Microsegmentation in Huawei’s data center networks (e.g., CloudFabric with SDN) divides Endpoint

Groups (EPGs) to enforce fine-grained security policies. EPGs group endpoints (e.g., VMs) based on

attributes. Let’s evaluate each option:

A. Operating system: This is true. The OS type (e.g., Linux, Windows) can be used to segment EPGs,

enabling policy enforcement based on OS-specific security needs. TRUE.

B. VM name: This is true. VM names can be used as identifiers for microsegmentation, allowing

policies to target specific VMs. TRUE.

C. IP address: This is true. IP addresses are commonly used to define EPG boundaries, especially for

network-based segmentation. TRUE.

D. MAC address: This is true. MAC addresses can segment EPGs, particularly for Layer 2-based

policies or device-specific isolation. TRUE.

All options A, B, C, and D are valid conditions for microsegmentation to divide EPGs in Huawei’s

implementation.

Reference: Huawei CloudFabric Data Center Network Solution – Microsegmentation; HCIP-Data

Center Network Training – EPG Configuration.

Multi-Chassis Link Aggregation Group (M-LAG) is a high-availability technology on Huawei

CloudEngine (CE) series switches, where two switches appear as a single logical device to

downstream devices. The peer-link between the M-LAG peers synchronizes critical information to

ensure seamless failover if one device fails. Let’s evaluate the entries:

A. MAC Address Entries: MAC address tables map device MACs to ports. In M-LAG, synchronizing

MAC entries ensures that both switches know the location of connected devices. If one switch fails,

the surviving switch can forward Layer 2 traffic without relearning MAC addresses, preventing

disruptions. Required.

B. Routing Entries: Routing entries (e.g., OSPF or BGP routes) are maintained at Layer 3 and typically

synchronized via routing protocols, not M-LAG peer-link packets. M-LAG operates at Layer 2, and

while Layer 3 can be overlaid (e.g., with VXLAN), routing table synchronization is not a standard M-

LAG requirement. Not Required.

C. IGMP Entries: IGMP (Internet Group Management Protocol) entries track multicast group

memberships. While useful for multicast traffic, they are not critical for basic unicast traffic

forwarding in M-LAG failover scenarios. Huawei documentation indicates IGMP synchronization is

optional and context-specific, not mandatory for general traffic continuity. Not Required.

D. ARP Entries: ARP (Address Resolution Protocol) entries map IP addresses to MAC addresses,

crucial for Layer 2/Layer 3 communication. Synchronizing ARP entries ensures the surviving switch

can resolve IP-to-MAC mappings post-failover, avoiding ARP flooding or traffic loss. Required.

Thus, A (MAC address entries) and D (ARP entries) are essential for M-LAG synchronization to

maintain traffic forwarding during failover, per Huawei CE switch M-LAG design.

Reference: Huawei CloudEngine Series Switch Configuration Guide – M-LAG Section; HCIP-Data

Center Network Training – High Availability Technologies.

This question pertains to OpenStack, a common virtualization platform in Huawei’s HCIP-Data Center

Network curriculum, where components collaborate to create and manage virtual machines (VMs).

Let’s analyze each component’s role in providing computing, storage, and network resources during

VM creation:

A. Nova: Nova is the compute service in OpenStack, responsible for managing VM lifecycles,

including provisioning CPU and memory resources. It’s essential for providing computing resources

during VM creation. Required.

B. Neutron: Neutron is the networking service, handling virtual network creation, IP allocation, and

connectivity (e.g., VXLAN or VLAN) for VMs. It’s critical for providing network resources during VM

creation. Required.

C. Ceilometer: Ceilometer is the telemetry service, used for monitoring, metering, and collecting

usage data (e.g., CPU utilization, disk I/O) of VMs. While useful for billing or optimization, it does not

directly provide computing, storage, or network resources during VM creation. Not Required.

D. Cinder: Cinder is the block storage service, providing persistent storage volumes for VMs (e.g., for

OS disks or data). It’s essential for providing storage resources during VM creation if a volume is

attached. Required.

Thus, C (Ceilometer) is not required to provision the core resources (computing, storage, network)

for VM creation, as its role is monitoring, not resource allocation.

Reference: Huawei HCIP-Data Center Network Training – OpenStack Architecture; OpenStack Official

Documentation – Service Overview.

VXLAN (Virtual Extensible LAN) tunnels are used to encapsulate Layer 2 traffic over a Layer 3

network, a key feature in Huawei’s data center solutions. The endpoints of a VXLAN tunnel are

VXLAN Tunnel Endpoints (VTEPs), identified by their IP addresses.

Tunnel Identification: A VXLAN tunnel is uniquely identified by the pair of VTEP IP addresses (local

and remote), along with the VNI (VXLAN Network Identifier). This pair ensures the tunnel is specific

to the communication path between the two VTEPs.

