MPLS L3VPN: Service Provider VPN Architecture

Introduction

MPLS L3VPN is the technology that service providers use to offer enterprise WAN connectivity (replacing expensive leased lines). Understanding how MPLS works is essential for any network engineer working with carrier networks or multi-site enterprise connectivity. This guide teaches the fundamentals and configuration of MPLS L3VPN.

MPLS Concepts

MPLS adds labels to packets, enabling fast switching without per-packet routing table lookups:

TEXT

Normal IP routing:           MPLS forwarding:
Router receives IP packet → Router receives labeled packet →
Look up destination IP in   Pop label, push new label,
routing table (slow)        forward based on label (fast)

MPLS label structure (32-bit):
+---------------+------+---+-------+
|     Label     |  TC  | S |  TTL  |
| (20 bits)     |(3bit)|   |(8bit) |
+---------------+------+---+-------+

L3VPN Architecture

TEXT

Customer Site A ──── CE-A ──── PE-A ═══ (MPLS Core) ═══ PE-B ──── CE-B ──── Customer Site B
                              Provider Edge             Provider Edge
                              Router                    Router

CE = Customer Edge router (customer's equipment)
PE = Provider Edge router (ISP's router that connects to customer)
P  = Provider core router (ISP internal, never sees customer traffic)

PE routers maintain separate VRF (Virtual Routing and Forwarding) tables per customer:
- Customer A VRF: knows A's routes only
- Customer B VRF: knows B's routes only
Traffic never leaks between customers

Configuring MPLS L3VPN on Cisco IOS

TEXT

! === Provider Core: Enable MPLS ===
! On ALL routers in MPLS core:

ip cef              ! Required for MPLS
mpls label protocol ldp
mpls ldp router-id Loopback0 force

interface GigabitEthernet0/0
  mpls ip           ! Enable MPLS on core-facing interface

! Verify LDP neighbors
show mpls ldp neighbor

! Verify labels assigned to routes
show mpls forwarding-table

TEXT

! === PE Router: Configure VRF for Customer ===
ip vrf CUSTOMER_A
  rd 65000:100           ! Route Distinguisher: makes routes globally unique
  route-target export 65000:100   ! Which routes to export to BGP
  route-target import 65000:100   ! Which routes to import from BGP

! Assign VRF to customer-facing interface
interface GigabitEthernet0/1
  ip vrf forwarding CUSTOMER_A
  ip address 10.0.0.1 255.255.255.252

! Configure MP-BGP between PE routers
router bgp 65000
  bgp log-neighbor-changes
  neighbor 10.255.0.2 remote-as 65000    ! iBGP with other PE
  neighbor 10.255.0.2 update-source Loopback0
  !
  address-family vpnv4
    neighbor 10.255.0.2 activate
    neighbor 10.255.0.2 send-community extended
  !
  address-family ipv4 vrf CUSTOMER_A
    neighbor 10.0.0.2 remote-as 65001    ! eBGP with customer CE
    neighbor 10.0.0.2 activate
    redistribute connected

! Verify VRF routing table
show ip route vrf CUSTOMER_A

! Verify VPNv4 routes in BGP
show bgp vpnv4 unicast all

Verification Commands

BASH

! Check MPLS label switch paths
show mpls ldp bindings
show mpls forwarding-table [prefix]

! Trace MPLS path (shows labels at each hop)
traceroute mpls ipv4 10.100.1.0/24 source 10.255.0.1

! Check VPN routes
show ip route vrf CUSTOMER_A
show bgp vpnv4 unicast rd 65000:100

! Verify label stack on packets
debug mpls packets

! Check connectivity from PE perspective
ping vrf CUSTOMER_A 192.168.1.1

QoS in MPLS L3VPN

TEXT

! Mark traffic at CE and preserve markings
! On CE router:
ip access-list extended VOICE-TRAFFIC
  permit udp any any range 16384 32767  ! RTP voice

class-map match-any VOICE
  match access-group name VOICE-TRAFFIC

policy-map MARK-VOICE
  class VOICE
    set ip dscp ef          ! Mark as Expedited Forwarding
  class class-default
    set ip dscp default

interface GigabitEthernet0/0
  service-policy output MARK-VOICE

! On PE: map DSCP to MPLS EXP bits for QoS through core
! The MPLS EXP (experimental) bits carry QoS markings through core

Troubleshooting MPLS L3VPN

TEXT

! Customer can't reach other site - troubleshooting steps:

1. Check PE can reach customer CE:
ping vrf CUSTOMER_A 10.0.0.2

2. Check customer routes in PE VRF:
show ip route vrf CUSTOMER_A

3. Check routes being exported to VPNv4 BGP:
show bgp vpnv4 unicast all

4. Check MPLS forwarding works:
traceroute mpls ipv4 10.255.0.2/32 source 10.255.0.1

5. Check label stack:
show mpls forwarding-table 10.255.0.2 detail

MPLS L3VPN is the backbone of enterprise WAN connectivity worldwide. The key concepts to master: VRF isolation (keeps customer traffic separate), Route Distinguishers (make routes globally unique), Route Targets (control which VRFs share routes), and MP-BGP (transports VPN routes between PE routers).