are applied based onUser Groupsinstead of VLAN or IP.

UsesGroup-Based Policy Control (GBP)andSoftware-Defined Access (SDA)principles.

❌Incorrect Statement Explanation:

Traditional networks rely on VLANs and IP addresses for segmentation, butFree Mobility applies policies at the user level, allowing seamless access anywhere on the network.

Reference from Huawei HCIE-Datacom Documentation:

Huawei CloudCampus Solution Guide – Free Mobility and Policy Control

HCIE-Datacom Training Material – Identity-Based Networking

To automatically enable MPLS on an interface inSR-MPLS:

Segment routing must be enabled globallyin thesystem view→✅

Segment routing must also be enabled under the IGP process, andIGP (OSPF or IS-IS) must be enabled on the interface→✅

Clarifications:

SRGB (Segment Routing Global Block)configuration defines SID ranges butdoes not trigger MPLS enablement→❌

Static adjacency labelsare advanced options and do not auto-enable MPLS →❌

Correct answers: B, D

TheMPLS headerconsists of:

Label (20 bits)– Label value used for forwarding.

EXP (3 bits)– QoS field (Class of Service).

S bit (1 bit)– Bottom-of-Stack indicator.

TTL (8 bits)–Time-to-Live, similar to the TTL field in the IP header.

Function of TTL in MPLS:

It is used toprevent infinite loops.

Every LSRdecrementsthe TTL by 1.

When TTL reaches0, the packet isdiscarded.

This mirrors the behavior of IP TTL and ensures loop prevention in MPLS networks.

Correct answer: D. This field is used to prevent packet forwarding loops, similar to the TTL field in an IP header.

To analyze this question, let's break down the key concepts and the given LSDB (Link State Database) information from the figure:

Understanding the LSDB Output:

The output shows the OSPF LSDB on R2 with Router ID 10.1.123.2.

Area 0.0.0.0 (Area 0) is displayed along with several Link State Advertisements (LSAs) including Router LSAs, Network LSAs, and Summary LSAs.

Area 0.0.0.1 (Area 1) also displays Router LSAs and a Type 7 LSA (NSSA LSA) with Link-State ID 0.0.0.0.

An External LSA (Type 5) with Link-State ID 0.0.0.0 and AdvRouter 10.1.123.2 is also present.

Analysis of Each Option:

Option A: Area 1 is an NSSA.

Correct.

The presence of a Type 7 LSA (NSSA LSA) in the database indicates that Area 1 is configured as an NSSA (Not-So-Stubby Area).

NSSA allows the injection of Type 7 LSAs for external routes while blocking Type 5 LSAs from entering the area.

Option B: R2 translates Type 7 default route into Type 5 default route.

Correct.

In an NSSA, if an ABR (like R2) has the NSSA ASBR capability, it will convert Type 7 LSAs to Type 5 LSAs before injecting them into the backbone area (Area 0).

In the LSDB, we see both a Type 7 LSA (NSSA) and a corresponding Type 5 External LSA, confirming that R2 performs this translation.

Option C: R2 advertises the default route in the OSPF process.

Incorrect.

There is no indication that R2 itself is originating the default route.

The Type 7 LSA in Area 1 and the Type 5 LSA in Area 0 only indicate translation from another source, not R2 advertising it directly.

Option D: Area 1 does not have Type 3 LSAs. The possible cause is that R2 filters Type 3 LSAs in the outbound direction of Area 1.

Incorrect.

In an NSSA area, Type 3 LSAs (Inter-Area Prefix LSAs) are typically not generated for external routes.

The absence of Type 3 LSAs in Area 1 is due to the nature of NSSA itself rather than any filtering configured on R2.

ForOSPF neighbors to reach Full state, they must exchangeLSAs (Link State Advertisements) properlyand synchronize their databases.

Possible Causes Preventing OSPF from Entering Full State:

✅A. A link works abnormally

If thephysical or Layer 2 linkis unstable,OSPF Hello packetsmay be lost, preventing the Full state.

✅B. The OSPF network types on both ends of the link are inconsistent

OSPF network types (Broadcast, P2P, NBMA, etc.) must matchon both ends.

Example: If one router isP2Pand the other isBroadcast, adjacency issues occur.

✅C. The router IDs of neighbors are the same

Router ID conflicts prevent OSPF adjacencies from forming.

Each router must have aunique Router ID.

