H12-891_V1.0 HCIE-Datacom V1.0 Questions and Answers

802.1X Authentication Overview

802.1X is a port-based authentication mechanism used for secure network access control. It involves:

EAPoL (Extensible Authentication Protocol over LAN) communication between the client (supplicant) and the switch (authenticator).

RADIUS communication between the authenticator and the authentication server (AAA server).

✅ A. 802.1X authentication uses EAPoL to exchange authentication information.

EAPoL (Extensible Authentication Protocol over LAN) is used to send authentication packets over Ethernet (IEEE 802.3) networks.

✅ B. In EAP termination mode, the network device terminates EAP packets and re-encapsulates them into RADIUS.

The switch acts as an authentication proxy by terminating EAP sessions and converting authentication information into RADIUS format.

✅ C. EAPoL is for wired (802.3), EAPoW is for wireless (802.11).

EAPoL (EAP over LAN) is used in wired Ethernet networks.

EAPoW (EAP over Wireless) is used in Wi-Fi (802.11) networks.

✅ D. In EAP relay mode, EAP packets are encapsulated into RADIUS using EAPoR (EAP over RADIUS).

The switch does not terminate the EAP session but instead forwards EAP messages to the AAA server inside RADIUS packets.

Reference from Huawei HCIE-Datacom Documentation:

Huawei 802.1X Configuration Guide – EAPoL, EAPoW, and EAPoR

HCIE-Datacom Training Material – AAA Authentication Modes

The Differentiated Services (DiffServ) model for Quality of Service (QoS) enables traffic management based on predefined priorities. This involves classifying, policing, queuing, and scheduling traffic to ensure efficient network resource utilization.

Breakdown of Each QoS Processing Step:

✅ Step 1: Traffic Classification and Marking

Purpose: Identifies and marks packets based on QoS attributes such as DSCP (Differentiated Services Code Point) or 802.1p priority bits.

Function: Assigns a QoS label to packets for further processing.

Example: Packets carrying voice traffic (EF - Expedited Forwarding) are marked for high-priority treatment.

✅ Step 2: Traffic Policing (CAR - Committed Access Rate)

Purpose: Enforces bandwidth limits on specific traffic flows to prevent excessive usage.

Function: Drops or re-marks packets exceeding the assigned bandwidth threshold.

Example: If a video stream exceeds 10 Mbps, excess packets may be dropped or re-marked.

✅ Step 3: Congestion Management (Queuing and Scheduling)

Purpose: Manages traffic flow through queues based on assigned QoS levels.

Function: Places packets in appropriate priority queues (e.g., Strict Priority, Weighted Fair Queuing - WFQ, CBWFQ).

Example: Voice packets are assigned to high-priority queues for low-latency forwarding.

✅ Step 4: Congestion Avoidance

Purpose: Prevents network buffer overflows and excessive packet drops.

Function: Uses mechanisms like WRED (Weighted Random Early Detection) to drop lower-priority packets before congestion occurs.

Example: If a queue reaches 80% capacity, WRED may drop low-priority packets to maintain QoS.

✅ Step 5: Traffic Shaping

Purpose: Smooths out traffic bursts to maintain a consistent transmission rate.

Function: Buffers and delays packets to prevent excessive packet drops.

Example: If outgoing traffic exceeds 50 Mbps, shaping ensures it does not exceed this limit while maintaining steady flow.

✅ Hypertext Transfer Protocol (HTTP) is an application-layer protocol used for:

Accessing web pages and hypermedia content.

Client-server communication over the internet.

Stateless communication with request-response architecture.

Key Features of HTTP:

Application Layer Protocol in the TCP/IP model.

Uses TCP (Port 80) and HTTPS (Port 443) for secure communication.

Supports REST APIs, web applications, and cloud services.

Reference from Huawei HCIE-Datacom Documentation:

Huawei Network Protocol Guide – HTTP and Web Services

HCIE-Datacom Study Material – Application Layer Protocols in TCP/IP Model

Before performing a network cutover (migration or upgrade), it is essential to collect baseline data to ensure that services operate normally before and after the change.

Importance of Pre-Cutover Information Collection:

Identifies Network Baseline – Helps compare pre-cutover and post-cutover performance.

Detects Hidden Issues – Ensures that no existing network issues interfere with the cutover process.

