MPLS VPN: Labels, LSPs, Layer 3 and Layer 2 VPNs

01 /Labels and label-switched paths

MPLS inserts a 4-byte shim header between the Layer 2 header and the IP packet: a 20-bit label, 3 bits of traffic class, a bottom-of-stack bit and an 8-bit TTL. A label-switching router forwards by looking up the incoming label, swapping it for the outgoing label and sending the packet out the associated interface. No IP lookup happens in the core. The sequence of swaps from ingress to egress is a label-switched path (LSP). Labels stack: an outer label steers the packet across the core while an inner label tells the egress router which customer it belongs to.

02 /LDP, RSVP-TE and static LSPs

Segment routing has since replaced RSVP-TE in many new builds by encoding the path as a label stack at the ingress, removing per-path state from the core; the forwarding plane is unchanged.

03 /Layer 3 VPNs: VRFs, route distinguishers and route targets

RFC 4364 (originally RFC 2547) defines the BGP/MPLS IP VPN. Each provider edge (PE) router holds a VRF (virtual routing and forwarding table) per attached customer, populated from the customer edge (CE) router by static routes, OSPF or eBGP. Two customers may both use 10.0.0.0/8; to keep those prefixes distinct in one BGP table, each is prefixed with a 64-bit route distinguisher (RD), forming a VPN-IPv4 address.

PEs exchange VPN-IPv4 routes over MP-BGP (multiprotocol BGP), attaching a VPN label and one or more route target (RT) extended communities. RTs are the policy knob: a VRF imports routes carrying RTs it is configured to accept and exports its own routes with its configured RTs. The same import and export RT at every site gives a full mesh; asymmetric RTs build hub-and-spoke or extranet topologies. The P routers in the core run only the IGP and LDP or RSVP; they carry no customer routes at all, which is what lets the design scale to thousands of VPNs.

vrf CUSTOMER-A
 rd 65000:100
 route-target export 65000:100
 route-target import 65000:100
 address-family ipv4
!
router mpls
 mpls-interface ethernet 1/1
 lsp to-pe2
  to 10.255.0.2
  enable
!
show mpls lsp
show mpls ldp neighbor
show ip route vrf CUSTOMER-A

04 /Layer 2 VPNs: VLL and VPLS

Some customers want Ethernet, not routing. A virtual leased line (VLL, or pseudowire) carries frames from one attachment circuit to one remote circuit over an LSP, point to point; the provider never looks at customer IP. VPLS (virtual private LAN service) extends this to multipoint: PEs form a full mesh of pseudowires per customer and learn MAC addresses across them, so remote sites behave as one VLAN. VPLS scales poorly with MAC count and is being replaced by EVPN, which distributes MAC addresses in BGP instead of learning them by flooding.

05 /Why providers used it and where it stands

Before MPLS, carriers ran separate Frame Relay, ATM and IP networks. MPLS VPNs let one core sell private Layer 3 and Layer 2 services with traffic engineering and QoS, and the enterprise got any-to-any connectivity without managing a mesh of tunnels. Through the 2000s the MPLS Layer 3 VPN became the default enterprise WAN.

SD-WAN has since taken much of that enterprise business: encrypted tunnels over cheap broadband, centrally orchestrated, often cheaper per megabit. MPLS remains in carrier cores, where label forwarding still underpins mobile backhaul, wholesale transport and the underlays beneath the SD-WAN circuits that compete with it. Mixed designs, MPLS for latency-sensitive sites and broadband elsewhere, are the current norm. The core router page covers where the label switching happens.

06 /Foundry heritage: NetIron IMR 640 and MLX

Foundry entered the provider market with NetIron routers. The NetIron IMR 640, around 2003, was a metro and provider-edge router whose service provider guide included a chapter on BGP/MPLS VPNs that operators linked to when comparing configuration models; the accompanying command reference for static LSPs was also frequently cited. The later NetIron XMR and MLX chassis, around 2005 to 2007, carried MPLS Layer 3 VPN, VLL and VPLS into carrier cores and were part of what made the company attractive in the Brocade acquisition.