Huawei H12-891_V1.0 Exam With Confidence Using Practice Dumps

Huawei IPsec supports multiple modes for establishing Security Associations (SAs):

A. Template negotiation — Used in IPsec policy templates and dynamic VPNs.

B. IKE auto-negotiation mode — Automatically negotiates parameters via IKE Phase 1/2.

C. Certificate negotiation — IPsec peers can authenticate each other using certificates during IKE negotiation.

D. Manual mode — Static IPsec SAs can be manually configured without IKE, often used in simple or static topologies.

Exact Extract - Huawei Security Configuration Guide (USG Series):

“IPsec SAs can be established manually or dynamically through IKE, including using PSKs or certificates. Template-based approaches simplify large-scale deployment.”

An IPsec Security Association (SA) includes the following critical components:

SPI (Security Parameter Index)

Destination IP address

Security Protocol (AH or ESP)

Encryption/Authentication algorithms

The Source IP address is not a defining parameter of an SA. SA is unidirectional and identified based on the SPI and destination address.

Exact Extract - Huawei Security Configuration Guide – IPsec Fundamentals:

“An SA is uniquely identified by the SPI, destination IP, and security protocol. The source address is not a determining factor in the SA.”

The MPLS header consists of:

Label (20 bits) – Label value used for forwarding.

EXP (3 bits) – QoS field (Class of Service).

S bit (1 bit) – Bottom-of-Stack indicator.

TTL (8 bits) – Time-to-Live, similar to the TTL field in the IP header.

Function of TTL in MPLS:

It is used to prevent infinite loops.

Every LSR decrements the TTL by 1.

When TTL reaches 0, the packet is discarded.

This mirrors the behavior of IP TTL and ensures loop prevention in MPLS networks.

Correct answer: D. This field is used to prevent packet forwarding loops, similar to the TTL field in an IP header.