✅D. The OSPF MTU values of interfaces on both ends of the link are different

If MTU settings do not match,OSPF Database Description (DD) packets may be dropped, preventing Full state.

Reference from Huawei HCIE-Datacom Documentation:

Huawei OSPF Configuration Guide – Troubleshooting OSPF Neighbor Issues

HCIE-Datacom Study Material – OSPF Adjacency and Route Synchronization

In Huawei’sFree Mobility solution:

Authentication Point (AP): Identifies users and associates them with aSecurity Group Tag (SGT)upon access.

Policy Enforcement Point (PEP): Enforces policiesbetween different security groups, such as allowing or denying traffic.

Key points:

Ais correct — The PEP enforces inter-group access based on defined policies.

Bis incorrect — AP and PEPcan be on separate devices, offering deployment flexibility.

Cis incorrect — Thepolicy enforcementhappens at thePEP, not the AP. AP's job is to authenticate and tag traffic.

Dis correct — AP and PEP can be deployed ondifferent devices.

Correct answers: A, D

✅A. encoding: indicates the character set encoding format. Currently, only UTF-8 encoding is supported.

UTF-8 is the default and only supported character encoding in NETCONF XML.

✅B. /: indicates the end of the current tag.

In XML, closes an element, defining the end of a structure.

✅C.

The

✅D. ?>: indicates the end of an instruction.

Closes theXML declaration.

Reference from Huawei HCIE-Datacom Documentation:

Huawei NETCONF Development Guide – XML Formatting Rules

HCIE-Datacom Training Material – Understanding XML in Network Automation

OSPFv3 Configuration Principles:

OSPFv3, the OSPF version supporting IPv6, differs from OSPFv2 in several aspects:

Interface-based Configuration:

OSPFv3 is configured on interfaces directly, unlike OSPFv2 which uses the network command.

Router ID:

The Router ID is still a 32-bit number, typically represented as an IPv4 address.

It must be explicitly specified since OSPFv3 requires a Router ID for operation, even though it supports IPv6.

Analysis:

A. [R1-GigabitEthernet0/0/1] ospfv3 1 area 0:

Correct. This command enables OSPFv3 process 1 on the GE0/0/1 interface in Area 0.

B. [R1-ospfv3-1] router-id 10.1.1.1:

Correct. This correctly sets the Router ID for OSPFv3 process 1.

C. [R1-ospfv3-1-area-0.0.0.0] network 2001:DB8:2345:12::1 ::

Incorrect. OSPFv3 does not use the network command as in OSPFv2. Instead, OSPFv3 is directly configured on interfaces.

D. [R1] router id 10.1.1.1:

Incorrect. The Router ID should be set within the OSPFv3 process view, not the global configuration view.

Therefore, the correct answers are A and B.

BGP EVPN Route Types in VXLAN:

BGP EVPN Type 2 Route (MAC/IP Advertisement Route)

Used forhost reachability advertisement.

Carries MAC and IP address information of endpoints.

Does not carry an IP Prefix field(Type 5 routes handle prefixes).

Correct Explanation of Answer Choices:✅IP Address (B) is included– Used for host mobility and reachability.✅L3VNI (C) is included– Used forLayer 3 VXLAN routing.✅L2VNI (D) is included– Used forLayer 2 VXLAN bridging.❌IP Prefix (A) is not included in Type 2 routes– It is part ofEVPN Type 5 routesforprefix advertisement.

Reference from Huawei HCIE-Datacom Documentation:

Huawei VXLAN BGP EVPN Configuration Guide – Type 2 vs. Type 5 Routes

HCIE-Datacom Training Material – VXLAN Overlay Networks and BGP EVPN

Huawei’sSD-WAN solutionoffers a full suite of application optimization technologies, including:

Application identification: Uses DPI and traffic signatures to identify applications.

Intelligent traffic steering: Dynamically routes traffic based on application type and real-time link performance.

WAN optimization: Reduces latency, deduplicates traffic, and optimizes throughput for key apps.

QoS: Prioritizes critical applications and ensures bandwidth guarantees.

All listed options are part of the Huawei SD-WAN solutionfor optimizing user experience and application performance.

Correct answers: A, B, C, D

InMPLS VPN, packets are forwarded usingtwo labels:

Outer label (Transport Label)– Used by the MPLS backbone for forwarding.

