Huawei HCIE-Datacom cheat sheet

OSPF LSA types: Type 1 Router (area-scoped), Type 2 Network (DR for broadcast/NBMA), Type 3 Summary (ABR inter-area), Type 4 ASBR Summary, Type 5 External (AS-wide), Type 7 NSSA External (translated to Type 5 by the ABR with the highest router ID).

OSPF cost = reference bandwidth (default 100 Mbps) divided by interface bandwidth; costs below 1 are clamped to 1, so 10G and 100G links both show cost 1 unless auto-cost reference-bandwidth is raised.

OSPF adjacency requires matching area ID, hello/dead timers (10/40 s on broadcast, 30/120 s on NBMA/P2MP), authentication, MTU (unless ignore-mtu-check), and stub/NSSA flags; a mismatch in any of these keeps the neighbor stuck in ExStart or 2-Way.

IS-IS uses Level 1 (intra-area), Level 2 (backbone), and L1/L2 routers; the default narrow metric is 6-bit (max 63) per interface, so wide metrics must be enabled for links above 63 or TE.

BGP best-path order: highest Weight, highest Local Preference, locally originated, shortest AS_PATH, lowest Origin (IGP < EGP < Incomplete), lowest MED (same neighbor AS by default), eBGP over iBGP, lowest IGP metric to next hop, oldest route, lowest Router ID, lowest peer address.

BGP route reflectors relax the iBGP full-mesh rule; Cluster_List and Originator_ID prevent loops, and a client reflects routes to clients and non-clients while a non-client only forwards to clients.

MPLS label stack: push on ingress PE (implicit-null 3 for directly connected, explicit-null 0 for QoS preservation), swap in the core, pop on egress; PHP pops the outer label so the penultimate router forwards with implicit-null.

VXLAN encapsulates Layer 2 frames in UDP (dest port 4789) with an 8-byte header holding a 24-bit VNI; BGP EVPN route types are Type 2 (MAC/IP), Type 3 (Inclusive Multicast), Type 5 (IP Prefix), and Type 8 (Auto-discovery).

Segment Routing uses SRGB (default 16000-23999); an SRv6 locator is advertised as a prefix SID with End, End.X, End.DT4, and End.DT6 behaviors, and TI-LFA provides sub-50 ms protection using the post-convergence path.

VLAN stacking (QinQ) adds an outer 802.1Q tag; the outer tag identifies the service provider VLAN while the inner tag is customer traffic, allowing 4094 x 4094 VLAN combinations.

STP timers: Hello 2 s, Forward Delay 15 s, Max Age 20 s; RSTP uses proposal/agreement and edge ports to converge in sub-second time, and MSTP maps VLANs to instances for load sharing.

Eth-Trunk modes: manual load-balance has no negotiation, LACP static uses Active/Passive with a max of 8 active links (up to 16 with hot standby), and LACP priority plus system MAC determine the actor selection.

VRRP: Master election by highest priority (default 100, range 1-254; 255 = owner), then highest IP; preemption is enabled by default and the virtual MAC is 0000-5e00-01XX.

DHCP snooping trusts only uplink ports; untrusted ports drop OFFER/ACK, and the binding table (MAC-IP-VLAN-Port) feeds IPSG and DAI to block spoofed source addresses and ARP replies.

IPv6 address types: global unicast 2000::/3, link-local fe80::/10, unique local fc00::/7, multicast ff00::/8; ND replaces ARP with NS/NA and RS/RA, and SLAAC uses the RA prefix with a 64-bit interface ID.

NAT64/DS-Lite and IPv6 transition: 464XLAT combines stateless NAT46 on the client with stateful NAT64 on the carrier; MAP-T uses stateless double translation with a shared IPv4 address and port set.

QoS scheduling: PQ is strict priority (starves lower queues), WFQ and WRR share bandwidth by weight, and LLQ combines a strict-priority queue with CBWFQ for the remaining classes; WRED drops early on congestion to avoid global synchronization.

iMaster NCE-Campus delivers SD-WAN and fabric management; underlay automation uses NETCONF/YANG (RFC 6241) with RESTCONF as the HTTP-based alternative, and telemetry uses gRPC or UDP-based dial-out.

Huawei VRP configuration: commit changes with commit (two-phase) on devices supporting candidate configuration; display current-configuration and display this distinguish running config from the current view.

AAA on Huawei uses the aaa view with authentication-scheme, authorization-scheme, and accounting-scheme; RADIUS uses UDP 1812/1813 and HWTACACS uses TCP 49.

SNMP versions: v1/v2c use community strings (clear text), v3 adds USM authentication (MD5/SHA) and privacy (DES/AES); traps are unsolicited on UDP 162 while polling uses UDP 161.

Syslog severity: 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notification, 6 Informational, 7 Debugging; the info-center loghost command sends messages to a collector on UDP 514.

NetStream/sFlow export flow records to a collector for traffic analysis; NetStream supports v5, v8, and v9 templates, and sampling reduces CPU load on high-speed interfaces.

Network automation tools: Ansible uses SSH with YAML playbooks (agentless), while Python with Netmiko/NAPALM scripts device configuration; both rely on idempotent, templated changes for repeatability.

Troubleshooting order: verify physical layer (display interface counters for CRC/errors), then Layer 2 (MAC table, STP state), then Layer 3 (routing table, FIB), then policy (ACL, NAT, QoS), then application (ping, traceroute, capture).