H12-841_V1.5 HCIP-Datacom-Campus Network Planning and Deployment V1.5 Questions and Answers

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In the Huawei CloudCampus virtualized campus architecture, aVirtual Network (VN)is a logical service container used to isolate different types of services and user traffic. When a VN is created on iMaster NCE-Campus, it is internally mapped to aVPN instanceon network devices. This VPN instance provides traffic isolation at the control plane and forwarding plane levels.

Each VN has its own independent routing table and forwarding context, ensuring that traffic belonging to different services cannot interfere with each other unless explicitly permitted through policy. This mechanism is similar to traditional VPN technologies and is fundamental to service segmentation in VXLAN-based campus networks.

According to HCIP Datacom Campus Network documentation, creating a VN effectively achieves service isolation in the same way as creating a VPN instance. Therefore, the statement is TRUE.

Comprehensive and Detailed Explanation (200–250 words):

In an iMaster NCE-Campus policy control matrix, rows representsource security groupsand columns representdestination security groups. A green check mark indicates that communication is allowed, while a red cross indicates that communication is denied. This matrix enables fine-grained user access control in VXLAN-based virtualized campus networks.

From the figure, communication betweenGuest_Group and Research_Groupis explicitly denied in both directions, as indicated by red crosses. Therefore, statementsAandDare both correct. The matrix also shows a green check mark forSales_Group communicating with itself, meaning intra-group communication is permitted, makingstatement B correct.

Theunknowngroup represents users that are not classified into Guest_Group, Research_Group, or Sales_Group. In the matrix, the unknown group is not completely blocked from all resources by default; access behavior depends on explicit policy configuration. Since the figure does not indicate a universal deny policy for unknown users toward all destinations,statement C is incorrect.

According to HCIP Datacom Campus Network policy control design, security group–based access control allows administrators to precisely define which user groups can communicate, improving security and service isolation. Hence, the correct answers areA, B, and D.

In VXLAN BGP EVPN, different EVPN route types carry different kinds of reachability information. The displayed entries areIP prefix routesbecause each record shows anIP prefix and prefix length(for example, 172.16.2.0:24 and 192.168.122.0:30) rather than a MAC address with a host /32. In HCIP Datacom Campus Network VXLAN EVPN, such network-segment routes are advertised usingEVPN Route Type 5 (IP Prefix Route). Type 5 routes are used to distributeLayer 3 reachabilitybetween VTEPs for inter-subnet/inter-VRF routing, and they inherently carrynetwork/mask information, which makes statement D correct.

These routes are associated with theL3 VXLAN forwarding plane, meaning they belong to theL3VNI(the VPN instance/VRF context). L3VNI is used for routing between IP subnets in an EVPN VXLAN fabric, while L2VNI is used for pure Layer 2 bridging within a broadcast domain. Because the entries shown are IP prefixes (not MAC learning information), they align withL3VNI-based routing, so statement B is correct and statement A is incorrect.

Statement C is incorrect becauseType 2routes are MAC/IP Advertisement routes typically used for host reachability (often /32) and include MAC information, which is not present in these entries.

Comprehensive and Detailed Explanation (200–250 words):

In a VXLAN-based virtualized campus network, user terminals located in different access locations communicate with each other overVXLAN tunnelsestablished between VXLAN Tunnel Endpoints (VTEPs). These VXLAN tunnels form the overlay network, which abstracts the physical underlay and enables flexible Layer 2 and Layer 3 connectivity across the campus.

When communication is confined within the virtualized campus network, traffic remains inside the VXLAN overlay and is encapsulated and forwarded between VTEPs. However, when users or services inside the VXLAN network need to accessexternal networks, such as traditional IP networks, the Internet, or data centers that do not support VXLAN, traffic must exit the VXLAN overlay. This function is performed byborder nodes.

