H12-841_V1.5 HCIP-Datacom-Campus Network Planning and Deployment V1.5 Questions and Answers

In a VXLAN-based campus or data center network, different node roles are defined to ensure proper traffic forwarding between traditional networks, the VXLAN overlay, and external networks. According to HCIP Datacom Campus Network documentation,edge nodes(also known as VTEPs) are responsible for encapsulating and decapsulating traffic between traditional Layer 2 or Layer 3 networks and the VXLAN overlay network. This allows legacy networks to communicate with virtualized VXLAN segments.

However, when traffic needs to leave the VXLAN fabric and accessexternal networks, such as a WAN, Internet, or another non-VXLAN domain, theborder nodeis used. The border node sits at the boundary of the VXLAN fabric and provides interconnection between the VXLAN network and external routing domains. It performs functions such as VXLAN termination, route advertisement, and traffic forwarding between overlay and underlay or external networks.

In BGP EVPN-based VXLAN deployments, the border node typically participates in BGP routing to exchange reachability information with external devices, ensuring seamless communication between VXLAN tenants and outside networks. This architectural separation improves scalability, simplifies network design, and enhances control over traffic entering or leaving the VXLAN fabric. Therefore, the correct node through which a VXLAN network accesses an external network is theBordernode.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In Huawei campus access authentication designs, network access is divided intopre-authentication,isolation, andpost-authenticationdomains to control user access at different stages of authentication.

Thepre-authentication domainprovides users with only the most basic network services required to initiate authentication. These services typically includeDHCPandDNS. DHCP allows unauthenticated terminals to obtain IP addresses and basic network parameters, while DNS enables domain name resolution so that users can reach authentication portals or admission servers. Therefore,DHCP and DNS servers are essential components of the pre-authentication domain, making optionsC and D correct.

AnFTP serveris a general-purpose file transfer service and is not required for user authentication. Anantivirus serverbelongs to theisolation domain, where users are redirected if authentication fails or if their devices do not meet security posture requirements, such as outdated virus signatures. These servers provide remediation resources but are not part of the pre-authentication process.

According to HCIP Datacom Campus Network documentation, limiting the pre-authentication domain to only essential services reduces security risks while ensuring successful user onboarding.

iMaster NCE-Campus adopts amulti-plane architectureto improve system security, scalability, and operational stability. The planes are logically isolated so that different types of traffic and functions do not interfere with each other. The two most commonly referenced planes are themanagement planeand theservice plane.

Themanagement planeis mainly responsible for system-level operations such as device registration, controller maintenance, system management, and internal communication between system components. For this purpose, it uses a dedicated access interface and port number to ensure secure and stable management connectivity.

Theservice plane, on the other hand, is designed fordaily network service operations. Administrators access this plane to perform tasks such as campus network planning, configuration delivery, monitoring, alarm viewing, and intelligent O&M operations. To keep service access independent and secure, the service plane uses its own dedicated login port.

According to HCIP Datacom Campus Network documentation, theservice plane of iMaster NCE-Campus uses port 18009. Administrators log in to the service plane by accessing the service IP address together with this port number. This separation ensures that service operations remain available even when management-plane functions are restricted or under maintenance.

Therefore, the correct port number for theservice planeis18009, making optionBthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In astatic VXLAN tunneldeployment, Huawei devices use anNVE (Network Virtualization Edge) interfaceas the logical tunnel interface for VXLAN encapsulation and decapsulation. The NVE interface represents the VTEP and does not have a one-to-one relationship with Bridge Domains (BDs) or VXLAN tunnels.

AnNVE interface can be associated with multiple VNIs, each corresponding to a different BD. Therefore, when multiple BDs exist on a VTEP,only one NVE interface is required, makingstatement B correctandstatement A incorrect.

In static VXLAN, thedestination VTEP addressesare specified usingingress replication listsunder each VNI. This allows a single NVE interface to establishmultiple VXLAN tunnelsto different remote VTEPs. As a result, there is no requirement to create a separate NVE interface for each tunnel, makingstatement D correctandstatement C incorrect.

According to HCIP Datacom Campus Network VXLAN configuration principles, the correct practice is to createone NVE interface per VTEP, associate multiple VNIs with it, and define remote peers through ingress replication. Therefore, the correct answers areB and D.