Inner label (VPN Label)– Used by theegress PEto identify the correct VPN instance.

Explanation of Correct Options:

✅A. The egress PE sends the data packet to the correct VPN based on the inner label.

Theinner label is assigned by the egress PEand determines the final destination VPN instance.

✅B. The penultimate hop removes the outer label before forwarding the data packet to a peer egress PE.

Penultimate Hop Popping (PHP)occurs when thesecond-to-last router(P router) removes the outer MPLS label before forwarding to theegress PE.

This reduces theprocessing overheadon the egress PE.

✅D. The penultimate-hop device receives a packet with an outer label.

Theouter label is used to forward the packet across the MPLS backbone.

Before reaching the egress PE, thepenultimate router still has the outer labeland processes it.

Incorrect Option:

❌C. The IP data packet received by the egress LSR is without labels.

This isincorrectbecause theinner label (VPN label) is still presentwhen the packet reaches the egress PE.

Only theouter labelis removed by PHP, not the inner VPN label.

Reference from Huawei HCIE-Datacom Documentation:

Huawei MPLS VPN Configuration Guide – Label Processing

HCIE-Datacom MPLS Traffic Engineering and PHP Mechanism

Huawei iMaster NCE-Campus MPLS VPN Implementation Guide

Option A: Correct — both terminal and interface security are important.

Option C: Correct —CAPWAP supports DTLSencryption for secure tunnel communication.

Option D: Correct — intranet security design considersboth wired and wireless.

Option B:Incorrect— traffic suppression (such as broadcast suppression) is implemented usingrate limiting or storm control,not by shutting down interfaces. Shutting down interfaces would disrupt legitimate traffic too.

Correct answer: B

Comprehensive and Detailed In-Depth Explanation:

In theCloudCampus public cloud scenario, when devices are deployed through theHuawei registration query center, there isno need to configure DHCP Option 148on the campus network’s DHCP server.

Theregistration query centerautomatically provides thecontroller IP addressto the devices during the registration process.

DHCP Option 148is typically used to provide theiMaster NCE-Campus addressin on-premises or private cloud scenarios.

In thepublic cloud scenario, the devices obtain this information directly from the Huawei cloud platform, makingOption 148 unnecessary.

Link-LSA (Type 8)in OSPFv3 performs the following:

Advertises therouter’s link-local addressto neighbors.

Advertises therouter’s interface IDon the link.

CarriesIPv6 prefixesassociated with the interface (since Router LSA no longer does this in OSPFv3).

TheOptions field in Link-LSAcontainscapabilities of the originating router,notthe options from Network-LSA.

So,Option D is incorrect— the Link-LSA doesnot advertise options from the Network-LSA.

Correct answer: D

Comprehensive and Detailed In-Depth Explanation:

In theiMaster NCE-Campusvirtualized network management platform, devices can be added using various methods:

A. In Batches:Correct. Devices can be added in bulk for efficient management.

B. By Device Role:Correct. Devices can be grouped and managed based on their role (e.g., access, aggregation, core).

C. By Device ESN (Electronic Serial Number):Correct. The ESN uniquely identifies the device within the system.

D. By Device Model:Incorrect. The platform does not use the device model as a primary criterion for adding devices. Instead, devices are typically added byrole, ESN, or batch operations.

From the output:

Tunnel destination IP address: Clearly shown as destination 10.0.1.1 →✅

Tunnel interface MTU: Shown as The Maximum Transmit Unit is 1500 →✅

Tunnel interface IP: Shown as Internet Address is 20.1.1.2/24 →✅

Tunnel source: Tunnel source 10.0.3.3 (LoopBack0) → Not 10.0.1.1 →❌

Therefore:

A— Correct

B— Correct

C— Correct

D— Incorrect (confuses destination as source)

Correct answers: A, B, C

IS-IS Multi-Process:

Huawei devices support runningmultiple IS-IS processes simultaneously.

These processes arecompletely independentof one another: different LSDBs, interfaces, routing tables, etc.

Each process can be associated with aseparate VPN instance, and asingle VPN instance can be served by multiple IS-IS processes.

IS-IS Multi-Instance:

One IS-IS process canrun multiple instances, typically used formulti-VPN scenarios.

However, Huawei's current implementation prefersone VPN per processfor clarity and control.