Border nodes act as the boundary between the VXLAN overlay and non-VXLAN networks. They are responsible for VXLAN encapsulation and decapsulation, routing between VXLAN segments and external networks, and enforcing security and policy controls at the network edge. According to HCIP Datacom Campus Network architecture principles, all traffic entering or leaving the VXLAN-based campus must pass through border nodes to ensure proper routing, policy enforcement, and service control.

Therefore, the statement is TRUE, and option A is correct.

iMaster NCE-Campus is Huawei’s centralized management and control platform specifically designed forcampus network scenarios. According to HCIP Datacom Campus Network documentation, its primary purpose is to provide unified planning, automated deployment, policy control, and intelligent O&M for campus environments. Therefore,campus networksare one of the most typical and core deployment scenarios for iMaster NCE-Campus.

In addition, iMaster NCE-Campus is widely used to deployVXLAN Fabric networkswithin campuses. VXLAN Fabric is a key technology for building scalable, virtualized, and multi-tenant campus networks. iMaster NCE-Campus simplifies VXLAN Fabric deployment by automating underlay and overlay configuration, VN creation, VNI assignment, and BGP EVPN policy distribution. This makes VXLAN Fabric networks another standard and typical deployment scenario supported by the platform.

Branch networksare not considered a typical deployment scenario for iMaster NCE-Campus. Branch network management is usually handled by iMaster NCE-WAN in SD-WAN solutions, which focuses on WAN connectivity, branch access, and centralized WAN control rather than campus-oriented services.

Similarly,small-sized networksare not defined as a deployment scenario category in iMaster NCE-Campus documentation. The platform is designed for medium to large campus environments where centralized management and automation provide the most value.

Therefore, the typical deployment scenarios when using iMaster NCE-Campus areCampus networksandVXLAN Fabric networks, making optionsA and Bthe correct answers.

In HCIP Datacom Campus Network VXLAN architecture, VXLAN tunnels are classified based onhow the tunnel endpoints are created and maintained, which is referred to as the VXLAN tunnel creation mode. According to Huawei VXLAN design principles, there aretwo valid VXLAN tunnel types: static VXLAN tunnels and dynamic VXLAN tunnels.

Astatic VXLAN tunnelis manually configured by an administrator. In this mode, the source VTEP IP address, destination VTEP IP address, and related parameters are explicitly specified on devices. Static VXLAN tunnels are typically used in small-scale networks or test environments where the number of VTEPs is limited and network topology is simple. However, static configuration lacks scalability and flexibility, making it unsuitable for large campus fabrics.

Adynamic VXLAN tunnelis automatically created based on control-plane learning mechanisms, such asBGP EVPN. In this mode, VTEPs learn remote VTEP IP addresses dynamically through EVPN route advertisements (for example, Type 3 routes). When a remote VTEP becomes reachable at the underlay Layer 3 level, the VXLAN tunnel is automatically established without manual intervention. This mode is widely used in modern campus and data center networks due to its scalability and automation capabilities.

Options A and D are incorrect becausestatelessandstatefulare not official VXLAN tunnel creation classifications in Huawei’s VXLAN implementation. VXLAN itself is an encapsulation mechanism, and tunnel state is not categorized in this manner.

Therefore, the correct VXLAN tunnel types based on creation mode arestatic VXLAN tunnels and dynamic VXLAN tunnels.

In Huawei campus WLAN solutions, different WLAN architectures are designed to meet varying network scales, cost requirements, and management complexity. The architecture described in this question matches theLeader APsolution.

ALeader APcan operate independently without a dedicated wireless controller, while also having the capability to manage asmall number of subordinate APs. The Leader AP takes on lightweight control functions, such as basic configuration management and simple roaming coordination among the managed APs. This allows wireless users to roam between APs with minimal service interruption, meeting basic mobility requirements.

According to HCIP Datacom Campus Network documentation, the Leader AP architecture is characterized bylow deployment cost and simple maintenance. Since no separate AC is required and the number of APs is limited, network planning and configuration are straightforward. This significantly reduces the technical skill level required for daily operation and maintenance, making it suitable for small campuses, retail stores, branch offices, and small enterprises.

