VXLAN uses the VXLAN Network Identifier (VNI) to identify and isolate virtual Layer 2 or Layer 3 networks in an overlay environment. The VNI field is 24 bits long , which allows a theoretical maximum of 2²⁴ (approximately 16 million) VNIs . This is a significant improvement over traditional VLAN technology, which supports only 4094 VLAN IDs, and is one of the main reasons VXLAN is adopted in large-scale campus and data center networks.

It is correct that a tenant can be mapped to one or more VNIs . For example, a tenant may use multiple VNIs to represent different broadcast domains or service segments, such as separate VNIs for different subnets or application tiers. However, the statement becomes incorrect when it claims that VXLAN supports a maximum of 12 million tenants .

VXLAN does not directly define a fixed maximum number of tenants. VNIs represent virtual networks, not tenants themselves. The actual number of tenants supported depends on how VNIs are allocated and how the network design maps tenants to VNIs. In theory, the upper limit of VNIs is close to 16 million, not 12 million, and the number of tenants is typically much lower and design-dependent.

Therefore, while the description of VNIs being 24 bits long is correct, the conclusion about supporting a maximum of 12 million tenants is incorrect, making the overall statement false.

Comprehensive and Detailed Explanation (200–250 words):

In an iMaster NCE-Campus policy control matrix, rows represent source security groups and columns represent destination security groups . A green check mark indicates that communication is allowed, while a red cross indicates that communication is denied. This matrix enables fine-grained user access control in VXLAN-based virtualized campus networks.

From the figure, communication between Guest_Group and Research_Group is explicitly denied in both directions, as indicated by red crosses. Therefore, statements A and D are both correct. The matrix also shows a green check mark for Sales_Group communicating with itself , meaning intra-group communication is permitted, making statement B correct .

The unknown group represents users that are not classified into Guest_Group, Research_Group, or Sales_Group. In the matrix, the unknown group is not completely blocked from all resources by default; access behavior depends on explicit policy configuration. Since the figure does not indicate a universal deny policy for unknown users toward all destinations, statement C is incorrect .

According to HCIP Datacom Campus Network policy control design, security group–based access control allows administrators to precisely define which user groups can communicate, improving security and service isolation. Hence, the correct answers are A, B, and D .

BGP EVPN is an extension of the BGP protocol designed to support large-scale Layer 2 and Layer 3 virtualization, such as VXLAN-based campus and data center networks. To achieve this, BGP EVPN defines multiple EVPN route types through BGP extensions, including MAC/IP Advertisement routes, Inclusive Multicast routes, Ethernet Segment routes, and IP Prefix routes. Therefore, statement A is correct.

In BGP EVPN, routing information is carried using the MP_REACH_NLRI (Multiprotocol Reachable Network Layer Reachability Information) attribute. EVPN-specific NLRI formats are encapsulated within MP_REACH_NLRI, making statement C correct.

Each EVPN route includes a Route Distinguisher (RD) , which is part of the EVPN NLRI itself. The RD is used to ensure route uniqueness across different EVPN instances. Since the EVPN NLRI is carried inside MP_REACH_NLRI, the RD is effectively carried through MP_REACH_NLRI as well, which makes statement B correct.

Statement D is incorrect. Route Targets (RTs) are not carried in MP_REACH_NLRI. Instead, RTs are transmitted using BGP extended community attributes , which control route import and export policies between EVPN instances. RTs are used for VPN membership control, not for route reachability advertisement.

In summary, BGP EVPN relies on BGP extensions and MP_REACH_NLRI to transport EVPN routing information and RDs, while RTs are carried separately as extended community attributes. Hence, the correct answers are A, B, and C.

In a VXLAN BGP EVPN network, different EVPN route types are used to advertise specific kinds of control-plane information. BGP EVPN Type 2 routes , also known as MAC/IP Advertisement routes , are primarily used to advertise Layer 2 and host-level Layer 3 reachability information between VTEPs.