In the Huawei CloudCampus Solution, switches must be able toautomatically connect to and be managed by iMaster NCE-Campus. To achieve this, Huawei provides specificdeployment and onboarding modesthat allow switches to discover the controller and establish a management relationship. According to HCIP Datacom Campus Network documentation, Huawei switches supportHuawei registration centerandDHCP Option 148as standard deployment modes.

TheHuawei registration centeris a cloud-based mechanism that enables devices to automatically register with iMaster NCE-Campus after they are powered on and connected to the network. Once registered, the controller can identify, authenticate, and centrally manage the switches without requiring manual configuration. This mode is commonly used in cloud-managed or large-scale deployments where zero-touch provisioning is required.

DHCP Option 148is another supported deployment mode. Through this option, the DHCP server provides the address information of iMaster NCE-Campus to the switch during IP address allocation. After receiving this information, the switch automatically establishes a management connection with the controller. This method is widely used in enterprise campus environments where DHCP services are already available.

In contrast, theWeb interfaceandCLIare local device management methods, not deployment modes in the CloudCampus architecture. They are mainly used for basic configuration, troubleshooting, or initial setup, rather than for controller-based deployment.

Therefore, the correct deployment modes supported by Huawei switches in the CloudCampus Solution areHuawei registration centerandDHCP Option 148.

In Huawei CloudCampus wireless solutions for small- and medium-sized campus networks,refined traffic controlmeans the ability to precisely limit and manage bandwidth consumption at theindividual user level. Among the available rate limiting modes,user-based rate limitingis specifically designed to meet this requirement.

User-based rate limiting applies bandwidth control policiesper authenticated user, regardless of which SSID, AP, or radio the user is connected to. This allows administrators to ensure fair bandwidth allocation, prevent a single user from monopolizing wireless resources, and provide differentiated service levels for different user roles, such as employees, guests, or VIP users. This fine-grained control aligns with identity-based access and policy management promoted in HCIP Datacom Campus Network design.

In contrast,SSID-based rate limitingcontrols bandwidth at the service level. It limits total traffic for an entire SSID, which affects all users connected to that SSID collectively, rather than individually.Radio-based rate limitingcontrols bandwidth per radio interface, focusing on wireless resource optimization instead of user-level fairness.ACL-based rate limitingis mainly used for traffic classification and control in wired or advanced scenarios and is not suitable for per-user refined wireless traffic control in CloudCampus WLAN deployments.

Therefore, when the requirement is refined traffic control foreach individual wireless user,user-based rate limitingis the most appropriate and effective option. Hence, the correct answer isA.

In campus network design, theegressis a critical point that connects the internal campus network to external networks such as the Internet or WAN. According to HCIP Datacom Campus Network architecture guidelines, ensuringhigh reliability at the egressis essential, even for small- and medium-sized campus networks, because external connectivity directly affects business continuity.

Deployingmulti-carrier linksat the egress is a recommended design practice to enhance reliability. Multi-carrier links refer to connecting the campus network todifferent service providersor independent external links. If one carrier experiences a failure, congestion, or maintenance issue, traffic can be switched to the backup carrier, ensuring uninterrupted external access. This approach significantly reduces the risk of service disruption caused by single-link or single-carrier failures.

For small- and medium-sized campuses, full redundancy with complex architectures may not be cost-effective. Multi-carrier backup links provide acost-efficient and practical solutionthat balances reliability and investment. Technologies such as static route backup, dynamic routing protocols, or policy-based routing can be used to implement automatic failover at the egress.

HCIP Datacom documentation emphasizes that egress reliability is not only a concern for large networks. Even smaller campuses require stable Internet and WAN access for cloud services, remote access, and centralized management platforms. Therefore, deploying multi-carrier links as backup at the egress is a valid and recommended design strategy.

Hence, the statement isTRUE.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In the Huawei CloudCampus virtualized campus architecture, aVirtual Network (VN)is a logical service container used to isolate different types of services and user traffic. When a VN is created on iMaster NCE-Campus, it is internally mapped to aVPN instanceon network devices. This VPN instance provides traffic isolation at the control plane and forwarding plane levels.

Each VN has its own independent routing table and forwarding context, ensuring that traffic belonging to different services cannot interfere with each other unless explicitly permitted through policy. This mechanism is similar to traditional VPN technologies and is fundamental to service segmentation in VXLAN-based campus networks.

According to HCIP Datacom Campus Network documentation, creating a VN effectively achieves service isolation in the same way as creating a VPN instance. Therefore, the statement is TRUE.