In contrast,Fat APsoperate completely independently and do not support centralized roaming management.AC + Fit AParchitectures are designed for medium to large networks and require higher investment and professional maintenance.Agile distributed APsolutions focus on centralized APs and RUs, which do not align with the independent AP management described.

Therefore, the WLAN architecture that best fits the given characteristics isLeader AP, making optionAthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Authentication Header (AH) is one of the core IPsec security protocols and is designed to provideauthentication and integrity protectionfor IP packets. AH ensures that the received packet is from a legitimate sender and that the packet has not been altered during transmission.

AH supportsdata origin authenticationby verifying the identity of the sender using cryptographic algorithms. It also providesdata integrity checking, ensuring that packet contents are not modified in transit. Additionally, AH supportsanti-replay protectionby using sequence numbers to prevent attackers from capturing and retransmitting valid packets.

However, AHdoes not provide data encryption. All packet contents, including payload data, remain visible on the network. This limitation is inherent to the AH protocol design and is one of the main reasons ESP is more widely used in modern IPsec deployments.

According to HCIP Datacom Campus Network documentation, if confidentiality through encryption is required, ESP must be used instead of AH. Therefore, the function not supported by AH is data encryption, making option D the correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In the Huawei CloudCampus Solution, devices such as switches and APs support multipleprovisioning modesto integrate with iMaster NCE-Campus, including Web interface provisioning, CLI-based provisioning, and registration center query. These methods allow devices to obtain controller information and register successfully.

Firewalls, however, have stricter provisioning mechanisms due to security considerations. They do not supportDHCP Option 148, which is commonly used by switches and APs to automatically discover the management controller.

Instead, firewalls must be provisioned manually through the Web interface or CLI, or discovered via registration center mechanisms. According to HCIP Datacom Campus Network documentation,DHCP Option 148 is not supported by firewalls, makingoption Cthe correct answer.

In the Huawei CloudCampus Solution, the architecture is typically divided into themanagement layerand thenetwork layer. The management layer, represented by platforms such as iMaster NCE-Campus, is responsible for centralized configuration, monitoring, policy delivery, and intelligent O&M. Communication between these two layers relies on standardizedmanagement and control protocols.

NETCONFis a key protocol used between the management layer and network devices. It provides a structured and reliable mechanism for delivering configurations, querying device status, and performing automated service deployment. NETCONF works closely with data models to ensure consistency and accuracy in configuration management.

SNMPis also widely used in the CloudCampus Solution for monitoring and fault management. Through SNMP, network devices report performance data, alarms, and status information to the management platform, enabling real-time visibility and proactive maintenance.

YANGis not a transport protocol but a data modeling language; however, it plays a critical role in management-layer communication. YANG models define the structure of configuration and operational data exchanged between the controller and devices, typically carried over NETCONF. Therefore, YANG-related information is effectively exchanged between the management and network layers.

RADIUS, on the other hand, is used for user authentication, authorization, and accounting. It operates between network devices and authentication servers, not between the management layer and the network layer.

Thus, the correct options areNETCONF, SNMP, and YANG.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Huawei iMaster NCE-Campus supports advanced networking solutions tailored for industry-specific scenarios, including thefinancial SD-WAN SRv6 solution. This solution leverages Segment Routing over IPv6 (SRv6) to enable precise traffic steering, deterministic forwarding, and end-to-end service scheduling across the network.

Because SRv6 introduces enhanced forwarding capabilities and control-plane features beyond standard campus networking functions, Huawei licenses these capabilities separately. To activate SRv6-based financial SD-WAN features on iMaster NCE-Campus, customers must obtain theSRv6 function package license. Without this license, SRv6-specific orchestration, scheduling, and optimization functions cannot be enabled.

According to HCIP Datacom Campus Network documentation, licensing ensures controlled feature activation and aligns with Huawei’s modular service enablement strategy. Therefore, the statement is TRUE, and option A is correct.

