Huawei H12-891_V1.0 - HCIE-Datacom V1.0

HuaweiSD-WAN establishes secure tunnels between SD-WAN edge devices (CPEs, AR routers, and controllers) using tunneling protocols.

✅B. GRE over IPsec(Correct Answer)

GRE (Generic Routing Encapsulation) over IPsecisthe primary tunneling method used in Huawei SD-WAN.

GRE provides multi-protocol encapsulation, whileIPsec ensures encryption and security.

Used forsecure communication over public WAN links (e.g., the internet, LTE, MPLS, etc.).

SSH Public Key Authentication

Inpublic key authentication mode, the SSH client must generate akey pair (public and private keys)before connecting to an SSH server.

✅C. ssh-keygen -t dsa (Correct Answer)

DSA (Digital Signature Algorithm) key generationfor SSH authentication.

Generates aprivate key (id_dsa)and apublic key (id_dsa.pub).

BGP routing policiesallow administrators to:

Control incoming and outgoing routes.

Filter routes based onprefix, AS-PATH, communities, MED, next hop, etc.

Apply route maps, prefix lists, or filter policies during:

Route advertisement

Route reception

Route import/export into local RIB or VPN instance

This is a fundamental capability of BGP and is widely used in production environments for traffic engineering, route filtering, and policy-based routing.

Correct answer: A. TRUE

InOSPFv3,Link-LSA (Type 8)is generated by a routerfor each of its interfacesto advertise:

Therouter's link-local addresson that interface.

TheIPv6 prefixesassociated with the interface.

Flags and options, such as router priority or loopback indicators.

From the output:

Link-LSA (Interface GigabitEthernet0/0/0)

Originating Router: 10.1.2.2

Link-Local Address: FE80::2E0:FCFF:FECD:4F79

Prefix: 2001:DB8:2345:23::/64

A. The link-local address of R2’s GE0/0/0 is FE80::2E0:FCFF:FECD:4F79→ This matches the Link-Local Address field in the LSA.✅

B. The IPv6 address prefix of R2’s GE0/0/0 is 2001:DB8:2345:23::/64→ This matches the Prefix field in the LSA.✅

C. This LSA indicates that R2 does not support external routes but can participate in IPv6 route calculation→❌Incorrect.

TheLink-LSAdoesnot provide any indicationabout external route capabilities.

It simply advertisesinterface-specific IPv6 and link-local info.

Whether R2 supports external routes depends onType 5 (External) or Type 7 (NSSA) LSAs, not Link-LSAs.

D. This LSA is generated by R2→ The Originating Router: 10.1.2.2 is R2’s router ID, so this LSA is definitely generated by R2.✅

Correct Answers:A, B, D

The Link-LSA in OSPFv3 contains:

The link-local address used by the originating router on the link.

A list of all IPv6 prefixes associated with the link.

Flags such as router priority and the Router-LSA options.

These LSAs are alwaysgenerated by the router itselfand arenot flooded beyond the link.

Comprehensive and Detailed Explanation:

✔iMaster NCE-WANprovides aRESTful APIfor integration withthird-party applicationsandnetwork automation platforms.

✔Why RESTful API?

UsesHTTP/HTTPSfor communication.

SupportsJSON and XMLdata formats.

Enablesorchestration, monitoring, and automation.

✔Why Not Other Options?

❌(A) NETCONF→ Used fordevice-level configuration, notnorthbound APIs.

❌(B) SNMP→ Used fornetwork monitoring, notnorthbound integration.

❌(C) CLI→ Used formanual command execution, notAPI communication.

📖Reference:Huawei HCIE Datacom – iMaster NCE-WAN Northbound API

Comprehensive and Detailed In-Depth Explanation:

Analyzing the output:

A. The device sends sampled data every second:Correct. Thesample interval is 1000 ms (1 second).

B. The subscription name is Sub1:Correct. Thesubscription nameis clearly shown asSub1.

C. The subscription mode is static subscription:Correct. Since theSub-stateisPASSIVE, it indicates astatic subscription.

D. The IP address of the device is 192.168.56.1:Incorrect. The IP address192.168.56.1shown in the output is thedestination IPwhere the telemetry data is sent, not the IP address of the device itself.

TheTime-To-Live (TTL) fieldin MPLS is essential forpreventing infinite loopsandenhancing security.

MPLS TTL Field Functionality:

It prevents packets fromcirculating indefinitelyin the MPLS network.

It allowstraceroute (tracert) to identify MPLS hopswhen TTL propagation is enabled.

Explanation of Correct Answers:✅B. The processing of IP TTL copy hides the LSR in an MPLS domain, improving security.

