Huawei H12-891_V1.0 - HCIE-Datacom V1.0

To analyze this question, let's break down the key concepts and the given LSDB (Link State Database) information from the figure:

Understanding the LSDB Output:

The output shows the OSPF LSDB on R2 with Router ID 10.1.123.2.

Area 0.0.0.0 (Area 0) is displayed along with several Link State Advertisements (LSAs) including Router LSAs, Network LSAs, and Summary LSAs.

Area 0.0.0.1 (Area 1) also displays Router LSAs and a Type 7 LSA (NSSA LSA) with Link-State ID 0.0.0.0.

An External LSA (Type 5) with Link-State ID 0.0.0.0 and AdvRouter 10.1.123.2 is also present.

Analysis of Each Option:

Option A: Area 1 is an NSSA.

Correct.

The presence of a Type 7 LSA (NSSA LSA) in the database indicates that Area 1 is configured as an NSSA (Not-So-Stubby Area).

NSSA allows the injection of Type 7 LSAs for external routes while blocking Type 5 LSAs from entering the area.

Option B: R2 translates Type 7 default route into Type 5 default route.

Correct.

In an NSSA, if an ABR (like R2) has the NSSA ASBR capability, it will convert Type 7 LSAs to Type 5 LSAs before injecting them into the backbone area (Area 0).

In the LSDB, we see both a Type 7 LSA (NSSA) and a corresponding Type 5 External LSA, confirming that R2 performs this translation.

Option C: R2 advertises the default route in the OSPF process.

Incorrect.

There is no indication that R2 itself is originating the default route.

The Type 7 LSA in Area 1 and the Type 5 LSA in Area 0 only indicate translation from another source, not R2 advertising it directly.

Option D: Area 1 does not have Type 3 LSAs. The possible cause is that R2 filters Type 3 LSAs in the outbound direction of Area 1.

Incorrect.

In an NSSA area, Type 3 LSAs (Inter-Area Prefix LSAs) are typically not generated for external routes.

The absence of Type 3 LSAs in Area 1 is due to the nature of NSSA itself rather than any filtering configured on R2.

Understanding VXLAN and BGP EVPN Control Plane

VXLAN (Virtual eXtensible LAN)is anoverlay network technologythat enablesLayer 2 (L2) extension over an IP-based networkusingMAC-in-UDP encapsulation.

🔹Traditional VXLAN Flooding Issue:

Without BGP EVPN, VXLAN usesflood-and-learnbehavior for MAC address learning.

Broadcast, Unknown Unicast, and Multicast (BUM) trafficis flooded to all VTEPs, which is inefficient.

🔹How Does BGP EVPN Solve Flooding?

BGP EVPN (Ethernet VPN) replaces the flood-and-learn model with a distributed control plane.

MAC/IP bindings are advertised through BGP EVPN Type 2 routes, eliminating the need forflooding ARP requests.

VXLAN routers learn MAC addressesproactivelyinstead of relying on flooding.

Why is the Answer TRUE?

✅BGP EVPN fully prevents ARP flooding by distributing MAC/IP bindings via control plane updates.

✅VTEPs only send traffic to known destinations, reducing network congestion.

✅BGP EVPN is the industry standard for large-scale data center and campus VXLAN deployments.

Real-World Application:

Data Centers:Avoids unnecessaryARP request floodingin large cloud networks.

Campus Networks:ReducesL2 broadcast storms, improving network efficiency.

Service Provider Networks:Enablesscalable multi-tenant VXLAN solutions.

✅Reference:Huawei HCIE-Datacom Guide – VXLAN BGP EVPN Control Plane Architecture

Comprehensive and Detailed In-Depth Explanation:

When invokingRESTful APIsiniMaster NCE-Campus, the client must include theACCESS-TOKENin therequest headerto authenticate the request.

TheACCESS-TOKENis obtained throughauthenticationand is required forAPI access control.

The correct format in the HTTP header is:

Authorization: Bearer ACCESS-TOKEN

Other formats likeACCEPT-TOKEN,X-ACCEPT-TOKEN, andX ACCESS TOKENare not recognized or valid foriMaster NCE-Campus API requests.

Therefore, the correct answer isA.

BGP EVPN Route Types in VXLAN:

BGP EVPN Type 2 Route (MAC/IP Advertisement Route)

Used forhost reachability advertisement.

Carries MAC and IP address information of endpoints.

Does not carry an IP Prefix field(Type 5 routes handle prefixes).

Correct Explanation of Answer Choices:✅IP Address (B) is included– Used for host mobility and reachability.✅L3VNI (C) is included– Used forLayer 3 VXLAN routing.✅L2VNI (D) is included– Used forLayer 2 VXLAN bridging.❌IP Prefix (A) is not included in Type 2 routes– It is part ofEVPN Type 5 routesforprefix advertisement.

Reference from Huawei HCIE-Datacom Documentation:

Huawei VXLAN BGP EVPN Configuration Guide – Type 2 vs. Type 5 Routes

HCIE-Datacom Training Material – VXLAN Overlay Networks and BGP EVPN

Dynamic VLAN Authorization in Huawei CloudCampus

Dynamic VLAN assignmentallows users to be placed into specific VLANsbased on authentication methods, ensuring security and network segmentation.

Correct Explanations:

✅A. Wired users using 802.1X authentication receive VLAN assignments dynamically.

