802.1X Authentication Overview
802.1X is a port-based authentication mechanism used for secure network access control. It involves:
* EAPoL (Extensible Authentication Protocol over LAN) communication between the client (supplicant) and the switch (authenticator).
* RADIUS communication between the authenticator and the authentication server (AAA server).
# A. 802.1X authentication uses EAPoL to exchange authentication information.
* EAPoL (Extensible Authentication Protocol over LAN) is used to send authentication packets over Ethernet (IEEE 802.3) networks.
# B. In EAP termination mode, the network device terminates EAP packets and re-encapsulates them into RADIUS.
* The switch acts as an authentication proxy by terminating EAP sessions and converting authentication information into RADIUS format.
# C. EAPoL is for wired (802.3), EAPoW is for wireless (802.11).
* EAPoL (EAP over LAN) is used in wired Ethernet networks.
* EAPoW (EAP over Wireless) is used in Wi-Fi (802.11) networks.
# D. In EAP relay mode, EAP packets are encapsulated into RADIUS using EAPoR (EAP over RADIUS).
* The switch does not terminate the EAP session but instead forwards EAP messages to the AAA server inside RADIUS packets.
Reference from Huawei HCIE-Datacom Documentation:
* Huawei 802.1X Configuration Guide - EAPoL, EAPoW, and EAPoR
* HCIE-Datacom Training Material - AAA Authentication Modes

Understanding Inter-AS MPLS VPN Option C (Solution 2)
In MPLS L3VPN Inter-AS Option C, the Route Reflectors (RRs) are used for VPN route distribution but do not participate in data forwarding. The traffic forwarding path is based on MPLS labels assigned at different routers.
Each data packet carries two MPLS labels:
Transport Label (T1) - Used for forwarding within the backbone.
VPN Label (V1) - Used for VPN route identification.
Breaking Down the Labels:
#VPN Label (V1) - Allocated by PE1 (answer: C#)
V1 (Inner Label) is the VPN label assigned by the egress PE router (PE1).
This label ensures that when the packet reaches PE1, it knows how to forward the traffic to CE1 (192.168.1.1).
#Transport Label (T1) - Allocated by P2 (answer: B#)
T1 (Outer Label) is the transport label assigned by P2 to forward the packet across the AS core.
This label ensures the packet reaches the next-hop router (ASBR-PE1 in AS100).
Why Are the Other Options Incorrect?
#A. " T1 is allocated by RR2 " (Incorrect)
RR2 is used only for route reflection; it does not participate in label allocation or forwarding.
#D. " V1 is allocated by P2 " (Incorrect)
P2 is an intermediate router and does not allocate VPN labels.
VPN labels are always assigned by the egress PE router (PE1 in AS100).
# Reference:Huawei HCIE Datacom - MPLS L3VPN Inter-AS Option C

Understanding VXLAN and ARP Suppression in BGP EVPN
VXLAN (Virtual Extensible LAN) is used toextend Layer 2 networks over Layer 3 infrastructure.
VXLAN uses VTEPs (VXLAN Tunnel Endpoints) to encapsulate and forward Layer 2 traffic.
BGP EVPN (Ethernet VPN)is used forMAC/IP address learning and distributionacross VXLAN networks.
How ARP Request Forwarding Works in This Scenario?
1##ARP Broadcast Suppression Enabled (VXLAN Optimized Forwarding)
SinceARP broadcast suppressionis enabled onVTEP1, theARP request is not flooded.
Instead, VTEP1checks its EVPN learned databaseto findPC2's MAC address (MAC C).
2##VTEP1 Encapsulates the ARP Request
VTEP1encapsulates the ARP request in a VXLAN packetand sends it toVTEP2.
Theoriginal ARP frame inside the VXLAN tunnel still has:
Source MAC:MAC A(PC1 ' s MAC)
Destination MAC:MAC C(PC2 ' s MAC, learned via EVPN)
3##VXLAN Outer Headers
Theouter VXLAN headeruses:
Source IP:1.1.1.1 (VTEP1)
Destination IP:2.2.2.2 (VTEP2)
VNI (VXLAN Network Identifier):200(BD 20)
4##VTEP2 Receives and Forwards the ARP Request
VTEP2 decapsulates the VXLAN packetand forwards theoriginal ARP requesttoPC2 (MAC C).
This ensures thatonly the intended receiver (PC2) gets the ARP request, preventing unnecessary broadcast flooding.
Why the Answer is MAC C?
#B. MAC C is Correct
Thedestination MAC of the inner data frameisPC2's MAC (MAC C).
This is becauseVTEP1 forwards the ARP request directly to VTEP2, which then forwards it to PC2.
Why Other Answers Are Incorrect?
#A. MAC B (Incorrect)
MAC B is VTEP1's MAC address, which is used in theouter VXLAN header, not in the inner Ethernet frame.
#C. MAC A (Incorrect)
MAC A is the source MACof the ARP request (PC1), not the destination.
#D. MAC D (Incorrect)
MAC D is not mentioned in the topology, so it is irrelevant.
# Reference:Huawei HCIE Datacom - VXLAN BGP EVPN and ARP Suppression