Based on Huawei’s design:

Ais incorrect — an IS-IS processcanserve multiple VPNs in other vendors, but Huawei typically uses one process per VPN for clean separation.

Bis correct — a VPN instance can be associated withmultiple IS-IS processes.

Cis incorrect in Huawei implementation context.

Dis correct —IS-IS processes are independent.

Correct answers: B, D

Comprehensive and Detailed In-Depth Explanation:

The statementAis incorrect because enablingDHCP snooping in the VLAN viewonly takes effect on interfaces within that specific VLAN that have DHCP snooping configured. It doesnotautomatically apply to all interfaces of the device. Each interface within the VLAN must individually be configured or marked as trusted/untrusted.

B:Correct, as DHCP snooping, when enabled globally without any additional specifications, defaults to processingDHCPv4messages.

C:Correct, as DHCP snooping can protect against DHCP spoofing attacks by marking interfaces astrustedoruntrusted.

D:Correct, enabling DHCP snooping on an interface means it will monitor all DHCP messages on that specific interface.

Comprehensive and Detailed In-Depth Explanation:

In BGP EVPN,Type 2routes (MAC/IP Advertisement routes) are used to advertise:

MAC addressesof endpoints.

ARP entries(MAC-to-IP bindings).

IRB (Integrated Routing and Bridging) routes, allowing the advertisement of both Layer 2 and Layer 3 reachability.

These routes are essential for enabling dynamic VXLAN tunnel establishment and seamless host mobility.

Type 1 (Ethernet Auto-Discovery):Used for multi-homing information.

Type 3 (Inclusive Multicast Ethernet Tag):Used for BUM (Broadcast, Unknown unicast, and Multicast) traffic.

Type 4 (Ethernet Segment):Used for identifying Ethernet segments in multi-homing scenarios.

BGP in Huawei SD-WAN

Huawei SD-WAN usesBGP (Border Gateway Protocol) as the primary routing protocolto exchange VPN routes between Customer Premises Equipment (CPEs) and the controller.

✅Why BGP is Used in SD-WAN?

Scalability: BGP can handle a large number of VPN routes.

Policy-Based Routing: BGP allowstraffic engineering and policy controlacross SD-WAN tunnels.

Multiprotocol Support: Huawei SD-WAN usesMP-BGP to exchange IPv4, IPv6, and VPNv4 routes.

Comprehensive and Detailed In-Depth Explanation:

The traceroute output shows that the path from R1 to the destination 172.17.1.5 is looping. After reaching the IP 10.1.13.1, the path goes back to 10.1.12.2, repeating the previous hops. This indicates a routing loop, where R1 continuously forwards packets through a circular path, never reaching the destination. Routing loops typically occur due to inconsistent or incorrect routing table entries, often because of routing protocol misconfigurations.

Huawei’sOPS (Open Programmability System)enables programmable interactions with devices through Python-based templates. In Huawei's OPS Python environment:

The classOPSConnectionis used to manage device interactions.

It includes methods like:

get()

post(self, uri, req_data)→ used tocreate resources

put(),delete(), etc.

This aligns with RESTful API semantics, and the post() method in the context given is used correctly.

Correct answer: A. TRUE

In BGP EVPN configuration forVXLAN-based networks, Huawei uses the command:

[bgp] advertise l2vpn evpn

This command enables the BGP process toadvertise routes from a VPN instance into the EVPN (L2VPN) address family, which is used for VXLAN control-plane operations like MAC/IP advertisement.

Option A (advertise irbvfi)— invalid command.

Option B (advertise vpnv4)— used for MPLS VPNs, not EVPN.

Option C (advertise irb)— not a recognized Huawei command.

Option Dis the correct and officially used command.

Correct answer: D. advertise l2vpn evpn

In BGP4+ (used for IPv6 routing), the MP_REACH_NLRI attribute is used to advertise reachable routes. The Next Hop field must:

Contain a global unicast IPv6 address

Link-local addresses are not used in MP_REACH_NLRI because they are valid only on a local link and not suitable for inter-AS routing.

RFC 2545 (Multiprotocol Extensions for BGP-4) also states that the Next Hop must be a routable global address.

Therefore:

C. It must be a global unicast address — is correct.

The other options involving link-local addresses are incorrect.