In IPsec VPN deployment, NAT traversal (NAT-T) is a critical mechanism used when one or both IPsec gateways are located behind a NAT device. Traditional ESP packets use IP protocol number 50 and do not contain TCP or UDP port numbers, which causes problems for NAT devices that rely on port information to maintain session mappings. As a result, ESP packets may be dropped by the NAT device.

During IKE negotiation, the two gateways detect whether a NAT device exists between them by exchanging NAT-detection payloads. If NAT is detected,NAT traversal is automatically enabled. When NAT-T is active, ESP packets are encapsulated insideUDP packetsso that they can traverse the NAT device successfully.

According to HCIP Datacom Campus Network security documentation, when ESP is encapsulated using NAT-T,both the source and destination UDP port numbers are set to 4500. UDP port 4500 is the standardized port reserved specifically for IPsec NAT traversal. This allows NAT devices to correctly track sessions and forward packets based on UDP port information.

Initially, IKE negotiations use UDP port 500. After NAT detection and NAT-T activation, subsequent IKE and ESP traffic switches toUDP port 4500. This encapsulation ensures compatibility with NAT environments while maintaining IPsec security.

Therefore, the correct value that enables ESP packets to pass through NAT devices is4500, which is a key operational detail in secure campus network VPN deployments.

In BGP EVPN-based VXLAN networks, route advertisement follows clearly defined standards regarding how endpoint and tunnel information is carried. According to HCIP Datacom Campus Network documentation,BGP EVPN does not use an EVPN Router MAC Extended Community to advertise the Router MAC of a VTEP. This statement is therefore incorrect.

In EVPN, different route types serve specific purposes. For example,EVPN Route Type 2 (MAC/IP Advertisement routes)are used to advertise MAC addresses (and optionally IP addresses) of endpoints. These routes associate endpoint information with a VTEP by using theBGP next-hop attribute, which contains the VTEP IP address. Similarly,EVPN Route Type 3 (Inclusive Multicast Ethernet Tag routes)also relies on the BGP next hop to identify the VTEP for VXLAN tunnel establishment and BUM traffic forwarding.

The Router MAC of a VTEP is alocal forwarding attribute, primarily used during VXLAN encapsulation and decapsulation on the device itself. It is not distributed through EVPN extended communities. While EVPN does define several extended communities for control and policy purposes, there is no standard or HCIP-defined “EVPN Router MAC Extended Community” used to carry the Router MAC field of a VTEP during route advertisement.

Therefore, based on HCIP Datacom Campus Network VXLAN EVPN principles, the statement is false.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

IKEv1 negotiation consists of two phases.Phase 1is responsible for establishing a secure IKE Security Association (SA), including peer authentication, key exchange, and protection of subsequent negotiations. In Huawei IPsec implementations, IKEv1 Phase 1 supportsMain modeandAggressive mode.

Main modeuses six message exchanges to securely negotiate parameters, protect identity information, and establish a trusted channel. It provides higher security and is commonly used in site-to-site IPsec VPN scenarios.Aggressive mode, on the other hand, completes negotiation using only three message exchanges, offering faster setup at the cost of reduced identity protection.

Quick modeis not part of IKEv1 Phase 1; it is used inPhase 2to negotiate IPsec SAs for data traffic protection.Normal modeis not a valid IKEv1 negotiation mode.

According to HCIP Datacom Campus Network documentation and standard IPsec principles, the supported IKEv1 Phase 1 negotiation modes areMain mode and Aggressive mode, makingoptions B and Ccorrect.

iMaster NCE-Campus supports multiple deployment modes to meet the needs of different enterprise customers, including on-premise deployment, MSP-owned cloud deployment, and Huawei public cloud deployment. The choice of deployment mode mainly depends on whether the customer wants to invest in infrastructure, manage the platform independently, or use a fully hosted service.

In this scenario, the supermarket chain explicitlydoes not want to purchase physical servers or software, which means an on-premise deployment is not suitable. On-premise mode requires customers to prepare hardware resources, install software, and maintain the system themselves. Similarly, an MSP-owned cloud deployment typically involves a managed service provider hosting the platform, which may still require contractual dependency on a third party and is not the most straightforward option for enterprises seeking minimal investment and simplified operations.

