H12-891_V1.0 Exam Dumps : HCIE-Datacom V1.0

Huawei IPsec supports multiple modes for establishing Security Associations (SAs):

A. Template negotiation — Used in IPsec policy templates and dynamic VPNs.

B. IKE auto-negotiation mode — Automatically negotiates parameters via IKE Phase 1/2.

C. Certificate negotiation — IPsec peers can authenticate each other using certificates during IKE negotiation.

D. Manual mode — Static IPsec SAs can be manually configured without IKE, often used in simple or static topologies.

Exact Extract - Huawei Security Configuration Guide (USG Series):

“IPsec SAs can be established manually or dynamically through IKE, including using PSKs or certificates. Template-based approaches simplify large-scale deployment.”

Comprehensive and Detailed In-Depth Explanation:

NSR (Non-Stop Routing)andNSF (Non-Stop Forwarding)are high-availability mechanisms used to maintain network stability during routing process failures:

NSR (Non-Stop Routing):

Operates within thelocal router only.

Keeps routing information synchronized between theactive and standby processes.

Does not require collaboration from neighboring routers.

NSF (Non-Stop Forwarding):

Requires collaboration from neighboring routersthat support graceful restart.

The router undergoing failover relies on its neighbors tomaintain forwarding tableswhile control plane recovery takes place.

Neighboring routers must supportGR (Graceful Restart)for NSF to function correctly.

Therefore, the correct answer isBbecauseNSF requires neighboring router collaboration, whileNSR does not.

Comprehensive and Detailed In-Depth Explanation:

TheOutbound Route Filtering (ORF)function in BGP allows a BGP speaker to inform its peer about the prefixes that it wants to receive, thereby reducing unnecessary route advertisements.

IP Prefix-List (D)is the correct answer because it is used to define the list of prefixes that are sent to the BGP peer during theORF capability negotiation.

Filter-policy (A)andRoute-policy (B)are used for controlling routing information locally or filtering incoming/outgoing routes but do not directly control the number of routes sent using ORF.

ACL (C)is primarily used for packet filtering and is not related to BGP route filtering.