Administrator:

– Defining a Security Group

– Defining a Policy Control Matrix

iMaster NCE-Campus:

– Delivering IP-Group Entries

– Delivering a Policy Control Matrix

In Huawei’s free mobility solution, responsibilities are clearly divided betweenadministratorsandiMaster NCE-Campusto achieve centralized control with automated policy delivery. Administrators are responsible forpolicy and security intent definition, while iMaster NCE-Campus handlesautomatic distribution and enforcement coordination.

Administrators firstdefine security groups, which represent logical user or terminal categories such as employees, guests, or IoT devices. These security groups form the basis of identity-based access control in the campus network. Administrators alsodefine the policy control matrix, which specifies communication permissions between different security groups, such as allow, deny, or redirect. This step represents business intent and security requirements and must be manually planned and configured.

Once these definitions are complete,iMaster NCE-Campus takes over the execution phase. It automaticallydelivers the policy control matrixto authentication points and policy enforcement points, translating high-level policies into device-level configurations. This ensures consistent policy enforcement across the entire campus network.

In addition, iMaster NCE-Campus automaticallydelivers IP-group entries, which bind user IP addresses to security groups. These entries are dynamically generated based on authentication results and are distributed to relevant devices so that traffic can be correctly identified and controlled as users move.

This division of labor aligns with HCIP Datacom Campus Network design principles, enabling simplified administration, reduced manual configuration, and truly seamless free mobility across the campus network.

BGP EVPN is an extension of the BGP protocol designed to support large-scale Layer 2 and Layer 3 virtualization, such as VXLAN-based campus and data center networks. To achieve this, BGP EVPN defines multipleEVPN route typesthrough BGP extensions, including MAC/IP Advertisement routes, Inclusive Multicast routes, Ethernet Segment routes, and IP Prefix routes. Therefore, statement A is correct.

In BGP EVPN, routing information is carried using theMP_REACH_NLRI (Multiprotocol Reachable Network Layer Reachability Information)attribute. EVPN-specific NLRI formats are encapsulated within MP_REACH_NLRI, making statement C correct.

Each EVPN route includes aRoute Distinguisher (RD), which is part of the EVPN NLRI itself. The RD is used to ensure route uniqueness across different EVPN instances. Since the EVPN NLRI is carried inside MP_REACH_NLRI, the RD is effectively carried through MP_REACH_NLRI as well, which makes statement B correct.

Statement D is incorrect.Route Targets (RTs)are not carried in MP_REACH_NLRI. Instead, RTs are transmitted usingBGP extended community attributes, which control route import and export policies between EVPN instances. RTs are used for VPN membership control, not for route reachability advertisement.

In summary, BGP EVPN relies on BGP extensions and MP_REACH_NLRI to transport EVPN routing information and RDs, while RTs are carried separately as extended community attributes. Hence, the correct answers are A, B, and C.

In a VXLAN BGP EVPN deployment, interconnection between Layer 2 and Layer 3 networks relies onIntegrated Routing and Bridging (IRB). According to HCIP Datacom Campus Network documentation, for a VPN instance to advertise its IP routes to the BGP EVPN control plane, the device must explicitly enable IRB route advertisement in the BGP view.

Theadvertise irbcommand is used to allow IP routes learned in a VPN instance to be advertised as EVPN Type 5 (IP Prefix) routes. These routes enable communication between different VNIs or between VXLAN segments and external Layer 3 networks. Without this command, the VPN instance routes remain local and are not distributed through the EVPN control plane, preventing proper Layer 3 connectivity across the VXLAN fabric.

The other options are incorrect in this context. Theadvertise vpnv4command is used in traditional MPLS VPN scenarios, not in BGP EVPN-based VXLAN networks. Theadvertise irbv6command is specific to IPv6 IRB scenarios and does not apply to IPv4 route advertisement unless explicitly required. Theadvertise l2vpn evpncommand is used to enable the EVPN address family itself but does not control the advertisement of IP routes from a VPN instance.

Therefore, to enable a VPN instance to advertise IP routes to the BGP EVPN address family in a VXLAN network, the correct command isadvertise irb.

In the Huawei CloudCampus Solution,device registrationis a key step that allows network devices such as switches, routers, and APs to establish a trusted management relationship withiMaster NCE-Campus. When a device is powered on and configured for cloud or controller-based management, it sends a registration request to the controller using a predefined service port.