According to HCIP Datacom Campus Network documentation, theHuawei public cloud deploymentis recommended for customers who want acloud-based, subscription-oriented solution. In this mode, iMaster NCE-Campus is hosted and operated on Huawei Cloud. Customers only need to register and subscribe to the service, without purchasing servers, storage, or management software. Huawei is responsible for system maintenance, upgrades, security, and high availability.

This deployment model is especially suitable forretail chains and multi-branch enterprises, such as supermarkets, because it enables centralized management of geographically distributed branch networks with low initial investment and fast rollout.

Therefore, the recommended deployment mode in this case isHuawei public cloud, making optionCthe correct answer.

VXLAN uses theVXLAN Network Identifier (VNI)to identify and isolate virtual Layer 2 or Layer 3 networks in an overlay environment. The VNI field is24 bits long, which allows a theoretical maximum of2²⁴ (approximately 16 million) VNIs. This is a significant improvement over traditional VLAN technology, which supports only 4094 VLAN IDs, and is one of the main reasons VXLAN is adopted in large-scale campus and data center networks.

It is correct thata tenant can be mapped to one or more VNIs. For example, a tenant may use multiple VNIs to represent different broadcast domains or service segments, such as separate VNIs for different subnets or application tiers. However, the statement becomes incorrect when it claims that VXLAN supports a maximum of12 million tenants.

VXLAN does not directly define a fixed maximum number of tenants. VNIs represent virtual networks, not tenants themselves. The actual number of tenants supported depends on how VNIs are allocated and how the network design maps tenants to VNIs. In theory, the upper limit of VNIs is close to 16 million, not 12 million, and the number of tenants is typically much lower and design-dependent.

Therefore, while the description of VNIs being 24 bits long is correct, the conclusion about supporting a maximum of 12 million tenants is incorrect, making the overall statement false.

In Huawei campus network access control solutions, different authentication methods are selected based onterminal capabilities, user mobility requirements, and service scenarios. According to HCIP Datacom Campus Network documentation,Portal authenticationandMAC address authenticationare designed for distinct use cases, and the statement correctly describes their recommended application scenarios.

Portal authenticationis well suited for environments withhigh user mobility and a wide variety of terminal types, such as shopping malls, supermarkets, airports, and exhibition centers. In these scenarios, users frequently connect and disconnect from the network using mobile phones, tablets, and laptops. Portal authentication provides a flexible and user-friendly access method, typically through a web page where users enter credentials, accept terms, or obtain temporary access. It does not require pre-installed client software and supports fast onboarding of diverse devices, making it ideal for public or semi-public access networks.

On the other hand,MAC address authenticationis recommended fordumb terminalsthat lack interactive user interfaces or browser capabilities. Devices such as printers, fax machines, IP phones, and some IoT terminals cannot complete Portal authentication. MAC authentication allows the network to authenticate these devices based on their MAC addresses, enabling automatic and seamless access once the MAC address is registered in the authentication system.

Using the appropriate authentication method improves user experience, simplifies network management, and enhances security. Therefore, the statement accurately reflects Huawei’s recommended authentication practices and isTRUE.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In anasymmetric IRB (Integrated Routing and Bridging)VXLAN forwarding model, Layer 2 forwarding and Layer 3 routing occur ondifferent VTEPs. When PC1 sends traffic to PC2, the packet is first forwarded to thelocal gateway (VBDIF interface)on VTEP1 for Layer 3 routing.

After routing is performed, VTEP1 encapsulates the packet into a VXLAN packet and forwards it to VTEP2. Importantly, theoriginal data frame inside the VXLAN packethas already been rewritten after routing. The destination MAC address in the original Ethernet frame is no longer the MAC address of PC2, but theMAC address of the next-hop gateway on the remote VTEP.