Prevents Service Interruptions – Ensures all dependent services are accounted for.

Provides Rollback Plan – If issues arise, administrators can restore previous configurations.

Reference from Huawei HCIE-Datacom Documentation:

Huawei Network Change Management Guide – Pre-Cutover & Post-Cutover Best Practices

HCIE-Datacom Training Material – Service Assurance & Risk Analysis

Authentication Header (AH) in IPsec

The Authentication Header (AH) protocol is part of IPsec and provides authentication, integrity, and replay protection but does NOT provide encryption.

✅ B. AH provides data origin authentication.

Ensures that packets come from a trusted source using cryptographic signatures.

✅ C. AH provides anti-replay protection.

Uses sequence numbers to prevent attackers from replaying old packets.

✅ D. AH provides data integrity authentication.

Ensures data integrity by verifying that packets have not been tampered with during transmission.

❌ A. AH provides packet encryption – Incorrect!

AH does not encrypt packet contents. It only authenticates headers.

ESP (Encapsulating Security Payload) is used for encryption in IPsec.

Reference from Huawei HCIE-Datacom Documentation:

Huawei IPsec Configuration Guide – AH vs. ESP

HCIE-Datacom Training Material – IPsec Security Mechanisms

Huawei SD-WAN establishes secure tunnels between SD-WAN edge devices (CPEs, AR routers, and controllers) using tunneling protocols.

✅ B. GRE over IPsec (Correct Answer)

GRE (Generic Routing Encapsulation) over IPsec is the primary tunneling method used in Huawei SD-WAN.

GRE provides multi-protocol encapsulation, while IPsec ensures encryption and security.

Used for secure communication over public WAN links (e.g., the internet, LTE, MPLS, etc.).

Congestion Management (like WFQ, CBWFQ) controls traffic without discarding packets unless absolutely necessary.

Congestion Avoidance (e.g., WRED) is responsible for selectively discarding packets to prevent buffer overflow.

Key Distinction:

Congestion Management = Traffic queuing and prioritization (no packet loss).

Congestion Avoidance = Selectively dropping packets (e.g., WRED).

✅ Reference: Huawei HCIE-Datacom Guide - Congestion Management vs. Avoidance

VXLAN Inter-Subnet Routing with Symmetric IRB

VXLAN supports inter-subnet routing using Integrated Routing and Bridging (IRB). In symmetric IRB, both ingress and egress VTEPs perform Layer 3 forwarding to ensure efficient packet forwarding across subnets.

✅ A. Both the ingress VTEP and egress VTEP forward packets based on the Layer 3 forwarding table.

In symmetric IRB, both ingress and egress VTEPs perform Layer 3 lookup and forwarding.

The ingress routes packets before encapsulating them in VXLAN, and the egress performs another Layer 3 lookup to determine final delivery.

✅ D. When VTEPs forward inter-subnet user communication packets, the VNI carried in the VXLAN header is the L3VNI.

L3VNI (Layer 3 VXLAN Network Identifier) is used for inter-subnet routing between VXLAN segments.

Understanding MPLS Forwarding Mechanism

MPLS (Multiprotocol Label Switching) is a high-performance forwarding mechanism that operates on two planes:

1️⃣ Control Plane:

Establishes Label Switched Paths (LSPs) using protocols like LDP (Label Distribution Protocol), RSVP-TE (Resource Reservation Protocol - Traffic Engineering), or BGP-LU (BGP Label Unicast).

Assigns labels to packets based on routing policies.

2️⃣ Data Plane (Forwarding Plane):

Uses a Label Forwarding Information Base (LFIB) instead of traditional IP routing.

Packets are forwarded based on labels, not IP addresses.

Analysis of the Answer Choices

✅ C. The system automatically assigns an ID to the upper-layer application that uses a tunnel. This ID is also called the tunnel ID.

Correct: MPLS assigns a Tunnel ID to applications that utilize tunnels (e.g., VPNs, MPLS-TE, or L2/L3 services).

This ID helps differentiate between various tunnel applications, ensuring traffic follows the correct LSP.

❌ A. After an IP packet enters an MPLS domain, the MPLS device forwards the packet based on FIB table queries.

Incorrect: MPLS routers do NOT use the FIB (Forwarding Information Base) for forwarding once labels are assigned.

