H19-402_V1.0 HCSP-Presales – Data Center Network Planning and Design V1.0 Questions and Answers

In Huawei data center and network security architecture, native encryption support is a key differentiator between tunneling technologies and secure communication protocols.

SSL VPN (C) and IPsec VPN (D) both provide built-in encryption mechanisms . SSL VPN uses TLS/SSL protocols to encrypt application-layer traffic, making it suitable for secure remote access. IPsec VPN operates at the network layer and provides confidentiality, integrity, and authentication through protocols such as ESP (Encapsulating Security Payload), making it widely used for site-to-site and data center interconnection security.

On the other hand, VXLAN (A) and GRE (B) are encapsulation/tunneling technologies that do not inherently provide encryption. VXLAN is used for overlay networking (e.g., tenant isolation in CloudFabric), while GRE is used for simple tunneling across IP networks. Both require additional security mechanisms (such as IPsec) if encryption is needed.

Huawei CloudFabric design guidelines clearly separate overlay encapsulation (VXLAN) from security protocols (IPsec/SSL) , emphasizing that encryption must be implemented using dedicated security technologies.

Therefore, the correct answers are C and D .

In Huawei data center network design, M-LAG (Multi-Chassis Link Aggregation) is widely used to build loop-free Layer 2 topologies without relying on Spanning Tree Protocol (STP) . This is a key advantage in modern CloudFabric architectures.

Traditional Layer 2 networks depend on STP to prevent loops, but STP introduces drawbacks such as blocked links, slow convergence, and inefficient bandwidth utilization . M-LAG eliminates these issues by allowing two physical switches to operate as a single logical device from the perspective of downstream nodes.

With M-LAG:

All links are active-active , maximizing bandwidth usage

Loop prevention is achieved through protocol mechanisms and peer-link synchronization , not STP

Convergence is much faster compared to STP-based designs

Network design becomes simpler and more predictable

Huawei best practices strongly recommend disabling STP in M-LAG-based data center fabrics , especially when combined with VXLAN EVPN, to achieve high performance, fast convergence, and simplified operations .

Therefore, the statement is TRUE .

The statement is false due to an incorrect description of in-band management communication .

Huawei iMaster NCE-Fabric indeed supports both in-band and out-of-band deployment modes , but the interfaces used are misrepresented:

In in-band mode , iMaster NCE-Fabric uses southbound interfaces (not northbound) to communicate with switches over the service network . These southbound interfaces are responsible for delivering configurations and collecting device information.

In out-of-band mode , the description is correct: the controller connects to device management interfaces via a dedicated management network , ensuring separation from service traffic.

The confusion arises because:

Northbound interfaces are used for communication between the controller and upper-layer systems (e.g., cloud platforms like OpenStack or ManageOne).

Southbound interfaces are used for communication between the controller and network devices .

Huawei architecture strictly separates these roles to enable clear control-plane layering and automation .

Therefore, because the statement incorrectly mentions northbound interfaces in in-band mode , the correct answer is FALSE .

Huawei data center design guidelines emphasize end-to-end reliability across all layers of the physical network, including uplinks, devices, interconnections, and server access. All the listed options reflect valid reliability principles.

Option A is correct because ECMP (Equal-Cost Multi-Path) is a fundamental mechanism in spine-leaf architectures, ensuring load balancing and fast convergence when links fail. Option B highlights modular switch reliability , where inter-card connections prevent single-card failures from impacting connectivity.

Option C describes the DAD (Dual-Active Detection) mechanism in M-LAG scenarios. When a peer-link failure occurs, DAD ensures that only one device remains active, preventing split-brain conditions and maintaining network stability.

Option D addresses server-side reliability , where dual-homing with NIC teaming (active-active or active-standby) ensures uninterrupted service in case of link or device failure.

Together, these principles form Huawei’s comprehensive approach to building highly reliable and resilient data center networks.

In Huawei CloudFabric architecture, the underlay network is defined as a pure IP transport (bearer) network whose primary role is to provide Layer 3 reachability between VTEPs (VXLAN Tunnel Endpoints) . It is designed to be simple, stable, and highly reliable , typically composed of spine and leaf switches running routing protocols such as OSPF, IS-IS, or EBGP .

The statement is false because it incorrectly includes LBs (load balancers) and firewalls as part of the underlay network. In Huawei design principles:

Underlay = physical IP forwarding infrastructure (switch fabric only)

Overlay/services = VAS devices (firewalls, load balancers, etc.)

Firewalls and load balancers are considered service devices (VAS) and are usually connected via service leaf nodes or border leaf nodes , operating in the overlay/service layer , not as part of the underlay forwarding plane.

Additionally, the underlay is typically implemented using a spine-leaf architecture , not traditional three-tier (core/aggregation/access) designs.

Therefore, the statement is FALSE .