In the figure, this next-hop MAC address isMAC C, which belongs to the VBDIF interface on VTEP2. MAC D (PC2’s MAC address) is only used after the packet is decapsulated and forwarded locally by VTEP2.

According to HCIP Datacom Campus Network VXLAN forwarding behavior, the correct destination MAC address of the original data frame sent from VTEP1 to VTEP2 isMAC C, making optionCcorrect.

In a centralized VXLAN gateway architecture, all inter-subnet traffic is forwarded to a centralized Layer 3 gateway, typically deployed on a core or aggregation device. This design simplifies network planning, gateway configuration, and policy enforcement because routing, security, and traffic control are all handled at a single centralized point. From an operational perspective, deployment and management are straightforward, which makes centralized gateways suitable for small- to medium-sized campus networks or environments with limited endpoints.

However, according to HCIP Datacom Campus Network documentation, this architecture introduces scalability limitations. Since the centralized gateway performs Layer 3 forwarding for all VXLAN segments, it must maintain ARP entries for every terminal in the network. As the number of endpoints increases, the ARP table on the Layer 3 gateway grows rapidly. Hardware resources such as memory and processing capacity limit the maximum number of ARP entries that can be supported.

In large-scale campus scenarios with a high density of terminals—such as universities, hospitals, or enterprise office campuses—this ARP scalability bottleneck can impact performance and stability. Excessive ARP entries may lead to increased CPU utilization, delayed ARP resolution, and reduced forwarding efficiency. For such environments, HCIP Datacom recommends distributed VXLAN gateways, which distribute ARP and routing responsibilities across multiple devices. Therefore, the statement is correct, and the centralized VXLAN gateway is not suitable for scenarios with a large number of terminals.

In a VXLAN BGP EVPN deployment, interconnection between Layer 2 and Layer 3 networks relies onIntegrated Routing and Bridging (IRB). According to HCIP Datacom Campus Network documentation, for a VPN instance to advertise its IP routes to the BGP EVPN control plane, the device must explicitly enable IRB route advertisement in the BGP view.

Theadvertise irbcommand is used to allow IP routes learned in a VPN instance to be advertised as EVPN Type 5 (IP Prefix) routes. These routes enable communication between different VNIs or between VXLAN segments and external Layer 3 networks. Without this command, the VPN instance routes remain local and are not distributed through the EVPN control plane, preventing proper Layer 3 connectivity across the VXLAN fabric.

The other options are incorrect in this context. Theadvertise vpnv4command is used in traditional MPLS VPN scenarios, not in BGP EVPN-based VXLAN networks. Theadvertise irbv6command is specific to IPv6 IRB scenarios and does not apply to IPv4 route advertisement unless explicitly required. Theadvertise l2vpn evpncommand is used to enable the EVPN address family itself but does not control the advertisement of IP routes from a VPN instance.

Therefore, to enable a VPN instance to advertise IP routes to the BGP EVPN address family in a VXLAN network, the correct command isadvertise irb.

In campus network design, theegressis a critical point that connects the internal campus network to external networks such as the Internet or WAN. According to HCIP Datacom Campus Network architecture guidelines, ensuringhigh reliability at the egressis essential, even for small- and medium-sized campus networks, because external connectivity directly affects business continuity.

Deployingmulti-carrier linksat the egress is a recommended design practice to enhance reliability. Multi-carrier links refer to connecting the campus network todifferent service providersor independent external links. If one carrier experiences a failure, congestion, or maintenance issue, traffic can be switched to the backup carrier, ensuring uninterrupted external access. This approach significantly reduces the risk of service disruption caused by single-link or single-carrier failures.

For small- and medium-sized campuses, full redundancy with complex architectures may not be cost-effective. Multi-carrier backup links provide acost-efficient and practical solutionthat balances reliability and investment. Technologies such as static route backup, dynamic routing protocols, or policy-based routing can be used to implement automatic failover at the egress.

HCIP Datacom documentation emphasizes that egress reliability is not only a concern for large networks. Even smaller campuses require stable Internet and WAN access for cloud services, remote access, and centralized management platforms. Therefore, deploying multi-carrier links as backup at the egress is a valid and recommended design strategy.