Tunnel Establishment: During setup, VTEPs exchange information to learn each other’s IP addresses.

This can occur manually (static configuration) or dynamically (e.g., via BGP EVPN). The underlay

network must provide Layer 3 reachability between the VTEP IP addresses, typically using routing

protocols (e.g., OSPF, BGP) to ensure IP connectivity.

Reachability Condition: If the local and remote VTEP IP addresses are reachable at Layer 3, the tunnel

can be established, allowing encapsulation and decapsulation of VXLAN traffic. This is a fundamental

requirement in Huawei’s VXLAN implementation.

The statement is TRUE (A) because a VXLAN tunnel’s identification and establishment depend on

reachable VTEP IP address pairs at Layer 3.

Reference: Huawei HCIP-Data Center Network Training – VXLAN Tunneling; CloudFabric VXLAN

Deployment Guide.

BGP EVPN (Ethernet VPN) extends BGP to provide control plane functionality for VXLAN overlays,

including in Huawei’s data center networks. EVPN defines several route types to advertise different

types of information:

Type 1: Auto-discovery routes for EVPN instances.

Type 2: MAC/IP Advertisement routes for host reachability.

Type 3: Inclusive Multicast Ethernet Tag routes for multicast traffic.

Type 4: Ethernet Segment routes for multi-homing.

Type 5: IP Prefix routes for advertising host IP routes and external network routes, enabling inter-

subnet and external connectivity.

The question specifies routes used to advertise "host IP routes and external network routes," which

aligns with Type 5 routes. These routes carry IP prefix information and a Layer 3 VNI, facilitating Layer

3 routing within the EVPN domain or to external networks. Thus, the answer is 5.

Reference: Huawei HCIP-Data Center Network Training – BGP EVPN Routes; CloudFabric EVPN

Configuration Guide.

In Huawei’s CloudFabric Solution, SecoManager (Security Manager) and iMaster NCE-Fabric

(Network Controller) are components of the SDN ecosystem. SecoManager handles security policy

management, while iMaster NCE-Fabric manages network orchestration.

Deployment: These components can be deployed independently but are designed to integrate

seamlessly. Huawei’s architecture supports automated interconnection after installation, leveraging

northbound/southbound APIs or pre-configured integration workflows.

Interconnection: Manual interconnection is not required post-installation; the system automates the

process once both are deployed and configured within the same management domain (e.g., via IP

addressing and authentication).

The statement is FALSE (B) because interconnection is automated, not manual.

Reference: Huawei CloudFabric Data Center Network Solution – Component Integration; HCIP-Data

Center Network Training – SDN Deployment.

The Easy mode in Huawei’s iMaster NCE-Fabric simplifies network deployment for basic VXLAN

fabrics. Let’s evaluate each statement:

A. This mode has low networking requirements: This is true. Easy mode is designed for simple

topologies (e.g., small spine-leaf networks) with minimal configuration complexity. TRUE.

B. iMaster NCE-Fabric automatically generates configuration script files: This is true. Easy mode

automates script generation based on user inputs, reducing manual effort. TRUE.

C. On iMaster NCE-Fabric, you need to manually create and configure fabric resource pools, managed

devices, device groups, device roles, tenants, and VPCs one by one in the Configuration Wizard

menu: This is false. Easy mode automates these tasks, minimizing manual configuration compared to

advanced modes. FALSE.

D. Layer 2 and Layer 3 basic services in a VPC are orchestrated on the Easy page: This is true. Easy

mode supports automated orchestration of L2 (e.g., BDs) and L3 (e.g., gateways) services within a

VPC. TRUE.

Thus, A, B, and D are true statements about Easy mode.

Reference: Huawei CloudFabric Data Center Network Solution – iMaster NCE-Fabric Easy Mode;

HCIP-Data Center Network Training – Deployment Modes.

Centralized gateway deployment using BGP EVPN in Huawei’s data center networks (e.g.,

CloudFabric) involves a gateway handling Layer 3 routing for VXLAN overlays. Let’s evaluate each

statement:

A. When configuring a VTEP, you need to create a Layer 2 BD and bind a VNI to the Layer 2 BD: A

Bridge Domain (BD) is a Layer 2 broadcast domain in VXLAN, and a Virtual Network Identifier (VNI) is

bound to it to segment traffic. This is a standard step when configuring a VXLAN Tunnel Endpoint

(VTEP) to map the overlay network. TRUE.

B. A VXLAN tunnel is identified by a pair of VTEP IP addresses and can be established if the local and

remote VTEP IP addresses are reachable to each other at Layer 3: VXLAN tunnels are established

between VTEPs using their IP addresses as endpoints. Layer 3 reachability (e.g., via underlay routing)

is required for tunnel establishment. TRUE.