In Huawei Cloud Stack (HCS) architecture, ManageOne serves as the unified cloud management platform , responsible for end-to-end orchestration, service provisioning, and lifecycle management across compute, storage, and network resources. It provides a centralized portal for administrators and tenants, enabling automated deployment and O & M of cloud services.

FusionSphere is Huawei’s virtualization platform (similar to OpenStack + hypervisor integration) and operates at the resource layer, not as the top-level management system. Hypervisor and Virtual Machine Monitor (VMM) are components of the virtualization layer that manage virtual machines on physical servers, but they lack cloud-wide orchestration capabilities.

From a Huawei CloudFabric perspective, ManageOne integrates with controllers like iMaster NCE-Fabric to automate network provisioning, enabling seamless underlay and overlay configuration. It supports multi-data-center management, self-service portals, and policy-driven automation, which are essential for modern cloud data center operations.

Therefore, ManageOne is the correct answer as the cloud management platform in HCS.

RoCEv2 (RDMA over Converged Ethernet version 2) is not based on TCP ; instead, it is implemented over UDP/IP . Therefore, the statement is false.

RoCEv2 encapsulates RDMA traffic directly into UDP packets over IP networks , enabling it to operate across Layer 3 networks, unlike RoCEv1 which is limited to Layer 2. This design allows RoCEv2 to leverage existing IP routing infrastructure in modern data centers.

However, because RoCEv2 does not use TCP, it does not inherently provide congestion control or retransmission mechanisms like TCP does. As a result, Huawei emphasizes the need for a lossless network fabric to support RoCEv2 traffic. Technologies such as:

PFC (Priority Flow Control)

ECN (Explicit Congestion Notification)

DCQCN (Data Center Quantized Congestion Notification)

are implemented in Huawei CloudFabric to ensure reliable and low-latency communication.

This architecture is critical for AI computing, HPC, and distributed storage , where RDMA enables high throughput and ultra-low latency.

Therefore, the correct answer is B (FALSE) .

In Huawei networking, Eth-Trunk (link aggregation) can operate in two modes: manual mode and LACP mode . In manual mode , the Eth-Trunk is statically configured by the administrator, and member interfaces are manually added without using the Link Aggregation Control Protocol (LACP) .

In this mode, all member links that are up are considered active by default , and they simultaneously participate in traffic forwarding and load balancing . Traffic distribution is typically based on hash algorithms (e.g., source/destination MAC or IP), ensuring efficient utilization of available bandwidth.

Unlike LACP mode, manual mode does not perform dynamic negotiation or link state detection between devices. Therefore, it requires consistent configuration on both ends to avoid issues such as loops or traffic blackholing. However, it is simpler and can be useful in controlled environments.

In Huawei data center designs, especially in M-LAG scenarios , LACP is generally preferred for better reliability and fault detection. Still, the statement accurately describes manual mode behavior.

Therefore, the statement is TRUE .

In Huawei CloudFabric architecture, iMaster NCE-Fabric acts as the central network controller and automation platform that directly integrates with server virtualization platforms such as FusionSphere, VMware vCenter, and OpenStack . This integration enables automated network provisioning, policy enforcement, and dynamic resource orchestration between compute and network layers.

Through northbound APIs, iMaster NCE-Fabric communicates with virtualization platforms to obtain tenant, VM, and network information. It then translates these requirements into fabric configurations, such as VXLAN, EVPN, and underlay routing policies. This tight integration is essential for automated service deployment and end-to-end orchestration , which is a core capability in Huawei’s CloudFabric solution.

On the other hand, iMaster NCE-FabricInsight is focused on intelligent O & M, monitoring, and analytics . It provides telemetry-based visibility, fault detection, and performance optimization, but it does not directly connect to or integrate with virtualization platforms for service provisioning.

Therefore, the correct answer is iMaster NCE-Fabric , as it is the component responsible for connecting to server virtualization systems and enabling automation.

In Huawei VXLAN architecture, all listed statements accurately reflect core design concepts used in CloudFabric deployments.

A is correct: a Virtual Interface (VBDIF/VirtualIF) is a Layer 3 interface associated with a Bridge Domain (BD) , enabling inter-subnet routing (distributed gateway function).

B is correct: Huawei VXLAN commonly uses a 1:1 mapping between VNI and BD , where the BD acts as the Layer 2 forwarding domain. This mapping ensures clear separation of tenant networks and simplifies forwarding logic.

C is correct: VXLAN encapsulation uses VTEP (VXLAN Tunnel Endpoint) IP addresses . The source IP is the local VTEP, and the destination IP is the remote VTEP. Together, they logically represent the VXLAN tunnel used for transporting overlay traffic across the IP underlay.

D is also correct: a VAP (Virtual Access Point) represents the service access interface. On Huawei CE switches, VAPs are typically implemented using VLAN-based access , meaning VLANs act as the entry point for VXLAN services.