Hence, the statement isTRUE.

In the Huawei CloudCampus Solution, switches must be able toautomatically connect to and be managed by iMaster NCE-Campus. To achieve this, Huawei provides specificdeployment and onboarding modesthat allow switches to discover the controller and establish a management relationship. According to HCIP Datacom Campus Network documentation, Huawei switches supportHuawei registration centerandDHCP Option 148as standard deployment modes.

TheHuawei registration centeris a cloud-based mechanism that enables devices to automatically register with iMaster NCE-Campus after they are powered on and connected to the network. Once registered, the controller can identify, authenticate, and centrally manage the switches without requiring manual configuration. This mode is commonly used in cloud-managed or large-scale deployments where zero-touch provisioning is required.

DHCP Option 148is another supported deployment mode. Through this option, the DHCP server provides the address information of iMaster NCE-Campus to the switch during IP address allocation. After receiving this information, the switch automatically establishes a management connection with the controller. This method is widely used in enterprise campus environments where DHCP services are already available.

In contrast, theWeb interfaceandCLIare local device management methods, not deployment modes in the CloudCampus architecture. They are mainly used for basic configuration, troubleshooting, or initial setup, rather than for controller-based deployment.

Therefore, the correct deployment modes supported by Huawei switches in the CloudCampus Solution areHuawei registration centerandDHCP Option 148.

The command output shows an EVPNRoute Type 2 (MAC Advertisement Route), which is used in VXLAN BGP EVPN fabrics to advertise host reachability information. The route clearly carries both aMAC address(b0d5-9dc7-3c41/48) and ahost IP address(172.16.1.173/32). In HCIP Datacom Campus Network VXLAN design, when a Type 2 route includes both MAC and IP information, it is classified as anIRB (Integrated Routing and Bridging) Type 2 route, enabling distributed gateways to perform Layer 2 forwarding and Layer 3 routing based on the same control-plane information. Therefore, statement A is correct.

Statement B is incorrect because ARP-related learning is not represented as a separate “ARP Type 2” EVPN route. EVPN uses MAC/IP Advertisement routes to distribute host reachability, not ARP-only route types.

Statement C is correct. The route containsRoute Target extended communities RT 0:2 and RT 0:3, which control EVPN route import. Any VPN instance configured with an import RT of 0:2 or 0:3 can successfully import this route and learn the corresponding host MAC and IP information.

Statement D is also correct. The output explicitly showsRT extended communitiesand theEVPN Router’s MACextended community. These attributes are essential for VXLAN tunnel identification, split-horizon forwarding, and correct EVPN operation in a campus fabric.

Hence, the correct answers are A, C, and D.

In Huawei campus networks, access authentication and authorization are implemented based on the AAA framework. After a user is successfully authenticated, the network enforces anauthorization result, which defines what network resources the user is allowed to access and how traffic is controlled. These authorization results are typically delivered by the authentication server or configured locally on network devices.

According to HCIP Datacom Campus Network documentation,authorization results focus on policy and access control attributes, not basic network parameter assignment. Common authorization items includeVLAN assignment,security group assignment, andACL application. VLANs determine the user’s logical network location, security groups enable group-based policy control, and ACLs restrict or permit traffic based on predefined rules. These elements directly affect access permissions and security enforcement.

AnIP address, however, does not need to be defined in the authorization result. In campus networks, IP addresses are usually assigned dynamically throughDHCP, either by a DHCP server or a DHCP relay function on network devices. The IP address allocation process is independent of user authorization and does not represent an access control policy.

Separating IP address assignment from authorization simplifies network design and improves scalability. It allows users to obtain IP addresses automatically while access rights are enforced consistently through identity-based policies. Therefore, among the given options,IP addressis not an item that must be defined in the authorization result.

Hence, the correct answer isB.