According to HCIP Datacom Campus Network documentation,port 18008is used as thedestination portfor device registration requests sent to iMaster NCE-Campus. This port is specifically reserved for device onboarding and registration services, ensuring secure and standardized communication during the initial connection phase. Once the registration is successful, the controller can authenticate the device, assign it to a site, and push management and service configurations.

The other options are not correct in this context.Port 53is used for DNS services and has no role in controller registration.Port 179is used by BGP for routing protocol communication and is unrelated to device management.Port 10020is commonly associated with other management or telemetry functions but is not used for device registration in CloudCampus solutions.

Correctly configuring network connectivity and firewall rules to allow traffic to destination port18008is essential for successful zero-touch provisioning and automatic onboarding of devices. Therefore, the correct destination port number for device registration requests to iMaster NCE-Campus is18008, making optionDthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

To deploy802.1X authenticationon Huawei campus switches and use aRADIUS serverfor user authentication and authorization, several core configuration components are mandatory. All four options listed are required for a complete and functional deployment.

Anauthentication domainis mandatory because it defines where user authentication requests are processed and which AAA schemes are used. Without a domain, the switch cannot determine how to handle authentication requests, makingoption A mandatory.

Anauthentication profileis also required. This profile binds authentication methods (such as 802.1X), authentication domains, and access policies together. Interfaces reference the authentication profile to determine how users are authenticated, sooption B is mandatory.

An802.1X access profiledefines detailed 802.1X parameters, such as authentication mode, reauthentication behavior, and client handling. This profile is bound to interfaces to enable 802.1X authentication on specific ports, makingoption C mandatory.

Finally, anAAA schemeis essential because it defines the authentication, authorization, and accounting methods used by the device, including RADIUS server configuration. Without an AAA scheme, the device cannot communicate with the RADIUS server or obtain user authorization information. Therefore,option D is mandatory.

According to HCIP Datacom Campus Network documentation, all four configuration steps are required to successfully enable 802.1X authentication with RADIUS-based access control.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

DHCP snooping works by distinguishing trusted and untrusted interfaces and controlling DHCP message forwarding behavior. After DHCP snooping is enabled, interfaces connected tolegal DHCP servers must be explicitly configured as trusted interfaces, otherwise DHCP server messages will be blocked. Therefore, statementB is correct.

On untrusted interfaces, the switchdrops DHCP server–type messages, such as DHCP Offer and DHCP ACK, to prevent rogue DHCP servers from assigning incorrect IP addresses. This validatesstatement C as correct.

Statement A is incorrect because DHCP snooping records client binding information mainly fromDHCP ACK messages, not from DHCP Offer messages. The ACK confirms the final IP assignment and lease parameters, making it the authoritative source for the binding table.

Statement D is also incorrect. When the interface connected to a DHCP client goes down, the corresponding DHCP snooping entry is immediately removed, rather than waiting for the lease to expire. This ensures real-time accuracy of the binding table.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

CloudCampus virtualized campus networks support multiplefabric egress modesto connect VXLAN fabrics to external networks. These modes determine how traffic exits the fabric and whether egress resources are shared among multiple virtual networks.

Layer 3 shared egressallows multiple VNs to share the same Layer 3 egress interface, improving resource utilization and simplifying external connectivity.Layer 3 exclusive egressdedicates an independent Layer 3 interface to a specific VN, providing stronger isolation and higher security.

Layer 2 shared egressenables multiple VNs to access an external Layer 2 network through a shared interface. This mode is commonly used when the external network does not support Layer 3 integration.

Layer 2 exclusive egressis not supported in the CloudCampus solution because Layer 2 resources are typically designed to be shared to optimize scalability and simplify deployment.

Therefore, the correct answers are A, C, and D.

WLAN planning and design aim to minimize co-channel and adjacent-channel interference while maximizing spectrum utilization and user experience. According to HCIP Datacom Campus Network WLAN design principles, proper channel planning is a core task, especially in environments with high user density.

On the2.4 GHz frequency band, only three non-overlapping channels—1, 6, and 11—are traditionally recommended. These channels do not overlap in frequency, which helps reduce interference between adjacent APs. Inhigh-density scenarios, to further improve spectrum utilization,channels 1, 5, 9, and 13can be used. This approach shortens the channel spacing but is acceptable when transmit power is well controlled and AP placement is carefully planned, enabling higher AP density while keeping interference manageable.

