Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In an asymmetric IRB (Integrated Routing and Bridging) VXLAN forwarding model, Layer 2 forwarding and Layer 3 routing occur on different VTEPs . When PC1 sends traffic to PC2, the packet is first forwarded to the local gateway (VBDIF interface) on VTEP1 for Layer 3 routing.

After routing is performed, VTEP1 encapsulates the packet into a VXLAN packet and forwards it to VTEP2. Importantly, the original data frame inside the VXLAN packet has already been rewritten after routing. The destination MAC address in the original Ethernet frame is no longer the MAC address of PC2, but the MAC address of the next-hop gateway on the remote VTEP .

In the figure, this next-hop MAC address is MAC C , which belongs to the VBDIF interface on VTEP2. MAC D (PC2’s MAC address) is only used after the packet is decapsulated and forwarded locally by VTEP2.

According to HCIP Datacom Campus Network VXLAN forwarding behavior, the correct destination MAC address of the original data frame sent from VTEP1 to VTEP2 is MAC C , making option C correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

IKEv1 negotiation consists of two phases. Phase 1 is responsible for establishing a secure IKE Security Association (SA), including peer authentication, key exchange, and protection of subsequent negotiations. In Huawei IPsec implementations, IKEv1 Phase 1 supports Main mode and Aggressive mode .

Main mode uses six message exchanges to securely negotiate parameters, protect identity information, and establish a trusted channel. It provides higher security and is commonly used in site-to-site IPsec VPN scenarios. Aggressive mode , on the other hand, completes negotiation using only three message exchanges, offering faster setup at the cost of reduced identity protection.

Quick mode is not part of IKEv1 Phase 1; it is used in Phase 2 to negotiate IPsec SAs for data traffic protection. Normal mode is not a valid IKEv1 negotiation mode.

According to HCIP Datacom Campus Network documentation and standard IPsec principles, the supported IKEv1 Phase 1 negotiation modes are Main mode and Aggressive mode , making options B and C correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In the Huawei CloudCampus virtualized campus architecture, a Virtual Network (VN) is a logical service container used to isolate different types of services and user traffic. When a VN is created on iMaster NCE-Campus, it is internally mapped to a VPN instance on network devices. This VPN instance provides traffic isolation at the control plane and forwarding plane levels.

Each VN has its own independent routing table and forwarding context, ensuring that traffic belonging to different services cannot interfere with each other unless explicitly permitted through policy. This mechanism is similar to traditional VPN technologies and is fundamental to service segmentation in VXLAN-based campus networks.

According to HCIP Datacom Campus Network documentation, creating a VN effectively achieves service isolation in the same way as creating a VPN instance. Therefore, the statement is TRUE.

In HCIP Datacom Campus Network security design, port security is used to limit the number of MAC addresses that can be learned on an access interface, preventing unauthorized device access and MAC address spoofing. When the number of learned MAC addresses reaches the configured upper limit, the switch behavior depends on the configured violation mode .

One possible action is shutdown mode , where the switch sets the interface to an error-down state and generates an alarm. This corresponds to option A. The interface must be manually or automatically recovered before normal communication can resume. This mode provides the highest level of security and clear fault notification.

Another supported behavior is protect mode , in which the switch silently discards packets from unknown source MAC addresses after the limit is reached. No alarms are generated in this case, which matches option C. This mode minimizes network disruption while still blocking unauthorized devices.

The restrict mode is also supported. In this mode, the switch discards packets with unknown source MAC addresses and generates an alarm or log entry, corresponding to option D. This allows administrators to detect violations without shutting down the interface.

Option B is incorrect because when an interface enters the error-down state due to a port security violation, an alarm or log notification is always generated according to HCIP Datacom Campus Network behavior. Therefore, the valid actions are A, C, and D.

SNMP and NETCONF are both commonly used network management protocols in campus networks, but they differ significantly in architecture, capabilities, and configuration management mechanisms. According to HCIP Datacom Campus Network documentation, NETCONF is designed for modern, model-driven network management , while SNMP is mainly used for monitoring and simple management.

Option A is incorrect because although both protocols use a client/server model, their roles are different. In SNMP, the managed device operates as an SNMP agent (server), while the NMS acts as the client. In NETCONF, the network device functions as the NETCONF server, and the management system is the client, not the other way around.

Option B is also incorrect because SNMP manages data using MIBs, whereas NETCONF uses data models , typically based on YANG, instead of MIBs.

Option D is incorrect because SNMP does not support multiple configuration databases. It mainly provides basic read and write operations and is not suitable for complex configuration management or rollback.

Option C is correct. NETCONF provides a locking mechanism that allows a client to lock a configuration datastore during configuration changes. This prevents multiple users or systems from modifying the same configuration simultaneously, avoiding conflicts and ensuring configuration consistency. This capability is a key advantage of NETCONF in intelligent campus network management and aligns with HCIP Datacom Campus Network best practices.

The command output shows an EVPN Route Type 2 (MAC Advertisement Route) , which is used in VXLAN BGP EVPN fabrics to advertise host reachability information. The route clearly carries both a MAC address (b0d5-9dc7-3c41/48) and a host IP address (172.16.1.173/32). In HCIP Datacom Campus Network VXLAN design, when a Type 2 route includes both MAC and IP information, it is classified as an IRB (Integrated Routing and Bridging) Type 2 route , enabling distributed gateways to perform Layer 2 forwarding and Layer 3 routing based on the same control-plane information. Therefore, statement A is correct.

