Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In IPsec, both Authentication Header (AH) and Encapsulating Security Payload (ESP) are implemented as IP protocols and are identified by specific IP protocol numbers in the IP header. These protocol numbers allow receiving devices to determine how the packet payload should be processed.

The protocol number assigned to AH is 51 . AH provides data origin authentication, data integrity, and anti-replay protection but does not offer encryption. When an IP packet contains AH, the protocol field in the IP header is set to 51 so that the receiver can correctly process the AH header.

The protocol number assigned to ESP is 50 . ESP provides data confidentiality through encryption and can also provide integrity and authentication. Packets protected by ESP use protocol number 50 in the IP header.

The other options are incorrect because protocol number 6 represents TCP and 17 represents UDP, which are transport-layer protocols rather than IPsec protocols. Protocol number 57 is unrelated to IPsec.

According to HCIP Datacom Campus Network documentation and standard IP protocol assignments, the correct protocol numbers are AH = 51 and ESP = 50, making option B the correct answer.

In a VXLAN-based virtualized campus network, planning is divided into underlay , fabric , and overlay layers, each with clear responsibilities:

Fabric Design → Border Node Design Fabric design focuses on the VXLAN fabric structure and roles of fabric nodes. Border nodes are a core part of the fabric, responsible for VXLAN encapsulation/decapsulation, policy enforcement, and traffic exit/entry between the VXLAN fabric and external networks. Therefore, Border Node Design belongs to Fabric Design.

Overlay Network Design → VN Access Design VN Access Design defines how users and terminals access different Virtual Networks (VNs), including VLAN-to-VN mapping and authentication-based access. These are overlay-layer service constructs.

Overlay Network Design → VN Interwork Design VN Interwork Design focuses on communication between different VNs (for example, inter-VN routing and security group policy control), which is a classic overlay function.

Overlay Network Design → External Network Design External Network Design defines how overlay VNs communicate with non-VXLAN external networks, which is also an overlay service behavior implemented through border nodes.

This mapping strictly follows Huawei HCIP Datacom Campus Network VXLAN planning methodology.

Huawei’s free mobility solution is designed to provide consistent user access control and policy enforcement across the campus network, regardless of user location. According to HCIP Datacom Campus Network documentation, the solution is built around several clearly defined core roles , each with specific responsibilities.

The authentication device is a core role. It performs user authentication using methods such as 802.1X, MAC authentication, or portal authentication, and associates user identity information with IP addresses or security groups.

The policy enforcement device is also a core role. It enforces security and access control policies based on IP-security group information, ensuring that traffic complies with defined policies wherever the user is connected.

iMaster NCE-Campus is another core component of the free mobility solution. It acts as the centralized management and control platform, responsible for policy definition, IP-security group management, and coordination of information distribution between authentication points and policy enforcement points.

The policy control device , however, is not a core role explicitly defined in Huawei’s free mobility architecture. Policy control functions are integrated into iMaster NCE-Campus rather than implemented as a separate standalone device role. Therefore, “policy control device” is not recognized as a core role in the free mobility solution.

As a result, option B is the correct answer, while the other options represent essential components of Huawei’s free mobility solution as defined in HCIP Datacom Campus Network materials.

In Huawei VXLAN implementations described in HCIP Datacom Campus Network documentation, the relationship between a VXLAN Network Identifier (VNI) and a Bridge Domain (BD) is a one-to-one (1:1) mapping . Each BD represents a Layer 2 broadcast domain in the VXLAN overlay network, and each BD is uniquely identified by a single VNI.

The VNI is carried in the VXLAN header and is used by VTEPs to determine which virtual Layer 2 network the encapsulated traffic belongs to. When a packet is received, the VTEP decapsulates the VXLAN header and forwards the traffic to the corresponding BD based on the VNI value. Because of this mechanism, a single BD can only be associated with one VNI, and a VNI can only represent one BD.

This strict 1:1 mapping simplifies traffic forwarding, MAC address learning, and broadcast, unknown unicast, and multicast (BUM) traffic handling. It also ensures clear isolation between different virtual networks, which is essential for multi-tenant campus and data center environments. Allowing multiple BDs to map to one VNI or vice versa would break traffic isolation and complicate forwarding logic.

Therefore, Huawei VXLAN design enforces a one-to-one relationship between VNIs and BDs, making 1:1 the correct answer.

In HCIP Datacom Campus Network VXLAN architecture, VXLAN tunnels are classified based on how the tunnel endpoints are created and maintained , which is referred to as the VXLAN tunnel creation mode. According to Huawei VXLAN design principles, there are two valid VXLAN tunnel types: static VXLAN tunnels and dynamic VXLAN tunnels .

A static VXLAN tunnel is manually configured by an administrator. In this mode, the source VTEP IP address, destination VTEP IP address, and related parameters are explicitly specified on devices. Static VXLAN tunnels are typically used in small-scale networks or test environments where the number of VTEPs is limited and network topology is simple. However, static configuration lacks scalability and flexibility, making it unsuitable for large campus fabrics.

A dynamic VXLAN tunnel is automatically created based on control-plane learning mechanisms, such as BGP EVPN . In this mode, VTEPs learn remote VTEP IP addresses dynamically through EVPN route advertisements (for example, Type 3 routes). When a remote VTEP becomes reachable at the underlay Layer 3 level, the VXLAN tunnel is automatically established without manual intervention. This mode is widely used in modern campus and data center networks due to its scalability and automation capabilities.

Options A and D are incorrect because stateless and stateful are not official VXLAN tunnel creation classifications in Huawei’s VXLAN implementation. VXLAN itself is an encapsulation mechanism, and tunnel state is not categorized in this manner.