Instead, they use LFIB (Label Forwarding Information Base) to switch packets based on labels.

❌ B. If the tunnel ID is 0x0, the MPLS forwarding process starts.

Incorrect: If the Tunnel ID is 0x0, MPLS does NOT start; it means no label is assigned, and traditional IP forwarding occurs.

❌ D. If the tunnel ID is not 0x0, the normal IP forwarding process starts.

Incorrect: If the Tunnel ID is not 0x0, MPLS forwards traffic using label switching, not IP forwarding.

MPLS Positioning in the TCP/IP Model

MPLS (Multiprotocol Label Switching) operates between the Data Link Layer (Layer 2) and the Network Layer (Layer 3).

✅ MPLS is protocol-independent and supports various network layer protocols (IPv4, IPv6, VPN, etc.) by using labels instead of traditional IP routing.

✅ How MPLS Works:

MPLS assigns labels to packets, allowing fast forwarding based on the label rather than a routing table lookup.

Supports Layer 3 VPNs (L3VPNs), Layer 2 VPNs (L2VPNs), and MPLS Traffic Engineering (MPLS-TE).

✅ Why MPLS is Between Layer 2 and Layer 3?

MPLS adds a label between the Layer 2 (Ethernet, PPP) and Layer 3 (IP) headers, effectively creating a separate forwarding mechanism.

Label Switching Routers (LSRs) forward packets based on labels instead of IP addresses, reducing processing time.

Reference from Huawei HCIE-Datacom Documentation:

Huawei MPLS Technology Guide – MPLS Architecture and Label Switching

HCIE-Datacom Study Material – MPLS Positioning and Functionality in TCP/IP

Stateless Address Autoconfiguration (SLAAC) is an IPv6 mechanism where a host automatically configures its own global unicast address without requiring a DHCPv6 server.

IPv6 Address Format in SLAAC:

First 64 bits → Network Prefix (received from the router's RA message).

Last 64 bits → Interface Identifier (generated using EUI-64 or a randomly assigned value).

Why is the Prefix Always 64 Bits?

SLAAC requires a /64 prefix because the host needs the lower 64 bits to generate a unique address.

IPv6 Neighbor Discovery (ND) and Address Autoconfiguration are designed for a /64 subnet mask.

Reference from Huawei HCIE-Datacom Documentation:

Huawei IPv6 Configuration Guide – SLAAC Addressing and Prefix Allocation

HCIE-Datacom Training Material – IPv6 Stateless Address Autoconfiguration (SLAAC)

Why is Free Mobility Not Based on VLANs or IP Addresses?

Free mobility in Huawei CloudCampus implements policy-based user access control based on user identity (rather than VLANs or IP addresses).

Users can move across different network locations while maintaining their assigned security and access policies.

✅ How Free Mobility Works:

Policies are applied based on User Groups instead of VLAN or IP.

Uses Group-Based Policy Control (GBP) and Software-Defined Access (SDA) principles.

❌ Incorrect Statement Explanation:

Traditional networks rely on VLANs and IP addresses for segmentation, but Free Mobility applies policies at the user level, allowing seamless access anywhere on the network.

Reference from Huawei HCIE-Datacom Documentation:

Huawei CloudCampus Solution Guide – Free Mobility and Policy Control

HCIE-Datacom Training Material – Identity-Based Networking

Huawei iMaster NCE-Campus as an Authentication Relay Agent

Huawei iMaster NCE-Campus can act as a relay agent for authentication services, forwarding authentication requests between users and authentication servers (e.g., RADIUS, LDAP).

✅ B. User Authentication

Validates user credentials before granting network access.

Supports 802.1X, Portal, MAC, and RADIUS authentication.

✅ C. User Analysis

Analyzes user behavior and access patterns to optimize security and network policies.

✅ D. Marketing

Provides customized authentication portals with advertisements and promotional messages.

Incorrect Answer:

❌ A. User Accounting – Accounting is handled by the authentication server (e.g., RADIUS), not the relay agent.

Reference from Huawei HCIE-Datacom Documentation:

Huawei iMaster NCE-Campus Authentication Guide – Relay Agent Functions

HCIE-Datacom Study Material – User Authentication and Analysis in CloudCampus