H19-402_V1.0 HCSP-Presales – Data Center Network Planning and Design V1.0 Question and Answers

In Huawei CloudFabric and modern data center architectures, the underlay and overlay networks are designed as independent layers with clear separation of responsibilities. The underlay network provides basic IP connectivity using standard Layer 3 routing (commonly using protocols such as OSPF, IS-IS, or even static routing), ensuring reliable transport between network devices.

The overlay network, typically implemented using VXLAN with BGP EVPN as the control plane, builds logical Layer 2/Layer 3 services on top of the underlay. Importantly, the overlay does not require the same routing protocol as the underlay. This independence allows flexible design, scalability, and easier evolution of services without modifying the physical infrastructure.

Option A is correct because endpoints (servers, VAS devices) are unaware of the underlay—they only interact with the overlay. Option C is correct as VXLAN is the mainstream overlay encapsulation technology. Option D correctly defines the overlay as a logical abstraction over the physical network.

Thus, statement B is false because Huawei explicitly supports different protocols between underlay and overlay layers.

In Huawei data center network design, M-LAG (Multi-Chassis Link Aggregation) is widely used to build loop-free Layer 2 topologies without relying on Spanning Tree Protocol (STP) . This is a key advantage in modern CloudFabric architectures.

Traditional Layer 2 networks depend on STP to prevent loops, but STP introduces drawbacks such as blocked links, slow convergence, and inefficient bandwidth utilization . M-LAG eliminates these issues by allowing two physical switches to operate as a single logical device from the perspective of downstream nodes.

With M-LAG:

All links are active-active , maximizing bandwidth usage

Loop prevention is achieved through protocol mechanisms and peer-link synchronization , not STP

Convergence is much faster compared to STP-based designs

Network design becomes simpler and more predictable

Huawei best practices strongly recommend disabling STP in M-LAG-based data center fabrics , especially when combined with VXLAN EVPN, to achieve high performance, fast convergence, and simplified operations .

Therefore, the statement is TRUE .

Huawei CloudFabric supports multiple data center interconnection (DCI) solutions to meet different scalability and geographic deployment requirements.

Multi-PoD (A) is supported and is used within a single data center to divide it into multiple Pods for modular expansion. It enables large-scale resource pooling while maintaining consistent architecture and simplified management.

Multi-Site (C) is a key CloudFabric capability, allowing multiple geographically distributed data centers to interconnect. This supports disaster recovery (DR), geo-redundancy, and workload migration , often implemented using EVPN/VXLAN across sites.

Multi-DC (D) is a broader concept encompassing interconnection between multiple data centers, including active-active and active-standby designs. Huawei supports this through DCI solutions integrated with CloudFabric , ensuring seamless service continuity.

Multi-VPC (B) is not a standard Huawei CloudFabric multi-DC interconnection model; it is more commonly associated with public cloud networking concepts rather than Huawei’s data center fabric architecture.

Therefore, the correct answers are A, C, and D , which represent the supported multi-data-center interconnection solutions in Huawei CloudFabric.

RDMA (Remote Direct Memory Access) is a key technology in Huawei’s Intelligent Lossless Data Center Network , widely used in high-performance scenarios such as AI training, distributed storage, and HPC.

The statement is correct because RDMA enables direct memory-to-memory data transfer between servers without involving the CPU or operating system in the data path. This bypass mechanism significantly reduces overhead and enables:

Ultra-low latency (microsecond-level communication)

High throughput (efficient use of bandwidth)

Low CPU utilization , freeing compute resources for applications

Although RDMA was originally developed for InfiniBand networks , it is now widely used over Ethernet through technologies like RoCE (RDMA over Converged Ethernet) in Huawei CloudFabric solutions.

To support RDMA effectively, Huawei implements lossless Ethernet mechanisms such as PFC, ECN, and congestion control algorithms to ensure reliable packet delivery.

Therefore, the statement accurately describes RDMA characteristics and is TRUE .

In Huawei VXLAN architecture, all listed statements accurately reflect core design concepts used in CloudFabric deployments.

A is correct: a Virtual Interface (VBDIF/VirtualIF) is a Layer 3 interface associated with a Bridge Domain (BD) , enabling inter-subnet routing (distributed gateway function).

B is correct: Huawei VXLAN commonly uses a 1:1 mapping between VNI and BD , where the BD acts as the Layer 2 forwarding domain. This mapping ensures clear separation of tenant networks and simplifies forwarding logic.

C is correct: VXLAN encapsulation uses VTEP (VXLAN Tunnel Endpoint) IP addresses . The source IP is the local VTEP, and the destination IP is the remote VTEP. Together, they logically represent the VXLAN tunnel used for transporting overlay traffic across the IP underlay.

D is also correct: a VAP (Virtual Access Point) represents the service access interface. On Huawei CE switches, VAPs are typically implemented using VLAN-based access , meaning VLANs act as the entry point for VXLAN services.