On the5 GHz frequency band, there are more available channels and less interference compared to 2.4 GHz. HCIP Datacom documentation recommendsstaggering high-frequency and low-frequency channels between adjacent APs. This staggered channel allocation reduces the likelihood of co-channel interference and improves overall throughput and roaming performance, especially in large or high-density campus deployments.

These channel planning strategies are standard WLAN design best practices supported by Huawei and are widely applied in enterprise campus networks. Therefore, the statement accurately reflects recommended WLAN planning principles and isTRUE.

In the Huawei CloudCampus Solution, the architecture is typically divided into themanagement layerand thenetwork layer. The management layer, represented by platforms such as iMaster NCE-Campus, is responsible for centralized configuration, monitoring, policy delivery, and intelligent O&M. Communication between these two layers relies on standardizedmanagement and control protocols.

NETCONFis a key protocol used between the management layer and network devices. It provides a structured and reliable mechanism for delivering configurations, querying device status, and performing automated service deployment. NETCONF works closely with data models to ensure consistency and accuracy in configuration management.

SNMPis also widely used in the CloudCampus Solution for monitoring and fault management. Through SNMP, network devices report performance data, alarms, and status information to the management platform, enabling real-time visibility and proactive maintenance.

YANGis not a transport protocol but a data modeling language; however, it plays a critical role in management-layer communication. YANG models define the structure of configuration and operational data exchanged between the controller and devices, typically carried over NETCONF. Therefore, YANG-related information is effectively exchanged between the management and network layers.

RADIUS, on the other hand, is used for user authentication, authorization, and accounting. It operates between network devices and authentication servers, not between the management layer and the network layer.

Thus, the correct options areNETCONF, SNMP, and YANG.

Explanation (Based on HCIP Datacom Campus Network Design)

Position 1 → 802.1X AuthenticationThis authentication point corresponds to aPC connected to an access switch. PCs typically support 802.1X clients, making802.1X authenticationthe preferred and most secure method for wired user access. It provides strong identity-based access control using a RADIUS server.

Position 2 → Portal AuthenticationThis point representswireless user access. Portal authentication is commonly used for wireless terminals, especially guest or mobile users, where browser-based authentication is required. Users authenticate through a web page redirected by the access device.

Position 3 → MAC Address AuthenticationThis point corresponds tonon-802.1X-capable terminals, such as IP phones or printers. These devices cannot initiate 802.1X or Portal authentication, soMAC address authenticationis used to identify and authenticate them based on their MAC addresses.

This authentication deployment aligns with Huawei NAC best practices:

802.1X for capable wired terminals

Portal for wireless or guest access

MAC authentication for dumb or IoT devices

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Huawei campus switches support multiple flexible VLAN assignment methods to meet diverse access control and service deployment requirements. The most basic method isinterface-based VLAN assignment, where a physical or logical port is statically assigned to a specific VLAN. This method is simple and widely used in traditional access layer designs.

Huawei switches also supportMAC address–based VLAN assignment, allowing devices to be dynamically placed into VLANs based on their MAC addresses. This is useful in scenarios where users frequently move between access ports but require consistent VLAN membership.

Protocol-based VLAN assignmentenables traffic to be classified into VLANs based on upper-layer protocol types, which can be useful in special service separation scenarios. Additionally,IP subnet–based VLAN assignmentallows switches to assign VLANs according to the source IP address of packets, enabling logical grouping of users based on network layer addressing rather than physical location.

These VLAN assignment mechanisms enhance network flexibility, simplify user mobility, and improve access-layer service management. According to HCIP Datacom Campus Network documentation, Huawei switches indeed support VLAN assignment based on interface, MAC address, protocol, and IP address. Therefore, the statement is TRUE, and option A is correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

The Huawei CloudCampus Solution adopts afour-layer architecture, not a three-layer one. According to HCIP Datacom Campus Network documentation, the architecture consists of theterminal layer,network layer,management and control layer, andapplication layer.

Theterminal layerincludes user devices such as PCs, mobile terminals, IoT devices, and other endpoints that access the campus network. Thenetwork layeris responsible for data forwarding and includes access, aggregation, and core network devices. Themanagement and control layer, represented by platforms such as iMaster NCE-Campus, provides centralized management, automation, policy control, and orchestration. Theapplication layerdelivers value-added services and business applications.