Correct Order for HTTP Request Line:

1. Request Method (e.g., GET, POST)

2. URI (Uniform Resource Identifier) (e.g., /index.html)

3. Protocol Version (e.g., HTTP/1.1)

Request Method

URI

Protocol Version

Comprehensive and Detailed Explanation:

Structure of an HTTP Request Message

An HTTP request message consists of:

1️⃣Request Line → Specifies the request method, the target resource (URI), andthe HTTP version.

2️⃣Headers → Provides additional request details (e.g., Host, User-Agent).

3️⃣Body (optional) → Used in methods like POST for sending data.

Format of an HTTP Request Line:

GET /index.html HTTP/1.1

GET → Request method

/index.html → URI (resource being requested)

HTTP/1.1 → Protocol version

Why Other Fields Are Incorrect?

❌Status Code → This belongs to an HTTP response, not a request.

❌Mixing Headers into the Request Line → Headers should be placed separately after the request line.

Congestion Avoidance in Networking

Congestion avoidance mechanismsprevent packet loss and delayby managing queues before congestion occurs.

Common Congestion Avoidance Techniques:

Weighted Random Early Detection (WRED)– Randomly drops low-priority packets before congestion builds up.

Explicit Congestion Notification (ECN)– Marks packets instead of dropping them to signal congestion.

Queue Management– Techniques likepriority queuing (PQ) and weighted fair queuing (WFQ)help prevent congestion.

Reference from Huawei HCIE-Datacom Documentation:

Huawei QoS Configuration Guide – Congestion Avoidance Technologies

HCIE-Datacom Study Material – Traffic Management and Queue Optimization

To determine R3’s role (Level-1, Level-2, or Level-1-2) based on the provided output of the display ipv6 routing-table protocol isis command on R3, we need to analyze the IS-IS routing information and understand IS-IS hierarchy and behavior, particularly in the context of IPv6 routing. Let’s break it down step by step:

Understanding the IS-IS Levels and Hierarchy:

IS-IS (Intermediate System to Intermediate System) is a link-state routing protocol that supports a two-level hierarchy:

Level-1: Routers within the same area, responsible for intra-area routing. Level-1 routers only maintain routing information for their area and rely on Level-1-2 routers to reach other areas.

Level-2: Routers that form the backbone, connecting different areas for inter-area routing. Level-2 routers maintain routing information across areas.

Level-1-2: Routers that operate both at Level-1 (within their area) and Level-2 (to connect to other areas). These routers act as boundary routers between Level-1 areas and the Level-2 backbone.

A router’s role (Level-1, Level-2, or Level-1-2) determines which types of adjacencies it can form and what routing information it advertises or receives.

Analyzing the Output:

The output shows R3’s IPv6 routing table with routes learned via IS-IS, specifically:

Destination: 2082:EDFC:DDCC::B824:0/127, Protocol: ISIS-L1

This route is learned via IS-IS Level-1 (ISIS-L1), indicating that R3 has a Level-1 adjacency and is receiving or advertising routes within its area.

The next hop (FE80::2E0:FCFF:FE45:6A3E) and interface (GigabitEthernet0/0/0) suggest this route is intra-area.

Destination: 2082:EDFC:DDCC::B891:0/127, Protocol: ISIS-L2

This route is learned via IS-IS Level-2 (ISIS-L2), indicating that R3 has a Level-2 adjacency and is receiving or advertising routes for inter-area or backbone routing.

The next hop (FE80::2E0:FCFF:FE50:406F) and interface (GigabitEthernet0/0/1) suggest this route is for a different area or the backbone.

Both Level-1 and Level-2 routes are present in R3’s routing table, which provides critical insight into R3’s role.

Determining R3’s Role:

Level-1 Routers:

Level-1 routers only participate in Level-1 adjacencies and maintain routing information for their area. They do not have Level-2 routes or adjacencies unless connected to a Level-1-2 router. Since R3 has a Level-2 route (ISIS-L2), it cannot be exclusively a Level-1 router.

Level-2 Routers:

Level-2 routers focus on inter-area routing and typically do not maintain Level-1 routes unless they are also configured as Level-1-2. Since R3 has a Level-1 route (ISIS-L1), it cannot be exclusively a Level-2 router.

Level-1-2 Routers:

Level-1-2 routers operate both at Level-1 (for intra-area routing) and Level-2 (for inter-area routing). They can form adjacencies with both Level-1 and Level-2 neighbors and maintain both types of routes. The presence of both ISIS-L1 and ISIS-L2 routes in R3’s routing table indicates that R3 is participating in both Level-1 and Level-2 adjacencies, making it a Level-1-2 router.