After authentication,the access control system (e.g., iMaster NCE-Campus)assigns VLANs dynamically.

✅C. Wireless users using 802.1X authentication also receive VLAN assignments.

Similar to wired users,wireless 802.1X authentication allows dynamic VLAN assignmentvia the RADIUS server.

✅D. Wired users using MAC authentication can receive VLAN assignments.

If a userdoes not support 802.1X, MAC authentication can still be used to assign VLANs dynamically.

Incorrect Statement Explanation:

❌B. When wireless users pass Portal authentication, they join the authorization VLANs delivered to edge nodes.

Wrong!InPortal authentication, VLAN assignmentis not dynamically deliveredbecausePortal authentication typically applies access policies, not VLAN changes.

Dynamic VLAN assignment is mainly used with 802.1X or MAC authentication.

Reference from Huawei HCIE-Datacom Documentation:

Huawei CloudCampus Configuration Guide – Dynamic VLAN Assignment and Authentication

HCIE-Datacom Training Material – VLAN Authorization in Virtualized Campus Networks

From theIS-IS error output, the key error is:

Mismatched Area Addr(L1): 13

This clearly indicates that thearea addresses are different, which prevents theLevel-1 adjacencyfrom forming.

Why is Option D Correct?

IS-IS Level-1 routers must have the same area IDto form an adjacency.

Since the log shows amismatched area address, the adjacency fails at Level-1.

If R3 and R4 wereLevel-2 routers, they could form an adjacencyeven with different area IDs.

Why Are the Other Options Incorrect?

❌Option A:No authentication failure is reported.

❌Option B:No "Mismatched Level" errors appear, so their levels are compatible.

❌Option C:No "Bad Circuit Type" errors indicate mismatched circuit types.

Thus, the correct answer isD.

📖Reference:Huawei HCIE Datacom – IS-IS Neighbor Troubleshooting

A white background with black lines AI-generated content may be incorrect.

🔸 R1 – Headend

It receives a normal IPv6 packet from CE1.

It inserts the SRH (Segment Routing Header) with segment list.

Therefore, R1 is the Headend.

Huawei Reference:

“The SRv6 headend node receives a normal IPv6 packet and inserts an SRH, becoming the source of the SR path.”

(Source: HCIE-Datacom V1.0 – SRv6 Fundamentals)

🔸 R2 – Transit Node

R2 simply forwards the SRv6-encapsulated packet.

It does not process any segment SID.

Hence, R2 is a Transit node.

“Transit nodes in SRv6 just forward packets based on the active segment in the IPv6 destination address without processing SRH.”

(Source: HCIE-Datacom Study Guide – SRv6 Node Roles)

🔸 R3 – Endpoint

The first SID in SRH is FC03::3, which belongs to R3.

R3 processes the SID, pops it, and forwards the packet to the next segment FC04::4.

Thus, R3 is an Endpoint for one segment.

🔸 R4 – Endpoint

The final destination SID in the SRH is FC04::4, which belongs to R4.

R4 performs the final End behavior, handling the payload.

So, R4 is also an Endpoint.

Comprehensive and Detailed In-Depth Explanation:

Analyzing the output:

A. Key authentication is disabled for the tunnel:Correct. The output explicitly states"key disabled".

B. The destination IP address of the tunnel is 10.0.3.3:Correct. The output shows"destination 10.0.3.3".

C. The tunnel is a GRE tunnel:Correct. The output states"Tunnel protocol/transport GRE/IP".

D. Keepalive detection is enabled on the tunnel:Incorrect.The output clearly shows"keepalive disabled".

Therefore, the correct answer isDbecause the tunnel doesnot have keepalive enabled.

GRE (Generic Routing Encapsulation) has the following benefits:

B. VPN Construction — GRE is often used to build site-to-site VPNs.

C. ARP Encapsulation — GRE supports Layer 2 protocol encapsulation such as ARP.

D. Multicast Support — GRE tunnels can encapsulate multicast packets, unlike traditional IPsec.

A. Enlarging the hop limit is incorrect — GRE does not inherently change TTL or hop behavior; routing protocols still use standard IP processing.

Exact Extract - Huawei HCIE-Datacom Tunneling Chapter:

“GRE can encapsulate multicast and broadcast packets and supports L2 protocols like ARP. It is often used for VPN construction over the internet.”

BGP EVPN Type 2 Route (MAC/IP Advertisement Route)

This route carriesMAC and IP address bindingsto inform remote VTEPs about locally learned endpoints.

Why Use arp collect host enable?

Collects ARP entriesof locally connected hosts.

EnablesBGP EVPN Type 2 route generationto distribute the learned ARP information.

Incorrect Answer Explanations:❌A. mac-address xxxx-xxxx-xxxx– Manually configures a MAC address butdoes not enable ARP collection for EVPN Type 2 routes.❌B. arp-proxy enable– Enables ARP Proxy butdoes not advertise ARP information using BGP EVPN.❌D. arp distribute-gateway enable– Used inDistributed Anycast Gateway (DAG) modebutnot for collecting host ARP data.

Reference from Huawei HCIE-Datacom Documentation:

Huawei VXLAN EVPN Configuration Guide – ARP Handling and EVPN Type 2 Routes

HCIE-Datacom Training Material – VTEP ARP Advertisement in VXLAN Networks