Huawei VPN Instance: Read It From the CLI, Not From STelnet

A question about a Huawei VPN instance usually arrives with the wrong tool attached. Someone wants to read the instance's routing table and asks how to reach the device over SSH. Those are two problems, and the second one only gets you to a prompt.

Separate the management session from the routing object, and the commands stop looking mysterious.

Two things people merge: the session and the object

STelnet is Huawei's SSH management service: it accepts a login and gives you a VRP prompt. A VPN instance is a separate routing and service context inside the device. The first is how you arrive; the second is what you inspect once you are there. Confusing them produces configuration changes to the SSH server when the actual question was about a routing table.

Nothing about the SSH session tells you which instance a packet will use.

List the instances first

Start with the inventory. display ip vpn-instance lists the instance identities configured on that platform and release. Read the output rather than assuming a name, because the instance you were told about may not exist on this device.

A name in a change ticket is not a name in the running configuration. If the name is not listed, stop and confirm which device the ticket means before guessing at similar names. A wrong instance that does exist produces output and a confidently wrong answer.

Look up one destination inside the instance

Once you have a real name, query the instance's own routing table. display ip routing-table vpn-instance BLUE 192.0.2.20 asks for the route to one destination inside that context, which is usually more informative than dumping the whole table.

Replace the example address with the destination you actually care about, and keep the instance name exact.

A route in the public table and a route in BLUE are different lookups. If the destination resolves in one and not the other, you have found the boundary rather than a broken command.

Check the prompt before you trust the output

The prompt tells you which device you are reading. If you opened a second SSH session from the first, every later command inspects the far end, not the device you started on. Some clients let you select a routing context for the SSH connection itself, which changes how the management session reaches its destination, not what it displays. Read the prompt every time you jump.

Two devices with similar hostnames make that mistake expensive.

Record the context with the finding

Write down the device, the instance name, the destination and the selected next hop or interface. Add the release, because command families and output fields differ across Huawei product lines.

An instance existing does not mean a remote-access tunnel is up. Check the feature's own status view for session state, and keep that separate from the routing answer.

That record is what makes the next question cheap, because someone can compare the same instance and destination after a change instead of repeating the investigation. Huawei's per-instance route lookup procedure follows the same shape of check.