FusionCompute is Huawei’s virtualization platform, part of the FusionSphere ecosystem, designed for managing virtualized resources in data centers. Its logical architecture consists of two primary modules:

VRM (Virtualization Resource Management):VRM is the management module responsible for centralized control, resource allocation, and monitoring of virtual machines, hosts, and clusters. It provides the user interface and orchestration capabilities for administrators to manage the virtualized environment.

CNA (Compute Node Agent):CNA runs on physical hosts and handles the execution of virtualization tasks, such as VM creation, resource scheduling, and communication with the underlying hypervisor (typically KVM in Huawei’s implementation). It acts as the compute node agent interfacing with the hardware.

Together, VRM and CNA form the core logical architecture of FusionCompute, with VRM managing the environment and CNA executing the compute tasks. The answer, per Huawei’s documentation, isVRM.References:Huawei FusionCompute Product Documentation – Architecture Overview; HCIP-Data Center Network Training – FusionCompute Section.

In Huawei’s CloudFabric Solution, Virtual Private Clouds (VPCs) enable isolated network environments, and interworking scenarios involve traffic between VPCs. The statement claims that traffic is checked and filtered only by the firewall in the source or destination VPC. Let’s evaluate:

VPC Interworking:Traffic between VPCs can be routed via a gateway (e.g., a Layer 3 gateway or centralized router) and may involve multiple security checkpoints depending on the design. Firewalls can be deployed in the source VPC, destination VPC, or a centralized location (e.g., a service chain or border gateway).

Firewall Role:The statement implies exclusivity (only one firewall), but in practice, traffic may be filtered by firewalls at both ends, a centralized firewall, or additional security devices (e.g., VAS nodes) in the path. For example, inter-VPC traffic might pass through a firewall in the source VPC for egress filtering and another in the destination VPC for ingress filtering, or a shared firewall in a hub-and-spoke model. Huawei’s security architecture (e.g., with SecoManager) supports distributed or centralized filtering, not limited to a single VPC’s firewall.

The statement isFALSE (B)because traffic is not restricted to being checked and filtered only by the firewall in the source or destination VPC; multiple firewalls or security devices may be involved.References:Huawei CloudFabric Data Center Network Solution – VPC Interworking; HCIP-Data Center Network Training – Security Design.

In Huawei’s CloudFabric Solution, iMaster NCE-Fabric automates overlay network (e.g., VXLAN) configuration, while the underlay network is manually deployed. Tenant hosts failing to access external networks indicate a connectivity issue, likely at the overlay-underlay boundary or security layer. Let’s evaluate each option as a possible cause:

A. No return route is configured on the PE:This is a possible cause. The Provider Edge (PE) device (e.g., border leaf or router) must have a return route to the tenant’s VXLAN network for external access. Without it, traffic from external networks cannot reach the DC.POSSIBLE CAUSE.

B. The engineer did not check whether the service loopback interface needs to be configured on the VXLAN network based on the switch model:This is a possible cause. Some Huawei switch models (e.g., CE series) require a service loopback interface as the VTEP source IP. If omitted or misconfigured based on the model, external connectivity fails.POSSIBLE CAUSE.

C. No firewall security policy is configured when host traffic passes through the firewall:This is a possible cause. If a firewall is in the path (e.g., between tenant VPC and external network), a missing security policy (e.g., allowing outbound traffic) blocks access.POSSIBLE CAUSE.

D. The MAC address of the NVE interface on the VXLAN network is not manually specified:This is not a possible cause. The Network Virtualization Edge (NVE) interface in VXLAN does not require a manually specified MAC address; it uses the switch’s system MAC or auto-generates one. iMaster NCE-Fabric typically handles this automatically, and manual specification is neither required nor a common fault point for external access issues.NOT A POSSIBLE CAUSE.

Thus,Dis not a possible cause of the fault.References:Huawei CloudFabric Data Center Network Solution – Troubleshooting Guide; HCIP-Data Center Network Training – VXLAN Connectivity.