Evaluating Each Option:

A. R3 must be a Level-2 device.

This is incorrect because R3 has ISIS-L1 routes, indicating it is also participating in Level-1 adjacencies, which Level-2-only devices do not do. Level-2 devices focus solely on inter-area routing and do not maintain Level-1 routes.

B. The device role of R3 cannot be determined.

This is incorrect because the presence of both ISIS-L1 and ISIS-L2 routes in the routing table clearly indicates R3’s role. The combination of Level-1 and Level-2 routes confirms R3 is a Level-1-2 router.

C. R3 must be a Level-1-2 device.

This is correct. The routing table shows both ISIS-L1 (Level-1) and ISIS-L2 (Level-2) routes, meaning R3 is operating as both a Level-1 and Level-2 router, which defines a Level-1-2 device.

D. R3 must be a Level-1 device.

This is incorrect because R3 has ISIS-L2 routes, indicating it is also participating in Level-2 adjacencies, which Level-1-only devices do not do. Level-1 devices only maintain intra-area routes and rely on Level-1-2 routers for inter-area reachability.

Additional Considerations:

The Flags: D in the output typically indicates a directly connected route or a route downloaded to the forwarding table, but it does not affect the determination of R3’s IS-IS level.

The preference (15) and cost (20) are standard for IS-IS routes and do not impact the level determination.

In Huawei’s IS-IS implementation, routers can be configured explicitly as Level-1, Level-2, or Level-1-2 using commands like isis level-1-2 under the IS-IS process. The presence of both Level-1 and Level-2 routes confirms R3’s configuration as Level-1-2.

Huawei HCIE-Datacom Context:

According to Huawei HCIE-Datacom documentation, IS-IS routers can operate at different levels, and the routing table’s protocol type (ISIS-L1 or ISIS-L2) indicates the level of adjacency. A router with both Level-1 and Level-2 routes is necessarily a Level-1-2 device, as it participates in both intra-area and inter-area routing.

The display ipv6 routing-table protocol isis command on Huawei devices shows routes learned via IS-IS, and the protocol type (L1 or L2) directly reflects the router’s role in the IS-IS hierarchy.

Conclusion:

Based on the presence of both ISIS-L1 and ISIS-L2 routes in R3’s IPv6 routing table, R3 must be a Level-1-2 device, as it is participating in both Level-1 (intra-area) and Level-2 (inter-area) adjacencies. Therefore, the correct answer is C.

References to Huawei HCIE-Datacom Documents:

Huawei HCIE-Datacom V1.0 Training Material, Chapter on IS-IS Configuration and Hierarchy.

Huawei NE Series Router Configuration Guide, IS-IS Section (Level-1, Level-2, and Level-1-2 Operations).

Huawei Technical Whitepaper on IS-IS Protocol, discussing IPv6 Routing and Level Determination.

OSPF (Open Shortest Path First) Router-LSA (Type 1 LSA)describesall directly connected OSPF linksof a router and their types. Thefollowing link types can appear in a Router-LSA:

Point-to-Point (P-2-P) (B)– Represents adirect connection between two routers.

Virtual Link (Vlink) (C)– Used toconnect an area to the backbone (Area 0)when a direct connection is unavailable.

Stub Network (StubNet) (D)– Represents anetwork with only one exit point(e.g., a loopback interface or passive interface).

Incorrect Option:

TransNet (A) – Incorrect!

Transit networks appear in Network LSAs (Type 2), not Router LSAs.

Reference from Huawei HCIE-Datacom Documentation:

Huawei OSPF Configuration Guide – Router-LSAs and Link Types

HCIE-Datacom Training Material – OSPF LSAs and Topology Advertisement

BGP EVPN Type 2 Route (MAC/IP Advertisement Route)

This route carriesMAC and IP address bindingsto inform remote VTEPs about locally learned endpoints.

Why Use arp collect host enable?

Collects ARP entriesof locally connected hosts.

EnablesBGP EVPN Type 2 route generationto distribute the learned ARP information.

Incorrect Answer Explanations:❌A. mac-address xxxx-xxxx-xxxx– Manually configures a MAC address butdoes not enable ARP collection for EVPN Type 2 routes.❌B. arp-proxy enable– Enables ARP Proxy butdoes not advertise ARP information using BGP EVPN.❌D. arp distribute-gateway enable– Used inDistributed Anycast Gateway (DAG) modebutnot for collecting host ARP data.