Position 1 → Before authenticationBefore users are authenticated, they are placed in thepre-authentication domain. At this stage, access is strictly limited to basic network services such as theAdmission server,DHCP server, andDNS server. This allows users to obtain IP addresses and reach authentication-related services only.

Position 2 → Upon authentication failuresIf user authentication fails or security posture checks (such as antivirus or patch verification) do not pass, users are redirected to theisolation domain. In this domain, access is restricted to remediation resources likevirus signature database serversandpatch servers, preventing users from accessing business services while allowing problem resolution.

Position 3 → After successful authenticationAfter authentication succeeds, users enter thepost-authentication domain. At this stage, full or role-based access is granted to enterprise resources such asoffice data,R&D data,marketing systems, as well asintranet or Internet services, based on assigned policies.

This mapping reflects Huawei’s standardNAC domain-based access control model, ensuring secure, staged network access.

In this scenario, O&M personnel need toview packet exchange processesduring Wi-Fi access and precisely locate the root cause of the failure. According to HCIP Datacom Campus Network documentation, theProtocol Tracefunction of iMaster NCE-CampusInsight is specifically designed for this purpose.

Protocol trace allows administrators to analyzereal packet interaction processesbetween clients, APs, gateways, and servers during key access phases such as authentication, IP address assignment, and service establishment. By tracing protocols like DHCP, ARP, and authentication exchanges, O&M personnel can clearly identify where the access process fails.

In the given case, mobile terminals fail to obtain IP addresses due toDHCP address pool exhaustion. This problem can only be accurately identified by observing the DHCP request and response flow, such as repeated DHCP Discover messages without successful Offer messages. Protocol trace visualizes this interaction step by step, making it easy to confirm that the DHCP server cannot allocate new IP addresses.

Other options do not match the scenario.Simulation feedbackis used to simulate access behavior rather than analyze real traffic.Issue analysisfocuses on aggregated fault statistics and trend analysis, not detailed packet-level inspection.Client journeytracks the overall user access path and experience stages but does not provide deep protocol packet visibility.

Therefore, the function used by O&M personnel to view packet exchange processes and identify DHCP pool exhaustion isProtocol trace, making optionAthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In campus networks, devices such as servers, print servers, and video surveillance systems requirestable and predictable IP addressesto ensure reliable access, simplified maintenance, and consistent policy enforcement. While fully dynamic DHCP allocation is easy to deploy, it does not guarantee IP address consistency, which complicates device management, monitoring, and troubleshooting.

Huawei campus network design best practices recommendstatic address allocation through DHCP based on MAC addresses, also known as DHCP reservation or static binding. With this approach, the DHCP server assigns a fixed IP address to a device according to its MAC address. This method combines the advantages of centralized DHCP management with the stability of static IP addresses.

PPPoE address binding is typically used in broadband access scenarios and is unsuitable for enterprise campus devices. The BOOT protocol is obsolete and not used in modern campus networks. Pure dynamic DHCP allocation does not meet the stability requirements of infrastructure and service devices.

According to HCIP Datacom Campus Network documentation, MAC-based DHCP static allocation is the recommended solution for managing critical campus devices, making option D correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a CloudCampus virtualized campus network,Virtual Networks (VNs)provide service isolation, whilesecurity groupsenable identity-based access control. Even when inter-VN routing is technically available, communication between users in different VNs isnot permitted by default. Access permissions are controlled bysecurity group–based policies.

To allowR&D personnel and sales personnelto communicate, the network administrator must explicitly define thesecurity policy relationshipbetween the two security groups. This is achieved by deploying apolicy control matrixon iMaster NCE-Campus. The policy control matrix specifies whether traffic between source and destination security groups is allowed or denied and enforces the policy on relevant network devices.

Deploying an external network is unnecessary because communication is required within the campus network. Configuring access management relates to authentication and authorization during network access, not inter-group communication control. Configuring inter-VN communication enables routing capability but does not definewhethercommunication is permitted at the security policy level.

According to HCIP Datacom Campus Network documentation,security group communication permissions are controlled through the policy control matrix, making optionAthe correct task to meet the requirement.