Huawei Updated H12-891_V1.0 Exam Questions and Answers by diana

Understanding IPsec SA (Security Association) Establishment

????IPsec (IP Security) provides encrypted communicationover IP networks.

????Security Associations (SAs) define encryption, authentication, and key parameters for IPsec tunnels.

Two IPsec SA Modes:

1️⃣Manual Mode:

All parameters (keys, encryption methods, authentication settings) must be manually configured.

Keys do not change automatically, making it less secure.

2️⃣IKE (Internet Key Exchange) Auto-Negotiation Mode:

UsesIKE Phase 1 and Phase 2to automaticallynegotiate, generate, and exchange keys.

Keys are periodically refreshed, increasing security.

UsesDiffie-Hellman (DH) key exchangefor secure key generation.

Why is Answer D Incorrect?

❌D. SAs established in both manual and IKE auto-negotiation modes can be dynamically updated.

Incorrect:Inmanual mode, the IPsec SA isstaticand does not support dynamic updates.

Correct behavior:OnlyIKE auto-negotiation modesupportsdynamic re-keying and SA updates.

✅Reference:Huawei HCIE-Datacom Guide – IPsec SA Modes and IKE Negotiation

In IPsec, a symmetric encryption algorithm (e.g., AES) is used for encrypting data due to its speed. To securely exchange the symmetric key between peers, asymmetric encryption algorithms (like RSA) are used.

This method ensures:

High performance (due to fast symmetric encryption)

Secure key exchange (asymmetric protection)

Exact Extract - Huawei HCIE-Datacom Guide – IPsec Encryption:

“IPsec uses symmetric algorithms to encrypt data for performance and asymmetric algorithms to securely exchange symmetric keys during IKE negotiation.”

Understanding VXLAN (Virtual eXtensible LAN) Technology

VXLAN is aLayer 2 over Layer 3 encapsulation protocoldesigned toextend Layer 2 domains across routed networksusingMAC-in-UDP encapsulation.

????Key VXLAN Components:

VTEP (VXLAN Tunnel Endpoints):These encapsulate and decapsulate VXLAN packets.

Underlay Network:The routed IP network that forwards VXLAN packets (does not require VXLAN awareness).

Overlay Network:The logical Layer 2 segments tunneled over VXLAN.

Analysis of the Answer Choices:

✅A. VXLAN uses MAC-in-UDP encapsulation to encapsulate Ethernet packets into UDP packets and thereby extend Layer 2 networks.

Correct:VXLAN usesMAC-in-UDP encapsulation, meaning that the originalEthernet frame is placed inside a UDP packet, allowing Layer 2 networks to extend over IP-based networks.

❌B. When VXLAN is deployed, in addition to devices at both ends of a VXLAN tunnel, intermediate forwarding devices are also required to support VXLAN. Otherwise, VXLAN packets cannot be forwarded.

Incorrect:VXLAN packets are forwarded asregular UDP trafficin the underlay network.

Intermediate routers or switches DO NOT need to support VXLAN, as theyonly forward UDP packetsbased on theouter IP headers.

Only VTEP devices must support VXLANbecause they handleencapsulation/decapsulation.

✅C. VXLAN packets are forwarded through routes on the underlay network, and the MAC address of the terminal in the inner data frame is not considered during underlay forwarding.

Correct:The underlay network routesVXLAN packetsusingouter IP headers(VTEP IP addresses),not the inner MAC address.

✅D. VXLAN can be deployed on campus networks to implement Layer 2 and Layer 3 communication.

Correct:VXLAN is commonly used incampus networksto provide bothLayer 2 bridgingandLayer 3 routingacross different locations.

Real-World Application:

Data Center Networks:VXLAN is widely used formulti-tenant network segmentationin cloud environments.

Enterprise Campus Networks:Enablesseamless Layer 2 and Layer 3 connectivityacross different buildings or locations.

✅Reference:Huawei HCIE-Datacom Guide – VXLAN Deployment and Forwarding Principles

Understanding BGP EVPN Route Types for VXLAN

????BGP EVPN (Ethernet VPN) is used for VXLAN control-plane learning.

✅EVPN Type 2 Route (MAC/IP Advertisement)

Carries:MAC + Host IP

Used for:L2 forwarding, Host Mobility

✅EVPN Type 5 Route (IP Prefix Advertisement)

Carries:Network segment (Subnet) + Prefix

Used for:VXLAN L3 routing

????What Do the Given Route Entries Show?

0:172.16.2.0/24

0:172.16.13.0/24

0:192.168.122.0/30

????These are IPv4 Subnets, NOT individual MACs.

????Since they carry IP Prefixes, they belong to EVPN Type 5.

Analysis of the Answer Choices:

✅A. These routes are Type 5 routes and carry network segment or mask information.

Correct:The displayed routescarry network prefixes, which belong toEVPN Type 5.

❌B. These routes are Type 2 routes and carry host IP addresses.

Incorrect:Type 2 routescarry MAC + Host IP, NOT full subnets.

❌C. These routes carry the L2VNI.

Incorrect:L2VNI is forLayer 2 VXLAN bridging, but these areIP Prefix Routes (L3 routing).

✅D. These routes carry the L3VNI.

Correct:Type 5 routes are used forVXLAN L3 routing, which means they belong toL3VNI.

Real-World Application:

VXLAN L3 Gateways:Type 5 routes enabledistributed routing between VXLAN segments.

Data Center Networks:Used tointerconnect virtual machines (VMs) across different subnets.

✅Reference:Huawei HCIE-Datacom Guide – BGP EVPN & VXLAN L3 Routing