Reference from Huawei HCIE-Datacom Documentation:

Huawei VXLAN EVPN Configuration Guide – ARP Handling and EVPN Type 2 Routes

HCIE-Datacom Training Material – VTEP ARP Advertisement in VXLAN Networks

WRED (Weighted Random Early Detection)helpsprevent congestionby randomly discarding packetsbefore buffers are full.

Drop Probability Behavior:

Below lower threshold=0% drop(packets pass normally).

Between lower & upper threshold=Progressively increasing drop probability.

Above upper threshold=100% drop (probability = 1).

✅Reference:Huawei HCIE-Datacom Guide - WRED Mechanism

BGP EVPN in VXLAN Tunneling

✅A. MP_REACH_NLRI is used to carry routing information.

MP_REACH_NLRI (Multiprotocol Reachable Network Layer Reachability Information)is used inBGP updatesto carryVXLAN reachability information.

✅B. Several BGP EVPN routes are defined through BGP extension.

BGP EVPN introduces multiple route types, such asType 2 (MAC/IP Advertisement), Type 3 (Inclusive Multicast), and Type 5 (IP Prefix Advertisement).

✅D. MP_REACH_NLRI is used to carry the RT.

RT (Route Target) defines route import/export policies in VPN environments.

MP_REACH_NLRI carries the RT attributein BGP EVPN updates.

❌Incorrect Answer:

❌C. MP_REACH_NLRI is used to carry the RD.

Wrong!TheRoute Distinguisher (RD)is carriedinside BGP attributes, but not in MP_REACH_NLRI.

Reference from Huawei HCIE-Datacom Documentation:

Huawei VXLAN BGP EVPN Configuration Guide – BGP EVPN Route Types

HCIE-Datacom Training Material – VXLAN Dynamic Tunnel Establishment

Dynamic VLAN Authorization in Huawei CloudCampus

Dynamic VLAN assignmentallows users to be placed into specific VLANsbased on authentication methods, ensuring security and network segmentation.

Correct Explanations:

✅A. Wired users using 802.1X authentication receive VLAN assignments dynamically.

After authentication,the access control system (e.g., iMaster NCE-Campus)assigns VLANs dynamically.

✅C. Wireless users using 802.1X authentication also receive VLAN assignments.

Similar to wired users,wireless 802.1X authentication allows dynamic VLAN assignmentvia the RADIUS server.

✅D. Wired users using MAC authentication can receive VLAN assignments.

If a userdoes not support 802.1X, MAC authentication can still be used to assign VLANs dynamically.

Incorrect Statement Explanation:

❌B. When wireless users pass Portal authentication, they join the authorization VLANs delivered to edge nodes.

Wrong!InPortal authentication, VLAN assignmentis not dynamically deliveredbecausePortal authentication typically applies access policies, not VLAN changes.

Dynamic VLAN assignment is mainly used with 802.1X or MAC authentication.

Reference from Huawei HCIE-Datacom Documentation:

Huawei CloudCampus Configuration Guide – Dynamic VLAN Assignment and Authentication

HCIE-Datacom Training Material – VLAN Authorization in Virtualized Campus Networks

Analyzing the Routing Table Output:

The command display ipv6 routing-table protocol isis showsall IPv6 routes learned via IS-IS.

The output shows"Summary Count: 6", meaning R1 hassix IS-IS IPv6 routes.

Explanation of Correct Answers:✅A. R1 has six IS-IS IPv6 routes.

The "Summary Count: 6" confirms thatsix IS-IS IPv6 routes existin R1's routing table.

✅C. IS-IS IPv6 must have been enabled on GigabitEthernet0/0/1 of R1.

Theinterface GigabitEthernet0/0/1is listed as thenext-hop, meaning IS-IS IPv6 must beenabled on that interface.

✅D. R1 is not a Level-1 device.

The protocol is listed as"ISIS-L2", indicating that R1 is anIS-IS Level-2 (backbone) router,not a Level-1 router.

Incorrect Answer Explanation:❌B. R1 does not have IS-IS IPv6 routes.

Wrong!The output clearlyshows six IS-IS IPv6 routes, proving this statement false.

