H12-841: HCIP-Datacom-Campus Network Planning and Deployment V1.5Demo

Policy association has three roles: the terminal, which provides the user interface for authentication and resource access; the access device, which enforces network-access policy; and the control device, which authenticates users and controls access policy. A Portal server is not one of these three roles.

The fabric global VLAN resource pool is a service VLAN pool for external gateway interconnection, network service resource interconnection, management VLANs used for policy association, and VN access. VLAN resources for interconnecting underlay devices are configured in the underlay automated resource pool, so they are not allocated from the fabric global VLAN resource pool.

Virtual networks are isolated from one another at the network layer unless inter-VN communication is configured. A policy control matrix controls permitted traffic between security groups, whereas inter-VN communication establishes the connectivity required between the R&D VN and marketing VN.

Wireless access points can implement wireless client isolation (also called AP isolation), restricting direct communication between wireless users on the same network.

In EVPN symmetric routing, a Type 2 MAC/IP route carries both the Layer 2 VNI and the Layer 3 VNI, with separate Layer 2 and Layer 3 route targets. The IP address field is optional but carries a specific IPv4 or IPv6 address when present.

iMaster NCE-Campus supports global perpetual licensing in both N1 and a-la-carte modes, as well as tenant subscription licensing in SaaS mode. Its global subscription model uses TBL subscription mode; it is not identified as IaaS mode.

For WLAN designs in regulatory domains that support channels 1–13, Huawei recommends channels 1, 6, and 11 for smaller AP deployments and channels 1, 5, 9, and 13 when many APs are deployed. It also recommends staggering high- and low-frequency 5 GHz channels on neighboring APs during channel planning.

VXLAN tunnels carry traffic within the virtualized campus fabric, while border nodes provide the connection point for traffic entering or leaving the fabric to reach external networks.

CloudCampus fabric external-network types support Layer 3 shared egress, Layer 3 exclusive egress, and Layer 2 shared egress. Layer 2 exclusive egress is not a supported external-network type.

A quality evaluation report presents network-wide resource, user, and quality information in a network overview; ranks and trends health metrics in indicator details; and identifies root causes with rectification suggestions. An optimization solution is not a defined section of this report.

A policy control matrix controls permitted or denied traffic between security groups and resource groups. Virtual networks remain isolated at the network layer unless inter-VN communication is configured, so inter-VN routing/connectivity is also required for users in different VNs to access one another.

CloudCampus dynamically authorized VLANs are supported for MAC address authentication and 802.1X authentication. Portal authentication requires the user to go online again when this authorization mode is used, so dynamically authorized VLANs are not recommended for Portal authentication.

Model-driven telemetry streams structured data defined by YANG models, which preserve explicit data types and hierarchy. Its push-based streaming model supports much higher collection frequencies than typical SNMP polling, including second-level intervals and therefore greater precision.

A Free Mobility policy enforcement device parses a service flow’s source and destination IP addresses, maps those addresses to security groups, and applies the matching group policy.

Authentication Header (AH) is assigned IP protocol number 51, while Encapsulating Security Payload (ESP) is assigned IP protocol number 50 in the IANA Internet Protocol Numbers registry.

IKEv1 Phase 1 supports Main Mode and Aggressive Mode to establish the IKE security association. Quick Mode is used in Phase 2 to negotiate IPsec security associations, and Normal Mode is not an IKEv1 negotiation mode.

In static VXLAN flood-and-learn operation, VTEPs learn remote MAC addresses from the source MAC addresses of received VXLAN-encapsulated data packets. Host ARP exchanges commonly supply the initial traffic that causes this MAC learning, after which known unicast traffic can be sent to the learned remote VTEP.

DHCP snooping creates a client binding from DHCP ACK information. The interface connected toward an authorized DHCP server is configured as trusted, while DHCP reply messages—including DHCP Offer and DHCP ACK—received on untrusted interfaces are discarded. Dynamic bindings age out at lease expiration or are removed when the client sends DHCP Release; a client-facing interface going down does not normally remove the binding immediately.

In an iMaster NCE-Campus policy matrix, each rule controls traffic from the row’s source security group to the column’s destination group. The deny rules block Guest_Group-to-Research_Group and Research_Group-to-Guest_Group traffic. No policy is configured for Sales_Group-to-Sales_Group traffic, which permits that access by default. The unknown group does not have a deny rule to every destination, so it is not universally blocked from network resources.

IPsec supports tunnel mode and transport mode. Tunnel mode encapsulates the complete original IP packet, whereas transport mode protects the IP payload while keeping the original IP header.

DSA provides digital signatures for authentication rather than payload encryption. IPsec ESP encryption transforms include DES-CBC, TripleDES-CBC, and AES-based modes; current standards discourage legacy DES and 3DES but still distinguish them as encryption algorithms.

Asymmetric IRB suppresses remote host IP-route forwarding at the ingress and carries the original Ethernet frame across the VXLAN tunnel for Layer 3 processing at the egress VTEP. Therefore, the inner frame is addressed to the egress routing-interface MAC, MAC B; it is not addressed directly to the destination host MAC. Huawei documents that asymmetric IRB is used to retain Layer 2 forwarding and that a decapsulated frame addressed to a BDIF/router MAC is then subjected to Layer 3 forwarding.

IPsec AH authenticates packet origin, verifies data integrity, and can provide anti-replay protection. It does not provide confidentiality through data encryption.