It is known that Loopback0 exists on router R1 and its address is 1.1.1.1/32. This loopback interface will be introduced when OSPF is enabled and direct routes are introduced. Now, both R1 and R2…

Question

Options

• A[Huawei]acl basic-2001 [Huawei-acl-basic-2001]rule 5 permit source 1.1.1.1 0.0.0.0 [Huawei-acl-basic-2001]quit [Huawei]route-policy policy-1 permit node 1 [Huawei-route-policy-policy-1]if-match acl 2001 [Huawei-route-policy-policy-1]apply deny [Huawei-route-policy-policy-1]quit [Huawei-ospf 1] [Huawei-ospf-1]import-route direct route-policy 1
• B[Huawei]acl 2001 [Huawei-acl-basic-2001]rule 5 permit source 1.1.1.1 255.255.255.255 [Huawei-acl-basic-2001]quit [Huawei]route-policy policy-1 deny node 1 [Huawei-route-policy-policy-1]if-match acl 2001 [Huawei-route-policy-policy-1]quit [Huawei]route-policy policy-1 permit node 2 [Huawei-route-policy-policy-1]quit [Huawei-ospf 1] [Huawei-ospf-1]import-route direct route-policy 1
• C[Huawei]acl 2001 [Huawei-acl-basic-2001]rule 5 deny source 1.1.1.1 0.0.0.0 [Huawei-acl-basic-2001]rule 10 permit source any [Huawei-acl-basic-2001]quit [Huawei]route-policy policy 1 permit node 1 [Huawei-route-policy-policy 1]if-match acl 2001 [Huawei-route-policy-policy 1]apply permit [Huawei-route-policy-policy 1]quit [Huawei-ospf 1] [Huawei-ospf-1]import-route direct route-policy 1
• D[Huawei]acl 2001 [Huawei-acl-basic-2001]rule 5 deny source 1.1.1.1 0.0.0.0 [Huawei-acl-basic-2001]rule 10 permit source any [Huawei-acl-basic-2001]quit [Huawei]route-policy policy 1 permit node 1 [Huawei-route-policy-policy 1]if-match acl 2001 [Huawei-route-policy-policy 1]quit [Huawei-ospf 1] [Huawei-ospf-1]import-route direct route-policy 1

• A
  12% (4)
• B
  9% (3)
• C
  76% (26)
• D
  3% (1)

Explanation

Option C is correct because it properly constructs both the ACL and the route-policy to achieve the goal: the ACL uses deny source 1.1.1.1 0.0.0.0 (wildcard 0.0.0.0 means exact host match) to block the Loopback0 route, then rule 10 permit source any allows everything else. When the route-policy's if-match acl 2001 is evaluated, 1.1.1.1/32 fails the match (denied by ACL) and hits the implicit deny at the end of the route-policy, while all other directly connected routes pass and are imported into OSPF via import-route direct route-policy 1.

Option A is wrong because apply deny is not valid Huawei route-policy syntax; deny/permit behavior is set at the node level, not with an apply action, and there is no permit node to handle the other routes anyway. Option B is wrong because the wildcard mask 255.255.255.255 is incorrect for matching a specific host -- all ones means "don't care about any bit," so the ACL matches any source address rather than only 1.1.1.1/32; the correct wildcard for an exact /32 match is 0.0.0.0. Option D is wrong because it omits the apply permit action in the route-policy node, meaning matched routes are not explicitly permitted for redistribution into OSPF.

Memory tip: Huawei ACL wildcard masks are the inverse of subnet masks -- 0 means "bit must match," 1 means "ignore." For a /32 host, wildcard is 0.0.0.0. When you want to exclude one route and permit the rest, deny it in the ACL first, permit any remaining routes with a second rule, and let a single route-policy permit node handle the import -- the ACL does the filtering, the route-policy does the importing.

No community discussion yet for this question.