Reference from Huawei HCIE-Datacom Documentation:

Huawei IPv6 Routing Protocols Guide – IS-IS for IPv6

HCIE-Datacom Routing & Switching Training – IS-IS L1 & L2 Operations

Huawei IS-IS Configuration Guide – IPv6 Route Management

✅Hypertext Transfer Protocol (HTTP) is an application-layer protocolused for:

Accessing web pagesand hypermedia content.

Client-server communication over the internet.

Stateless communication with request-response architecture.

Key Features of HTTP:

Application Layer Protocolin theTCP/IP model.

UsesTCP (Port 80) and HTTPS (Port 443)for secure communication.

SupportsREST APIs, web applications, and cloud services.

Reference from Huawei HCIE-Datacom Documentation:

Huawei Network Protocol Guide – HTTP and Web Services

HCIE-Datacom Study Material – Application Layer Protocols in TCP/IP Model

Comprehensive and Detailed In-Depth Explanation:

A. Correct:OPS can use themaintenance assistantto triggerPython scriptsperiodically or based on events.

B. Correct:OPS supportsautomatic deploymentusing Python scripts to download software and configuration files.

C. Incorrect:OPS doesnot inherently provide local storagefor temporarily saving execution results when the network is disconnected. This would require additional programming logic in the script itself, which is not a built-in feature of OPS.

D. Correct:OPS can run scripts toautomatically check device healthand report the status.

Therefore, the incorrect statement isC.

Comprehensive and Detailed In-Depth Explanation:

When configuring avirtualized campus networkoniMaster NCE-Campus, the platform supports automatic delivery of routing policies when connecting to external networks, including the Internet.

This feature ensures that traffic destined for external networks isautomatically directed to the appropriate egress points.

TheNCE-Campusautomatically creates and delivers thedefault routeor specific routes, depending on the network topology and configuration.

This simplifies network management by eliminating the need for manual route configuration on each device.

Therefore, the statement isTRUE.

HuaweiiMaster NCE-Campusprovidesopen APIsfor seamless integration with third-party applications and services. Each API serves a specific purpose in managingnetwork security, operations, analytics, and user interactions.

1. Authentication and authorization → Third-party authentication API

This API is used to integrate third-party authentication systems, such as:

LDAP (Lightweight Directory Access Protocol)

RADIUS (Remote Authentication Dial-In User Service)

OAuth/OpenID authentication

It ensures secureuser identity verification, access control, and single sign-on (SSO)in CloudCampus networks.

2. Network O&M → Infrastructure API

TheInfrastructure APIprovides tools fornetwork monitoring, diagnostics, and automated management.

It is used for:

Device status monitoring

Network topology visualization

Fault detection and real-time alerts

Performance optimization

3. LBS (Location-Based Services) → LBS API

TheLBS APIenables applications to accesslocation datacollected by the network.

It is used for:

Tracking users or assets within a campus network

Heatmap generation and movement analytics

Geo-fencing and location-based policies

4. Crowd profiling → VAS API

VAS (Value-Added Services) APIis designed foradvanced analytics and business intelligence.

It supports:

User behavior analytics

Demographic profiling

Marketing strategies based on network usage patterns

Reference from Huawei HCIE-Datacom Documentation:

HCIE-Datacom Training Guide – CloudCampus Solution

Huawei iMaster NCE-Campus API Documentation

Huawei CloudCampus Solution Whitepaper – Open API and Use Cases

Comprehensive and Detailed In-Depth Explanation:

AfterPortal authenticationon a wireless network, the following parameters can be used for authorization:

free-rule (A):Allows traffic even before authentication.

UCL (B):User Control List, specifying user permissions.

ACL (D):Access Control List, defining permitted or denied traffic.

TheIP address (C), however, isnot used as an authorization parameterdirectly. Instead, IP addresses are typically assigned after successful authentication, and the control policies are applied based on user profiles or access lists.

Comprehensive and Detailed In-Depth Explanation:

Blackhole MAC address configuration is a security feature that helps protect a network from MAC address spoofing or attacks involving untrusted MAC addresses. When you configure a MAC address as ablackhole MAC address, any packet received with that address as the source or destination will be immediately discarded by the device.

This feature is useful in scenarios where certain MAC addresses are identified as malicious or untrusted. By adding these MAC addresses to the blackhole list, the device effectively blocks communication involving these addresses, thereby mitigating security risks.