Therefore, the correct VXLAN tunnel types based on creation mode are static VXLAN tunnels and dynamic VXLAN tunnels .

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

DHCP snooping works by distinguishing trusted and untrusted interfaces and controlling DHCP message forwarding behavior. After DHCP snooping is enabled, interfaces connected to legal DHCP servers must be explicitly configured as trusted interfaces , otherwise DHCP server messages will be blocked. Therefore, statement B is correct .

On untrusted interfaces, the switch drops DHCP server–type messages , such as DHCP Offer and DHCP ACK, to prevent rogue DHCP servers from assigning incorrect IP addresses. This validates statement C as correct .

Statement A is incorrect because DHCP snooping records client binding information mainly from DHCP ACK messages , not from DHCP Offer messages. The ACK confirms the final IP assignment and lease parameters, making it the authoritative source for the binding table.

Statement D is also incorrect. When the interface connected to a DHCP client goes down, the corresponding DHCP snooping entry is immediately removed, rather than waiting for the lease to expire. This ensures real-time accuracy of the binding table.

In a Huawei virtualized campus network managed by iMaster NCE-Campus , Fit APs do not go online immediately after being added to the management platform. According to HCIP Datacom Campus Network documentation, Fit APs depend on a wireless access controller (AC) for control, configuration delivery, and service provisioning. Simply adding a Fit AP to iMaster NCE-Campus only completes the device registration step , not the full service enablement process.

After a Fit AP is added, several additional steps are required before it can go online and provide wireless services. First, the AP must successfully discover and establish a control tunnel with the AC . Then, the AP typically needs to be approved , assigned to a site, and bound to the correct AP group . Configuration data such as radio parameters, SSIDs, security policies, and authentication profiles must also be delivered from the AC to the AP.

In addition, firmware version checks or upgrades may occur during the onboarding process to ensure compatibility with the controller and management platform. Only after these steps are completed can the Fit AP enter the normal online state and start providing WLAN services.

This multi-step process ensures centralized control, consistent configuration, and reliable operation across large-scale campus networks, but it also means Fit APs cannot immediately go online upon being added to iMaster NCE-Campus.

Therefore, the statement is incorrect, and the correct answer is FALSE .

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a static VXLAN tunnel deployment, Huawei devices use an NVE (Network Virtualization Edge) interface as the logical tunnel interface for VXLAN encapsulation and decapsulation. The NVE interface represents the VTEP and does not have a one-to-one relationship with Bridge Domains (BDs) or VXLAN tunnels.

An NVE interface can be associated with multiple VNIs , each corresponding to a different BD. Therefore, when multiple BDs exist on a VTEP, only one NVE interface is required , making statement B correct and statement A incorrect .

In static VXLAN, the destination VTEP addresses are specified using ingress replication lists under each VNI. This allows a single NVE interface to establish multiple VXLAN tunnels to different remote VTEPs. As a result, there is no requirement to create a separate NVE interface for each tunnel, making statement D correct and statement C incorrect .

According to HCIP Datacom Campus Network VXLAN configuration principles, the correct practice is to create one NVE interface per VTEP , associate multiple VNIs with it, and define remote peers through ingress replication. Therefore, the correct answers are B and D .

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a VXLAN-based campus network, VBDIF interfaces serve as Layer 3 gateway interfaces for Bridge Domains (BDs) and provide routing capabilities. However, not all VXLAN gateways must maintain VBDIF interfaces. This makes statement A false .

A Layer 2 VXLAN gateway operates purely at Layer 2 and is responsible for VXLAN encapsulation and decapsulation, enabling intra-subnet communication within the same VXLAN network. It does not require a VBDIF interface , because no Layer 3 routing is involved. Therefore, claiming that both Layer 2 and Layer 3 VXLAN gateways must maintain VBDIF interfaces is incorrect.

Statement B is correct because a VBDIF interface is a logical Layer 3 interface bound to a BD and functions similarly to a VLANIF interface in traditional VLAN-based networks. Statement C is also correct, as a Layer 3 VXLAN gateway enables inter-subnet routing between different VNIs and allows traffic to exit the VXLAN network toward non-VXLAN external networks. Statement D correctly describes the function of a Layer 2 VXLAN gateway.

According to HCIP Datacom Campus Network documentation, VBDIF interfaces are mandatory only for Layer 3 VXLAN gateways, not for Layer 2 VXLAN gateways.

iMaster NCE-Campus adopts a flexible multi-plane networking architecture to meet different deployment scale and reliability requirements. According to HCIP Datacom Campus Network documentation, iMaster NCE-Campus supports both single-plane networking and multi-plane networking , and the selection depends on the system deployment mode.

In a single-node system deployment , all functional components of iMaster NCE-Campus run on a single node. In this scenario, single-plane networking is optional and can be used to simplify network planning and reduce deployment complexity. Management traffic, service traffic, and internal communication share the same network plane, which is sufficient for small-scale or test environments where high availability and strict isolation are not mandatory.

However, in multi-node or cluster deployments , iMaster NCE-Campus requires multi-plane networking . Different network planes—such as management plane, service plane, and internal communication plane—are deployed separately to ensure high availability, scalability, performance isolation, and security. Single-plane networking is not supported in these deployments because it cannot meet the reliability and performance requirements of clustered systems.

This design ensures that large-scale campus networks benefit from fault isolation and load separation, while smaller deployments can use a simplified architecture. Therefore, the statement that single-plane networking is optional only in single-node system deployment is consistent with HCIP Datacom Campus Network design principles.

Hence, the correct answer is TRUE .