Statement B is incorrect because ARP-related learning is not represented as a separate “ARP Type 2” EVPN route. EVPN uses MAC/IP Advertisement routes to distribute host reachability, not ARP-only route types.

Statement C is correct. The route contains Route Target extended communities RT 0:2 and RT 0:3 , which control EVPN route import. Any VPN instance configured with an import RT of 0:2 or 0:3 can successfully import this route and learn the corresponding host MAC and IP information.

Statement D is also correct. The output explicitly shows RT extended communities and the EVPN Router’s MAC extended community. These attributes are essential for VXLAN tunnel identification, split-horizon forwarding, and correct EVPN operation in a campus fabric.

Hence, the correct answers are A, C, and D.

In a centralized VXLAN gateway architecture, all inter-subnet traffic is forwarded to a centralized Layer 3 gateway, typically deployed on a core or aggregation device. This design simplifies network planning, gateway configuration, and policy enforcement because routing, security, and traffic control are all handled at a single centralized point. From an operational perspective, deployment and management are straightforward, which makes centralized gateways suitable for small- to medium-sized campus networks or environments with limited endpoints.

However, according to HCIP Datacom Campus Network documentation, this architecture introduces scalability limitations. Since the centralized gateway performs Layer 3 forwarding for all VXLAN segments, it must maintain ARP entries for every terminal in the network. As the number of endpoints increases, the ARP table on the Layer 3 gateway grows rapidly. Hardware resources such as memory and processing capacity limit the maximum number of ARP entries that can be supported.

In large-scale campus scenarios with a high density of terminals—such as universities, hospitals, or enterprise office campuses—this ARP scalability bottleneck can impact performance and stability. Excessive ARP entries may lead to increased CPU utilization, delayed ARP resolution, and reduced forwarding efficiency. For such environments, HCIP Datacom recommends distributed VXLAN gateways, which distribute ARP and routing responsibilities across multiple devices. Therefore, the statement is correct, and the centralized VXLAN gateway is not suitable for scenarios with a large number of terminals.

In a VXLAN BGP EVPN architecture, EVPN Type 5 routes , also known as IP Prefix routes , are used to advertise Layer 3 reachability information between VXLAN segments. These routes are essential for implementing inter-VNI communication and external network connectivity through distributed or centralized gateways.

According to HCIP Datacom Campus Network documentation, a Type 5 route carries IP prefix information , including the IP prefix and its prefix length , allowing VTEPs to learn network-level routing information rather than host-level details. The Route Distinguisher (RD) is also included to ensure uniqueness of routes across different VPN instances, which is critical in multi-tenant environments. Additionally, the gateway IP address is carried to identify the next-hop gateway responsible for forwarding traffic toward the advertised prefix.

Unlike EVPN Type 2 routes, which advertise MAC address and optional host IP address information , Type 5 routes do not carry MAC addresses. Type 5 routes operate purely at the Layer 3 level and are independent of Layer 2 forwarding. Their purpose is to exchange subnet-level routing information rather than endpoint-level details.

MAC addresses are only relevant for Layer 2 forwarding and ARP/ND suppression, which are functions of EVPN Type 2 routes. Including MAC information in Type 5 routes would be unnecessary and inefficient for Layer 3 routing purposes.

Therefore, the field that is not carried in a BGP EVPN Type 5 route is the MAC Address , making option C the correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Dynamic VLAN authorization allows edge devices to dynamically assign users to specific VLANs based on authentication results. This mechanism is widely used to guide user traffic into the correct VN in a CloudCampus virtualized campus network.

For wired users , both MAC address authentication and 802.1X authentication support dynamic VLAN assignment. Once authentication succeeds, the authentication server delivers authorization VLAN information to the edge node, and users are placed into the corresponding VLANs. Therefore, statements C and D are correct.

For wireless users , 802.1X authentication also supports dynamic VLAN authorization, making statement B correct. However, Portal authentication for wireless users does not support dynamic VLAN assignment in CloudCampus networks. Wireless Portal authentication typically controls access rights rather than VLAN placement.

According to HCIP Datacom Campus Network documentation, statement A is false, making it the correct answer.

Explanation (Based on HCIP Datacom Campus Network Design)

Position 1 → 802.1X Authentication This authentication point corresponds to a PC connected to an access switch . PCs typically support 802.1X clients, making 802.1X authentication the preferred and most secure method for wired user access. It provides strong identity-based access control using a RADIUS server.

Position 2 → Portal Authentication This point represents wireless user access . Portal authentication is commonly used for wireless terminals, especially guest or mobile users, where browser-based authentication is required. Users authenticate through a web page redirected by the access device.

Position 3 → MAC Address Authentication This point corresponds to non-802.1X-capable terminals , such as IP phones or printers. These devices cannot initiate 802.1X or Portal authentication, so MAC address authentication is used to identify and authenticate them based on their MAC addresses.

This authentication deployment aligns with Huawei NAC best practices:

802.1X for capable wired terminals

Portal for wireless or guest access

MAC authentication for dumb or IoT devices