Understanding EVPN (Ethernet VPN) and ARP Request Handling
# What is EVPN?
EVPN (Ethernet VPN) is aBGP-based control plane for VXLANthat improvesLayer 2 & Layer 3 network scalability.
Eliminatesflood-and-learn behaviorusingBGP MAC/IP advertisement routes.
# Why is an ARP Request Sent?
WhenCE1 (192.168.1.1/24) wants to communicate with CE2 (192.168.1.2/24), it sends anARP requestto discover the MAC address of CE2.
# How Does EVPN Process the ARP Request?
1##PE1 receives the ARP request from CE1.
2##PE1 sends a MAC/IP advertisement route (Type 2 EVPN route) to inform PE2 and PE3 of CE1's MAC address.
3##PE1 forwards the ARP request as BUM (Broadcast, Unknown unicast, and Multicast) traffic to PE2 and PE3.
4##PE3 (Designated Forwarder - DF) forwards the packet to CE2.
5##PE2 (Non-DF) does NOT forward the packet to avoid loops.
Analysis of the Answer Choices:
#A. When forwarding the packet to PE3, PE1 needs to add the BUM traffic label allocated by PE3 to the packet.
Correct:
BUM (Broadcast, Unknown Unicast, Multicast) traffic in EVPNis encapsulated with aspecial labelassigned by the receiving PE.
PE1adds the BUM traffic label for PE3before sending the ARP request.
#B. PE1 sends a MAC/IP advertisement route carrying the MAC address of CE1.
Correct:
EVPN Type 2 MAC/IP advertisement routesare sent to inform other PEs of CE1's MAC/IP binding.
#C. PE2 forwards the packet to CE1.
Incorrect:
PE2 is the Non-Designated Forwarder (Non-DF)anddoes NOT forward BUM trafficto avoid loops.
#D. PE3 forwards the packet to CE1.
Correct:
PE3 is the Designated Forwarder (DF) for this segment, meaning itforwards the ARP request to CE2.
Final answer: A, B, D
#Reference:Huawei HCIE-Datacom Guide - EVPN BGP MAC/IP Advertisement and BUM Traffic Handling Real-World Application:
Data Center Interconnect (DCI):EVPN prevents excessiveARP floodingacross VXLAN networks.
Enterprise Campus Networks:UsesEVPN VXLAN to scale Layer 2 connectivity across multiple locations.

BGP routing policiesallow administrators to:
Control incoming and outgoing routes.
Filter routes based onprefix, AS-PATH, communities, MED, next hop, etc.
Apply route maps, prefix lists, or filter policies during:
Route advertisement
Route reception
Route import/export into local RIB or VPN instance
This is a fundamental capability of BGP and is widely used in production environments for traffic engineering, route filtering, and policy-based routing.
Correct answer: A. TRUE
Reference:Huawei HCIE-Datacom V1.0 Study Guide -Chapter: BGP Policy ControlSection: Route Filtering and Policy Control Techniques