C. When BGP EVPN is used to dynamically establish a VXLAN tunnel, the local and remote VTEPs first

establish a BGP EVPN peer relationship and then exchange BGP EVPN routes to transmit VNI and

VTEP IP address information. A VXLAN tunnel is then dynamically established between them: In BGP

EVPN, VTEPs establish a BGP peer relationship, exchange routes (e.g., Type 2 for MAC/IP or Type 3

for multicast), and share VNI and VTEP IP details, enabling dynamic tunnel setup. TRUE.

D. When configuring a VTEP, you need to create an EVPN Instance in the Layer 2 BD and configure an

RD for the local EVPN instance. You do not need to configure an RT: An EVPN Instance (EVI) is created

within a BD, and a Route Distinguisher (RD) is configured to make routes unique. However, Route

Targets (RTs) are also required to control route import/export between EVPN peers, ensuring proper

VNI and route distribution. Stating that RT configuration is not needed is incorrect, as RTs are

essential for BGP EVPN operation. FALSE.

Thus, D is the false statement because RT configuration is necessary in centralized gateway

deployment with BGP EVPN.

Reference: Huawei CloudFabric Data Center Network Solution – BGP EVPN Configuration; HCIP-Data

Center Network Training – EVPN Gateway Deployment.

Layer 4 load balancing operates at the transport layer (OSI Layer 4), using TCP/UDP protocols to

distribute traffic based on information like IP addresses and port numbers, without inspecting the

application-layer content (Layer 7). Let’s evaluate each option:

A. Nginx: Nginx is a versatile web server and reverse proxy that supports both Layer 4 and Layer 7

load balancing. In its Layer 4 mode (e.g., with the stream module), it balances TCP/UDP traffic,

making it a Layer 4 load balancing technology. This is widely used in Huawei’s CloudFabric DCN

solutions for traffic distribution. TRUE.

B. PPP (Point-to-Point Protocol): PPP is a Layer 2 protocol used for establishing direct connections

between two nodes, typically in WAN scenarios (e.g., dial-up or VPNs). It does not perform load

balancing at Layer 4 or any layer, as it’s a point-to-point encapsulation protocol. FALSE.

C. LVS (Linux Virtual Server): LVS is a high-performance, open-source load balancing solution

integrated into the Linux kernel. It operates at Layer 4, using techniques like NAT, IP tunneling, or

direct routing to distribute TCP/UDP traffic across backend servers. It’s a core Layer 4 technology in

enterprise DCNs. TRUE.

D. HAProxy: HAProxy is a high-availability load balancer that supports both Layer 4 (TCP mode) and

Layer 7 (HTTP mode). In TCP mode, it balances traffic based on Layer 4 attributes, making it a Layer 4

load balancing technology. It’s commonly deployed in Huawei DCN environments. TRUE.

Thus, A (Nginx), C (LVS), and D (HAProxy) are Layer 4 load balancing technologies. PPP is not.

Reference: Huawei CloudFabric Data Center Network Solution – Load Balancing Section; HCIP-Data

Center Network Training – Network Traffic Management.

OSPF (Open Shortest Path First) is a routing protocol used in the underlay network of Huawei’s

CloudFabric DCNs. Let’s evaluate each statement:

A. Typically, the IP address of Loopback0 is configured as the VTEP IP address and the same IP

address is planned for active-active leaf nodes in the same group: This is true. Loopback0 IP is

commonly used as the VTEP IP for stability, and in active-active leaf node groups (e.g., M-LAG), the

same IP can be configured with VRRP or anycast to ensure consistency. TRUE.

B. The network type of spine and leaf nodes can be set to P2P in order to accelerate convergence:

This is true. Setting OSPF network type to Point-to-Point (P2P) on spine-leaf links reduces overhead

(e.g., no DR/BDR election) and speeds up convergence, a recommended practice in Huawei DCNs.

TRUE.

C. This routing design is recommended when the DC has more than 300 switches: This is false. OSPF

is suitable for smaller to medium-sized DCNs (e.g., up to 200-300 switches). For larger networks

(>300 switches), EBGP is preferred due to better scalability and reduced complexity. FALSE.

D. It is recommended that all devices be planned in Area 0: This is false. While a single Area 0 is

possible for small DCNs, multi-area OSPF is recommended for larger networks to manage scalability

and reduce routing table size, avoiding a flat Area 0 design. FALSE.

Thus, A and B are true statements about OSPF routing design in a DC underlay.

Reference: Huawei CloudFabric Data Center Network Solution – Underlay Design; HCIP-Data Center

Network Training – OSPF in DCN.