These concepts are fundamental in Huawei EVPN-VXLAN fabrics, enabling scalable, multi-tenant, and automated data center networking.

In Huawei CloudFabric and VXLAN-based overlay networking, the overlay provides abstraction, flexibility, and scalability by decoupling logical services from the physical infrastructure. NVEs (Network Virtualization Edge nodes) can indeed be deployed on physical switches (such as leaf switches), which is a fundamental capability of hardware-based VXLAN fabrics. Additionally, overlay networks are designed to meet the needs of private cloud environments, offering high performance, simplified O & M, and enhanced security through network segmentation (e.g., VXLAN VNIs).

Overlay networks also support access for both virtual machines and physical servers, ensuring consistent connectivity regardless of workload type.

However, statement D is incorrect. In Huawei’s architecture, especially with BGP EVPN-based VXLAN, the control plane is distributed rather than relying on a controller to synchronously deliver flow tables. Devices dynamically learn and exchange forwarding information using EVPN. Even in SDN-based scenarios with iMaster NCE-Fabric, policy delivery is not strictly synchronous flow table pushing in the traditional sense (like OpenFlow).

Therefore, “controller delivers flow tables synchronously” is not a standard capability of Huawei overlay networks, making option D incorrect.

In Huawei CloudFabric VXLAN-based data center networks, active-active access is a key design goal to ensure high availability, load balancing, and optimal resource utilization.

M-LAG (C) is one of the primary technologies used to achieve active-active access at the access layer. It allows a server or downstream device to connect to two leaf switches simultaneously, both of which actively forward traffic. This eliminates single points of failure and ensures link redundancy with load sharing.

EVPN (D) , when used with VXLAN, provides the control plane for MAC/IP route distribution. It enables multi-homing and supports all-active forwarding , ensuring consistent forwarding decisions across the fabric. EVPN also prevents loops and optimizes traffic forwarding using mechanisms like aliasing and mass withdrawal.

Smart Link (A) is typically used for primary/backup (active-standby) scenarios, not active-active. BFD (B) is a fast fault detection protocol and does not provide active-active forwarding capability.

Huawei best practices recommend combining VXLAN + EVPN + M-LAG to achieve highly reliable, scalable, and active-active data center access architectures .

Therefore, the correct answers are C and D .

In Huawei M-LAG design, strict requirements ensure stability and consistency between the two participating devices. Option A is false because M-LAG must be established between devices of the same type and model (or at least fully compatible models) . This ensures consistent forwarding behavior, synchronization of MAC/ARP tables, and proper operation of the peer-link and keepalive mechanisms. Using different device types is not supported and may lead to instability.

Option B is correct : unidirectional isolation is relevant only for dual-homed scenarios. If a device is single-homed, this mechanism is not applied.

Option C is correct : the peer-link is a critical connection between M-LAG peers and is typically configured as an Eth-Trunk (link aggregation) to ensure high bandwidth and redundancy.

Option D is also correct : peer-link interfaces are dedicated and cannot be used for other services, ensuring reliable synchronization and control-plane communication.

Huawei best practices emphasize homogeneous device deployment for M-LAG to guarantee predictable and stable operation.

In Huawei CloudFabric solutions integrated with OpenStack, Neutron is the key component responsible for network service management and integration with external network controllers such as iMaster NCE-Fabric .

Neutron provides APIs for creating and managing network resources such as:

Networks (VXLAN/BD)

Subnets

Ports

Routers

iMaster NCE-Fabric integrates with Neutron via northbound APIs , allowing it to automatically translate cloud network requests into underlay and overlay configurations (e.g., VXLAN, EVPN, routing policies) on physical network devices.

Other components:

Nova (A) manages compute resources (VM lifecycle)

Keystone (B) handles authentication and identity services

Cinder (C) provides block storage services

These components do not directly interact with network controllers for fabric provisioning.

Huawei emphasizes tight integration between Neutron and iMaster NCE-Fabric to enable automated, policy-driven network deployment , which is essential for cloud data center operations.

Therefore, the correct answer is D (Neutron) .

In Huawei CloudFabric architecture, the underlay network is the physical IP network that provides basic connectivity and routing reachability for overlay services such as VXLAN.

Option A is correct : the underlay acts as the bearer (transport) network for VXLAN traffic, carrying encapsulated packets between VTEPs.

Option B is correct : the underlay includes both NVE (Network Virtualization Edge) devices that perform VXLAN encapsulation/decapsulation and standard IP forwarding devices (e.g., spine switches).

Option C is correct : the underlay has its own independent control plane , typically using IGP (OSPF/IS-IS) or BGP (EBGP) , and operates independently from the overlay (EVPN).

Option D is false because the underlay network is fundamentally responsible for Layer 3 IP reachability between VTEPs. Without proper L3 routing in the underlay, VXLAN tunnels cannot be established.