Because the terminal layer is an essential and explicitly defined component of the CloudCampus architecture, stating that the solution has only three layers is incorrect. Therefore, the statement isFALSE, making optionBthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In Huawei iMaster NCE-Campus and CloudCampus management systems, different log types are designed to record different categories of events to support auditing, troubleshooting, and security analysis. When anMSP administrator creates a tenant account, this action is considered amanagement operationperformed through the system’s management interface.

Such administrative actions are recorded in theOperation Log. Operation logs documentuser-initiated configuration and management activities, including tenant creation, modification, deletion, policy changes, and administrative actions performed by operators or administrators. These logs are essential for operation auditing and responsibility tracing in multi-tenant environments.

System logsmainly record internal system events, such as service startup, module status changes, or system exceptions, and do not track administrator operations.Security logsfocus on security-related events, such as login failures, abnormal access attempts, or permission violations, rather than routine administrative operations.Device channel logsrecord communication events between devices and controllers, such as device registration or channel status changes, and are unrelated to tenant management actions.

According to HCIP Datacom Campus Network and CloudCampus O&M documentation, tenant account creation performed by an MSP administrator is clearly categorized as anoperation behavior, and therefore it is recorded in theOperation Log.

In the Huawei CloudCampus Solution for small- and medium-sized campus networks,AR series routersare commonly deployed asegress gatewaysto provide Internet access, WAN connectivity, and centralized management integration. According to HCIP Datacom Campus Network documentation, AR devices supportmultiple deployment and management modes, ensuring flexibility during initial deployment and ongoing operations.

It is correct that an AR functioning as an egress gateway supportsweb-based network management, which allows administrators to perform basic configuration through a graphical interface. AR devices also supportregistration center query, enabling zero-touch provisioning by automatically discovering and registering with iMaster NCE-Campus. In addition,DHCP Option 148-based deploymentis supported, allowing the AR to obtain controller address information dynamically and establish a management connection.

However, the statement becomes incorrect when it claims thatCLI-based deployment is not supported. In fact, AR routers fully supportCLI-based configuration and deployment, which remains a fundamental management method in Huawei network devices. CLI access is widely used for initial configuration, troubleshooting, advanced feature configuration, and scenarios where automated or graphical tools are not available.

HCIP Datacom documentation emphasizes that CloudCampus deployment modes areadditive, not mutually exclusive. Web-based management, registration center onboarding, DHCP Option 148, and CLI can all coexist, giving administrators flexibility to choose the most suitable method based on deployment conditions.

Therefore, since AR devicesdo support CLI-based deployment, the statement is incorrect, and the correct answer isFALSE.

1 →dh group1

2 →main

3 →esp

4 →tunnel

In the IKE proposal, the Diffie-Hellman group defines the key exchange strength used during IKE Phase 1 negotiation, which is whydh group1corresponds to position 1 under the IKE proposal configuration. Theexchange-mode mainsetting is part of IKEv1 Phase 1 and therefore correctly matches position 2 under the IKE peer configuration.

For the IPsec proposal, thetransformspecifies the protocol used to protect data traffic; since ESP is explicitly required,espcorrectly maps to position 3. Finally, theencapsulation-mode tunneldefines how packets are encapsulated in IPsec VPNs between gateways, makingtunnelthe correct match for position 4.

This mapping strictly follows HCIP Datacom Campus Network IPsec and IKE configuration logic and aligns with standard Huawei VRP command behavior.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Encapsulating Security Payload (ESP) is one of the core IPsec protocols used to protect data confidentiality, integrity, and authenticity. To prevent replay attacks, ESP includes aSequence Numberfield in its header. This field plays a critical role in ensuring packet freshness.

Each ESP packet carries a monotonically increasing sequence number assigned by the sender. The receiving device maintains a sliding window and checks incoming packets against this window. If a packet arrives with a sequence number that has already been received or falls outside the valid window, the packet is considered a replay and is discarded. This mechanism effectively protects the network against replay attacks, where attackers capture legitimate packets and retransmit them to disrupt communication or bypass security controls.

TheSPI (Security Parameters Index)identifies the security association used for the packet but does not provide replay protection. TheNext Headerfield indicates the type of payload carried in the ESP packet.Authentication Dataensures packet integrity and data origin authentication but does not independently prevent replay attacks without the sequence number mechanism.