According to HCIP Datacom Campus Network documentation, a Type 2 route carries MAC address information , and it can optionally carry a host IP address associated with that MAC. This enables efficient MAC learning and ARP suppression within the VXLAN fabric. The L2VNI is also included in Type 2 routes, as it identifies the Layer 2 broadcast domain to which the MAC and IP information belongs.

The L3VNI is not used to identify a Layer 2 broadcast domain but is associated with Layer 3 VPN forwarding and inter-VNI routing. While L3VNI information is relevant in EVPN-based Layer 3 services, it is not the primary identifier in a Type 2 route. However, the key distinction in this question lies in the difference between host routes and prefix routes.

An IP prefix represents a network segment rather than a single host and is advertised using EVPN Type 5 (IP Prefix) routes , not Type 2 routes. Type 2 routes only carry host IP addresses, not IP prefixes. Therefore, IP Prefix is not carried in a BGP EVPN Type 2 route, making option C the correct answer.

In BGP EVPN-based VXLAN networks, route advertisement follows clearly defined standards regarding how endpoint and tunnel information is carried. According to HCIP Datacom Campus Network documentation, BGP EVPN does not use an EVPN Router MAC Extended Community to advertise the Router MAC of a VTEP . This statement is therefore incorrect.

In EVPN, different route types serve specific purposes. For example, EVPN Route Type 2 (MAC/IP Advertisement routes) are used to advertise MAC addresses (and optionally IP addresses) of endpoints. These routes associate endpoint information with a VTEP by using the BGP next-hop attribute , which contains the VTEP IP address. Similarly, EVPN Route Type 3 (Inclusive Multicast Ethernet Tag routes) also relies on the BGP next hop to identify the VTEP for VXLAN tunnel establishment and BUM traffic forwarding.

The Router MAC of a VTEP is a local forwarding attribute , primarily used during VXLAN encapsulation and decapsulation on the device itself. It is not distributed through EVPN extended communities. While EVPN does define several extended communities for control and policy purposes, there is no standard or HCIP-defined “EVPN Router MAC Extended Community” used to carry the Router MAC field of a VTEP during route advertisement.

Therefore, based on HCIP Datacom Campus Network VXLAN EVPN principles, the statement is false.

In campus network architecture, the egress zone plays a critical role as the boundary between the internal campus network and external networks such as the Internet, WAN, or cloud services. According to HCIP Datacom Campus Network design principles, the egress zone must meet multiple functional and security requirements to ensure stable, secure, and flexible network operation.

First, network connectivity is a fundamental requirement. The egress zone must reliably connect the campus intranet to external networks, ensuring uninterrupted access to external resources and services. High availability and redundancy are often considered in this aspect to avoid single points of failure.

Second, network secure ensurance is essential. As the main security boundary, the egress zone must protect the campus network from external threats. This typically involves deploying security mechanisms such as firewalls, intrusion prevention, traffic filtering, and attack defense to ensure data and service security.

Third, the egress zone must provide strong service control capability . This includes traffic identification, policy-based forwarding, bandwidth management, and application control. These capabilities allow administrators to optimize service quality, prioritize critical applications, and manage user access to external services.

Finally, various and flexible access modes are required to support different external connection scenarios, such as Internet access, MPLS WAN access, VPN connections, and cloud interconnection. This flexibility enables the campus network to adapt to evolving business and service requirements.

Therefore, all listed options are essential requirements for proper egress zone design, making A, B, C, and D the correct answers.

In VXLAN BGP EVPN, different EVPN route types carry different kinds of reachability information. The displayed entries are IP prefix routes because each record shows an IP prefix and prefix length (for example, 172.16.2.0:24 and 192.168.122.0:30) rather than a MAC address with a host /32. In HCIP Datacom Campus Network VXLAN EVPN, such network-segment routes are advertised using EVPN Route Type 5 (IP Prefix Route) . Type 5 routes are used to distribute Layer 3 reachability between VTEPs for inter-subnet/inter-VRF routing, and they inherently carry network/mask information , which makes statement D correct.