Huawei best practices emphasize a simple, stable, and highly reliable underlay , as it is the foundation for all overlay services.

Therefore, the correct answer is D .

In Huawei CloudFabric design, M-LAG (Multi-Chassis Link Aggregation) is widely used to provide active-active forwarding and high availability at the access and border layers. When border leaf nodes are deployed in an M-LAG pair, they typically connect to upstream PE (Provider Edge) devices in a dual-homing (square topology) manner, ensuring both link-level and device-level redundancy.

However, Huawei design guidelines clearly state that an interconnection link (commonly called a peer-link or bypass link) between M-LAG devices is mandatory. This link is essential for synchronization of forwarding states, MAC address tables, ARP/ND entries, and control plane information between the two devices. It also ensures proper traffic forwarding in failure scenarios, such as when one device loses its uplinks but remains operational.

Without this peer-link, traffic consistency and loop prevention mechanisms cannot function correctly, leading to potential traffic loss or loops. Therefore, even in dual-egress scenarios with PE devices, the bypass/peer link is still required.

Hence, the statement is FALSE.

In Huawei data center networking, M-LAG (Multi-Chassis Link Aggregation Group) is a critical technology used to provide active-active access, high availability, and link redundancy . It allows a downstream device (such as a server) to establish a single logical Eth-Trunk across two separate physical switches (DeviceA and DeviceB).

From the server’s perspective, both upstream switches appear as one logical device , which eliminates the need for protocols like STP and enables simultaneous forwarding on all active links . This significantly improves bandwidth utilization and avoids blocked links.

The key advantage highlighted in the statement is the improvement of reliability from card-level to device-level . In traditional single-device link aggregation, failures are limited to interface cards. However, with M-LAG, even if an entire switch (device-level failure) goes down, traffic continues to flow through the other active switch without interruption.

Huawei CloudFabric widely adopts M-LAG + VXLAN EVPN to ensure high reliability, fast convergence, and continuous service availability .

Therefore, the statement is TRUE .

Huawei data center design guidelines emphasize end-to-end reliability across all layers of the physical network, including uplinks, devices, interconnections, and server access. All the listed options reflect valid reliability principles.

Option A is correct because ECMP (Equal-Cost Multi-Path) is a fundamental mechanism in spine-leaf architectures, ensuring load balancing and fast convergence when links fail. Option B highlights modular switch reliability , where inter-card connections prevent single-card failures from impacting connectivity.

Option C describes the DAD (Dual-Active Detection) mechanism in M-LAG scenarios. When a peer-link failure occurs, DAD ensures that only one device remains active, preventing split-brain conditions and maintaining network stability.

Option D addresses server-side reliability , where dual-homing with NIC teaming (active-active or active-standby) ensures uninterrupted service in case of link or device failure.

Together, these principles form Huawei’s comprehensive approach to building highly reliable and resilient data center networks.

In Huawei data center and network security architecture, native encryption support is a key differentiator between tunneling technologies and secure communication protocols.

SSL VPN (C) and IPsec VPN (D) both provide built-in encryption mechanisms . SSL VPN uses TLS/SSL protocols to encrypt application-layer traffic, making it suitable for secure remote access. IPsec VPN operates at the network layer and provides confidentiality, integrity, and authentication through protocols such as ESP (Encapsulating Security Payload), making it widely used for site-to-site and data center interconnection security.

On the other hand, VXLAN (A) and GRE (B) are encapsulation/tunneling technologies that do not inherently provide encryption. VXLAN is used for overlay networking (e.g., tenant isolation in CloudFabric), while GRE is used for simple tunneling across IP networks. Both require additional security mechanisms (such as IPsec) if encryption is needed.

Huawei CloudFabric design guidelines clearly separate overlay encapsulation (VXLAN) from security protocols (IPsec/SSL) , emphasizing that encryption must be implemented using dedicated security technologies.

Therefore, the correct answers are C and D .

Huawei’s data center design guidelines emphasize that spine-leaf architecture is a flattened, two-layer fabric designed to overcome the limitations of traditional three-tier networks. One of its key advantages is low and predictable oversubscription ratios , achieved through equal-cost multi-path (ECMP) forwarding and uniform link distribution.

Option A is correct as an advantage because spine-leaf enables resource pooling across zones , eliminating isolated silos and improving utilization. Option C is also a core benefit: the architecture provides high reliability, redundancy, and scalable east-west traffic capacity , which is critical for cloud and distributed applications. Option D reflects the fundamental design principle where each leaf connects to multiple spine switches , ensuring full-mesh reachability and consistent latency.

However, Option B states that the architecture has a high oversubscription ratio , which contradicts Huawei best practices. In fact, spine-leaf is specifically designed to minimize oversubscription , ensuring balanced traffic and predictable performance.

Therefore, B is not an advantage , making it the correct answer.