These concepts are fundamental in Huawei EVPN-VXLAN fabrics, enabling scalable, multi-tenant, and automated data center networking.

In Huawei CloudFabric and cloud networking models (aligned with OpenStack and SDN-based architectures), a VPC (Virtual Private Cloud) represents an isolated tenant network environment that contains multiple logical networking components.

Within a VPC:

A logical router provides Layer 3 routing and interconnection between subnets . Typically, one logical router is associated with a VPC to manage north-south and east-west routing.

Multiple logical switches (VXLAN networks or BDs) can be created to represent different Layer 2 segments within the same tenant environment.

Each logical switch can have multiple logical ports , which represent VM interfaces, containers, or service endpoints connected to the network.

This hierarchical design allows:

Flexible network segmentation

Multi-tier application deployment (web/app/db tiers)

Scalable tenant isolation

Huawei CloudFabric, integrated with platforms like iMaster NCE-Fabric and ManageOne , automates the creation and orchestration of these components.

Therefore, the statement is TRUE , as it accurately reflects the standard VPC network model.

In Huawei CloudFabric architecture, the underlay network is the physical IP network that provides basic connectivity and routing reachability for overlay services such as VXLAN.

Option A is correct : the underlay acts as the bearer (transport) network for VXLAN traffic, carrying encapsulated packets between VTEPs.

Option B is correct : the underlay includes both NVE (Network Virtualization Edge) devices that perform VXLAN encapsulation/decapsulation and standard IP forwarding devices (e.g., spine switches).

Option C is correct : the underlay has its own independent control plane , typically using IGP (OSPF/IS-IS) or BGP (EBGP) , and operates independently from the overlay (EVPN).

Option D is false because the underlay network is fundamentally responsible for Layer 3 IP reachability between VTEPs. Without proper L3 routing in the underlay, VXLAN tunnels cannot be established.

Huawei best practices emphasize a simple, stable, and highly reliable underlay , as it is the foundation for all overlay services.

Therefore, the correct answer is D .

In Huawei data center network design, VXLAN overlay deployment models are categorized based on where VTEPs (VXLAN Tunnel End Points) are located. These include host-based overlay, network-based overlay, and hybrid overlay.

In a host overlay , VTEPs are implemented only on vSwitches (such as those within hypervisors), and physical switches only provide IP transport (underlay). In a network overlay , VTEPs are deployed only on physical switches (typically leaf switches), and servers are unaware of VXLAN encapsulation.

The hybrid overlay model combines both approaches. In this design, VTEPs can exist on both vSwitches (inside virtualized hosts) and physical switches (such as leaf devices). This allows greater flexibility, supporting mixed environments where some workloads use hypervisor-based encapsulation while others rely on hardware VTEPs for higher performance or integration with bare-metal servers.

Huawei CloudFabric supports hybrid overlay to enable smooth evolution from traditional to fully virtualized environments. Therefore, the correct answer is Hybrid overlay (C) .

According to Huawei data center network design guidelines, the selection of an underlay routing protocol depends on the scale and complexity of the network. For small to medium-sized data centers , particularly when the number of ToR (Top of Rack) switches is less than 100 , OSPF (Open Shortest Path First) is the recommended routing protocol.

OSPF is a mature and widely deployed link-state protocol that offers fast convergence, simple configuration, and strong interoperability. It is well-suited for smaller-scale spine-leaf networks where operational simplicity is a priority. Huawei recommends OSPF in such scenarios because it provides sufficient scalability and performance without the added complexity of protocols like BGP.

For larger-scale data centers (typically more than 100 ToR switches), Huawei suggests using IS-IS or BGP to improve scalability and simplify large-scale route management. RIP is not suitable due to its limitations in scalability and convergence speed.

Therefore, for networks with fewer than 100 ToR switches, OSPF is the optimal and recommended choice .

Comprehensive and Detailed 150 to 200 words of Explanation From Huawei data center:

After rechecking against Huawei’s own materials, the verified multi-select answer is B and D . Huawei documentation for Elastic Load Balance, which is the load-balancing architecture referenced in Huawei cloud/data center designs, states that for Layer 4 traffic using TCP/UDP , incoming traffic is routed only through the LVS cluster . For Layer 7 traffic using HTTP/HTTPS , incoming traffic is routed first to the LVS cluster and then to the Nginx cluster before reaching backend servers. That means Huawei explicitly uses LVS for L4 load balancing and Nginx together with LVS for L7 load balancing.

By contrast, IP ECMP is a Layer 3 equal-cost forwarding/load-sharing mechanism, not an L4-L7 service load balancer in Huawei’s CloudFabric context. Huawei’s ECMP documentation discusses route-based traffic distribution in the IP layer, which is fundamentally different from application/service load balancing.