IfTTL propagation is disabled, MPLS routers do not decrease TTL, hidinginternal LSRsfrom traceroute, enhancing security.

✅C. MPLS provides two TTL processing modes:

Default Mode:The MPLS TTLcopies the IP TTL valuewhen an IP packet enters the MPLS network.

Uniform Mode:The ingress LERsets the MPLS TTL to 255, so it does not decrement.

✅D. MPLS encapsulation in frame mode supports the TTL field, while cell mode does not.

Frame Mode (Ethernet, PPP, etc.) supports TTL.

Cell Mode (ATM/MPLS) does not support TTL.

Incorrect Answer Explanation:❌A. If TTL copy is disabled, users can use the tracert function to view MPLS hops.

Wrong!If TTL propagation is disabled, tracertcannotsee LSRs inside the MPLS core network.

Reference from Huawei HCIE-Datacom Documentation:

Huawei MPLS Technology Guide – TTL Field & Loop Prevention

HCIE-Datacom MPLS VPN Configuration Guide – Traceroute in MPLS Networks

X = 0

Y = 0

Z = 1

Understanding MPLS Label Headers

🔹What is MPLS (Multiprotocol Label Switching)?

MPLS is ahigh-performance forwarding technologythat replacesIP lookups with label switching.

Packets are forwardedbased on labels instead of destination IP addresses.

MPLS labels are stacked when passing throughmultiple hops.

🔹MPLS Label Stack Structure

Each MPLS label hasfour fields:

Label– 20-bit identifier used for forwarding.

EXP (Experimental Bits / Traffic Class)– 3-bit field used forQoS (Quality of Service).

S (Bottom of Stack)– 1-bit flag that indicates whether this is thelast (bottom) label in the stack.

TTL (Time-To-Live)– 8-bit field to prevent loops.

Understanding the EXP Fields (X, Y, Z) in the Figure

The image shows a packet with three MPLS labels.

Each label has anEXP field (X, Y, Z) representing the QoS bits.

By default,MPLS EXP bits are copied from the top label to lower labels unless modified by QoS policies.

If no QoS policy modifies the EXP bits, they remain thedefault value of 0.

Thebottom label in the stack (Label 3) often has an EXP value of 1 to indicate specific QoS policies.

Why Are the Answers X = 0, Y = 0, Z = 1?

✅X = 0 (Default EXP for Label 1, the top label in the stack).

✅Y = 0 (EXP for Label 2, unchanged from the default value).

✅Z = 1 (EXP for Label 3, indicating a QoS setting applied to the bottom label).

Real-World Application:

MPLS QoS (Quality of Service):EXP values determinepacket priorityinService Provider networks.

Traffic Engineering (TE):MPLS labels guide packets throughoptimized paths, ensuringlow-latency services.

Enterprise WAN Optimization:MPLS traffic is prioritized forcritical applications like VoIP, Video Conferencing, and Cloud Services.

✅Reference:Huawei HCIE-Datacom Guide – MPLS Label Stack and QoS EXP Field Processing

Huawei iMaster NCE-CampusWi-Fi Location-Based Services (LBS)useHTTP/HTTPSto send location data (such as AP association, signal strength, timestamp, etc.) to an externalLBS platform.

Thestandard format for such data exchange is JSON (JavaScript Object Notation).

JSON is lightweight, readable, and widely supported by modern web APIs and platforms.

Other options:

XML: Used in legacy systems, heavier format.

HTML: Used for page rendering, not data transfer.

YAML: Used mainly in configurations, not standard for HTTP APIs.

Correct answer: C. JSON

Comparison Between Paramiko (SSH) and Telnetlib (Telnet)

✅Paramiko (SSH) is more secure than Telnetlib (Telnet).

SSH (Secure Shell) encrypts login credentials and session datausing encryption protocols likeAES and RSA.

Telnet transmits data in plaintext, making it vulnerable to eavesdropping and man-in-the-middle attacks.

✅Why is Telnet Insecure?

No encryption→ Credentials (username/password) are sent in plaintext.

Easily interceptedby attackers using packet sniffers (e.g., Wireshark).

Correct Method for Secure Remote Login in Python:

UseParamiko for SSH-based secure automation.

Example of logging in withParamiko (SSH)in Python:

import paramiko

ssh = paramiko.SSHClient()

ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

ssh.connect("192.168.1.1", username="admin", password="password")

stdin, stdout, stderr = ssh.exec_command("display version")

print(stdout.read().decode())

ssh.close()

Reference from Huawei HCIE-Datacom Documentation:

Huawei Security Best Practices – Avoiding Telnet and Using SSH for Secure Access

HCIE-Datacom Training Material – Network Automation with Python (Paramiko & Telnetlib)