These routes are associated with the L3 VXLAN forwarding plane , meaning they belong to the L3VNI (the VPN instance/VRF context). L3VNI is used for routing between IP subnets in an EVPN VXLAN fabric, while L2VNI is used for pure Layer 2 bridging within a broadcast domain. Because the entries shown are IP prefixes (not MAC learning information), they align with L3VNI-based routing , so statement B is correct and statement A is incorrect.

Statement C is incorrect because Type 2 routes are MAC/IP Advertisement routes typically used for host reachability (often /32) and include MAC information, which is not present in these entries.

iMaster NCE-Campus supports multiple deployment modes to meet the needs of different enterprise customers, including on-premise deployment, MSP-owned cloud deployment, and Huawei public cloud deployment. The choice of deployment mode mainly depends on whether the customer wants to invest in infrastructure, manage the platform independently, or use a fully hosted service.

In this scenario, the supermarket chain explicitly does not want to purchase physical servers or software , which means an on-premise deployment is not suitable. On-premise mode requires customers to prepare hardware resources, install software, and maintain the system themselves. Similarly, an MSP-owned cloud deployment typically involves a managed service provider hosting the platform, which may still require contractual dependency on a third party and is not the most straightforward option for enterprises seeking minimal investment and simplified operations.

According to HCIP Datacom Campus Network documentation, the Huawei public cloud deployment is recommended for customers who want a cloud-based, subscription-oriented solution . In this mode, iMaster NCE-Campus is hosted and operated on Huawei Cloud. Customers only need to register and subscribe to the service, without purchasing servers, storage, or management software. Huawei is responsible for system maintenance, upgrades, security, and high availability.

This deployment model is especially suitable for retail chains and multi-branch enterprises , such as supermarkets, because it enables centralized management of geographically distributed branch networks with low initial investment and fast rollout.

Therefore, the recommended deployment mode in this case is Huawei public cloud , making option C the correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Encapsulating Security Payload (ESP) is one of the core IPsec protocols used to protect data confidentiality, integrity, and authenticity. To prevent replay attacks, ESP includes a Sequence Number field in its header. This field plays a critical role in ensuring packet freshness.

Each ESP packet carries a monotonically increasing sequence number assigned by the sender. The receiving device maintains a sliding window and checks incoming packets against this window. If a packet arrives with a sequence number that has already been received or falls outside the valid window, the packet is considered a replay and is discarded. This mechanism effectively protects the network against replay attacks, where attackers capture legitimate packets and retransmit them to disrupt communication or bypass security controls.

The SPI (Security Parameters Index) identifies the security association used for the packet but does not provide replay protection. The Next Header field indicates the type of payload carried in the ESP packet. Authentication Data ensures packet integrity and data origin authentication but does not independently prevent replay attacks without the sequence number mechanism.

According to HCIP Datacom Campus Network documentation and IPsec standards, replay protection in ESP is implemented using the Sequence Number field, making option A the correct answer.

DHCP is a core protocol used in campus networks to automatically assign IP addresses and deliver network parameters to hosts, improving deployment efficiency and simplifying address management. DHCP messages include several fixed fields and an Options field , which plays a critical role in parameter delivery.

Option A is false . Even if only gateway and DNS server information needs to be delivered to a client, the DHCP Offer message must carry the Options field . Default gateway and DNS server information are delivered through specific DHCP options, such as Option 3 (Router) and Option 6 (DNS Server). Without the Options field, these parameters cannot be conveyed to the client.

Option B is correct. The Options field in DHCP messages uses a TLV (Type-Length-Value) format, allowing flexible extension and supporting various network parameters, including NTP server addresses, wireless AC addresses, and log server addresses, which aligns with HCIP Datacom Campus Network descriptions.

Option C is also correct. DHCP supports static IP address allocation by binding a specific IP address to a client’s MAC address. This is commonly used for printers, servers, or network devices that require fixed IP addresses.

Option D is correct as well. Because DHCP uses broadcast messages that cannot cross Layer 3 boundaries, a DHCP relay agent is required when the client and server reside on different IP networks.

Therefore, option A is the only incorrect statement.