An enterprise builds a DC and deploys iMaster NCE-Fabric to automatically deliver network configurations.

In Huawei’s CloudFabric Solution, iMaster NCE-Fabric automates overlay network (e.g., VXLAN) configuration, while the underlay network is manually deployed. Tenant hosts failing to access external networks indicate a connectivity issue, likely at the overlay-underlay boundary or security layer. Let’s evaluate each option as a possible cause:

A. No return route is configured on the PE:This is a possible cause. The Provider Edge (PE) device (e.g., border leaf or router) must have a return route to the tenant’s VXLAN network for external access. Without it, traffic from external networks cannot reach the DC.POSSIBLE CAUSE.

B. The engineer did not check whether the service loopback interface needs to be configured on the VXLAN network based on the switch model:This is a possible cause. Some Huawei switch models (e.g., CE series) require a service loopback interface as the VTEP source IP. If omitted or misconfigured based on the model, external connectivity fails.POSSIBLE CAUSE.

C. No firewall security policy is configured when host traffic passes through the firewall:This is a possible cause. If a firewall is in the path (e.g., between tenant VPC and external network), a missing security policy (e.g., allowing outbound traffic) blocks access.POSSIBLE CAUSE.

D. The MAC address of the NVE interface on the VXLAN network is not manually specified:This is not a possible cause. The Network Virtualization Edge (NVE) interface in VXLAN does not require a manually specified MAC address; it uses the switch’s system MAC or auto-generates one. iMaster NCE-Fabric typically handles this automatically, and manual specification is neither required nor a common fault point for external access issues.NOT A POSSIBLE CAUSE.

Thus,Dis not a possible cause of the fault.References:Huawei CloudFabric Data Center Network Solution – Troubleshooting Guide; HCIP-Data Center Network Training – VXLAN Connectivity.