According to HCIP Datacom Campus Network documentation and IPsec standards, replay protection in ESP is implemented using the Sequence Number field, making option A the correct answer.

Comprehensive and Detailed Explanation (200–250 words):

In this scenario,distributed VXLAN gatewaysare deployed, andlocal ARP proxyis enabled onVBDIF 10 of SW1. PC1 (172.16.1.1/24) needs to communicate with PC2 (172.16.1.2/24), which is located behind aremote distributed gateway (SW3).

Witharp-proxy local enable, SW1 doesnot flood ARP requests across the VXLAN tunnel. Instead, SW1 responds locally to PC1’s ARP request using theMAC address of its own VBDIF interface. Therefore, PC1 learns172.16.1.2 mapped to MAC D, which is the MAC address ofVBDIF 10 on SW1, not MAC B (the actual MAC of PC2). This makesstatement C trueandstatement A false.

Once PC1 sends traffic to PC2, the destination MAC in the frame isMAC D, meaning the packet is delivered to thelocal Layer 3 gateway. SW1 then performsLayer 3 routing, not Layer 2 switching. SW1 looks up theLayer 3 forwarding table, determines the remote VTEP, encapsulates the packet into VXLAN, and forwards it across the VXLAN tunnel. Therefore,statement D is true, whilestatement B is false.

This behavior aligns with HCIP Datacom Campus Network documentation fordistributed gateways with ARP proxy enabled, where traffic is routed locally and optimized across the VXLAN fabric.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Port isolation is commonly used on access switches to preventwired terminalsfrom communicating directly with each other at Layer 2. This enhances security by blocking lateral attacks and unnecessary broadcast traffic.

Forwireless users, Huawei APs and WLAN controllers (or central APs in agile distributed scenarios) providewireless user isolationmechanisms. Wireless user isolation prevents clients connected to the same SSID or AP from directly communicating with each other, even though they share the same wireless medium. This is widely used in guest networks, dormitories, and public WLAN environments.

Therefore, the statement that APs cannot implement wireless user isolation is incorrect. According to HCIP Datacom Campus Network WLAN design principles,wireless user isolation is fully supported by APs, either locally or under centralized control.

Hence, the statement is FALSE, and option B is correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In Huawei campus authentication architecture, anauthentication profiledefines how users are authenticated and which domain is used during authentication. A key concept is theforcible domain, which has the highest priority during domain selection. If a forcible domain is configured, the device ignores any domain information carried in the user name and forcibly authenticates the user in the specified domain. Therefore, statementD is correct.

Statement A is incorrect because the default domaincan be modifiedusing CLI commands, allowing administrators to flexibly control user authentication behavior. Statement B is also incorrect; on the same interface, different authentication types (such as 802.1X, MAC authentication, and Portal)can be configured with different domains, depending on access control requirements.

Statement C is incorrect because the default authentication triggering sequence on Huawei devices is802.1X → MAC address authentication → Portal authentication, not the order described. This sequence ensures strong authentication is attempted first before falling back to weaker mechanisms.

According to HCIP Datacom Campus Network documentation, forcible domain configuration guarantees unified policy enforcement and simplifies authentication control, making option D the only correct statement.

In the Huawei SD-WAN Interconnection Solution,enhanced BGP EVPNis used as the core control-plane technology to distribute not only traditional routing information but also SD-WAN–specific service and tunnel-related data. This enhancement allows centralized control and automated service deployment across branch and hub sites.

TNP routesare one of the key information types transmitted through enhanced BGP EVPN. TNP (Transport Network Plane) routes describe the reachability of transport tunnels between SD-WAN nodes and are essential for establishing and maintaining overlay connectivity across different transport networks such as Internet, MPLS, or LTE.

IPsec SA (Security Association) informationis also carried through enhanced BGP EVPN. This allows SD-WAN devices to dynamically establish secure IPsec tunnels without manual configuration, ensuring encrypted communication between sites while supporting fast deployment and scalability.

In addition,service routesare distributed using enhanced BGP EVPN. Service routes identify application or service-level reachability and enable intelligent traffic steering, policy-based forwarding, and service chaining across the SD-WAN fabric.

GRE configuration, however, is not transmitted through enhanced BGP EVPN. GRE parameters are typically configured locally and do not belong to the control information exchanged by EVPN in the Huawei SD-WAN solution. Therefore, the correct information types are TNP routes, IPsec SA information, and service routes.