MPLS, or Multiprotocol Label Switching, solves a fundamental problem of traditional IP routing: speed and flexibility. In older networks, every router along a packet's path had to perform a complex lookup on the destination IP address, which is like reading a whole address book for every single letter. MPLS replaces this slow process with a simple, fast label lookup, allowing data to be forwarded much more quickly and enabling sophisticated traffic engineering. This concept is critical for the 350-501 exam because it is the foundation for many advanced Service Provider technologies like VPNs, Traffic Engineering, and Segment Routing.
Jump to a section
A simple way to picture MPLS Basics and Label Distribution
A railway switchyard is a central hub where trains arrive, are sorted, and are sent out to different destinations. Each train car has a final destination, like a specific city or depot. In a traditional network, every switch along the way would need to look at the train car's destination address to decide which track to send it on. This is slow and inefficient, especially when many trains are moving through the yard.
Now, imagine a smarter system. As a train enters the yard, a controller gives each car a temporary, easy-to-read sticker with the train's route number. This sticker is a simple label with a short number like '47'. Switches along the route are pre-programmed to know what to do when they see a train car with sticker '47': they just push the car along a specific track without ever needing to check the final destination again. The sticker can even be stacked—if a car needs to go through multiple yards, it might have a stack of stickers. The outermost sticker tells the first yard what to do, and when the car leaves that yard, the outer sticker is removed, revealing the next sticker for the next yard. This is faster, simpler, and reduces errors. The labels are exchanged between yards using a standardised set of hand signals, ensuring every yard knows which sticker corresponds to which route. This is exactly how MPLS works: labels are the stickers, routers are the switches, and the handshake is the Label Distribution Protocol (LDP).
MPLS (Multiprotocol Label Switching) is a data-carrying technique that uses short, fixed-length labels to direct data packets across a network. Think of it as a high-speed sorting system for data. Its core purpose is to improve the speed, predictability, and manageability of network traffic, especially in large Service Provider networks.
Before MPLS, networks used traditional IP routing. Each router (a specialized computer that forwards data) would receive a packet, look at the destination IP address (a long number like 192.168.1.1), perform a complex lookup in its routing table to find the best path, and then forward the packet. This is called 'destination-based routing'. The problem is that every single router along the path had to do this lookup independently. This is slow, and it makes it hard to force traffic to go a specific way if you want to, for example, avoid a congested link.
MPLS changes this. At the edge of an MPLS network, a router called a Label Edge Router (LER) or Ingress Provider Edge (PE) router receives a normal IP packet. It classifies the packet based on its destination, or other criteria like quality of service. It then attaches a small, 4-byte label to the front of the packet. This label is a short identifier, say, '100'. The packet now has a shim header with the label, and it enters the MPLS network.
Inside the network, there are routers called Label Switch Routers (LSRs). These routers do not look at the IP address. They only look at the outermost label on the packet. They have a special table called a Label Information Base (LIB) or a Forwarding Equivalency Class (FEC) table. This table tells them: 'If I see label 100, remove it, and push label 200, and forward the packet out port 4.' The key is that this label lookup is a simple, direct table lookup, much faster than a complex IP routing lookup. This process is called a swap operation.
The label can also be pushed (added) or popped (removed). When a packet leaves the MPLS network, the last LSR (the Egress LSR or PE router) pops the final label and forwards the remaining IP packet using traditional routing.
This brings us to the concept of the Label Stack. Just like our initial analogy of the train with a stack of stickers, MPLS packets can carry multiple labels stacked on top of each other. The outermost label is used for forwarding at the current router. Once that label is popped, the next label underneath becomes the active label for the next router. This is incredibly powerful. For example, in MPLS VPNs (Virtual Private Networks), the top label might direct the packet through the provider's backbone, and the second label might identify which customer's VPN the packet belongs to.
Now, how do all these routers know which labels to use? This is where the Label Distribution Protocol (LDP) comes in. LDP is the standard 'handshake' protocol used by routers in an MPLS network to exchange label information. LSRs use LDP to tell their neighbouring routers: 'For any packets that belong to this specific destination network (let's say it is network 10.1.1.0/24), use label 100.' They build up their LIBs based on these advertisements. The process is automated and ensures that every router in the path has a consistent view of label assignments. The routing protocol (like OSPF or IS-IS, which find the paths) works together with LDP (which distributes the labels for those paths).
In summary, MPLS offers a 'connection-oriented' paradigm inside a 'connectionless' IP network. It creates Label Switched Paths (LSPs), which are predetermined paths through the network defined by the sequence of labels. This allows Service Providers to engineer traffic, create VPNs, and offer guaranteed service levels, all of which are essential for modern telecommunications. For the 350-501 exam, you must understand these five components:
The difference between IP routing and MPLS forwarding.
The role of PE (Provider Edge) and P (Provider) routers.
The operations: Push, Swap, and Pop.
The concept of a Label Stack and its uses.
How LDP distributes labels to build LSPs.
Enable Underlying IGP
Configure a routing protocol (e.g., OSPF or IS-IS) on all routers in the MPLS domain. This builds a consistent view of the network topology and ensures all routers can reach each other. LDP requires this IGP to be running to establish its own sessions.
Enable MPLS on Interfaces
Activate MPLS forwarding on the interfaces connecting the routers. This tells the router that those interfaces can process and forward labelled packets. It is a per-interface configuration command.
Enable LDP on Interfaces
Turn on LDP on the same interfaces. The router will start sending LDP Hello messages (UDP to 224.0.0.2) to discover neighbouring LSRs. Once a neighbour is discovered, they establish a TCP session (port 646) to exchange label bindings.
LDP Neighbour Discovery and Session Establishment
LDP Hello messages are sent periodically. When two routers receive each other's hellos, they open a TCP connection. They use this connection to exchange initialization messages and negotiate parameters (like label distribution method). Once the session is up, they exchange label mappings.
Label Mapping Advertisements
Each router advertises its FECs (typically its directly connected and loopback IP prefixes) with a label binding. The upstream router receives this and installs the label into its LIB and LFIB. This builds the forwarding path.
Packet Forwarding with Labels
An IP packet arrives at the ingress PE. It matches a FEC. The PE pushes the corresponding label onto the packet. The labelled packet is forwarded to the next-hop LSR. Each core LSR performs a label swap based on its LFIB. The penultimate hop performs PHP and pops the label, forwarding the plain IP packet to the egress PE.
Imagine you are a network engineer for a large internet Service Provider (ISP) called 'GlobalConnect'. You have customers all over the country: small businesses, large banks, and streaming services. Each of these customers needs to have their data securely and reliably transported across your backbone network.
A year ago, your network used traditional IP routing. When a customer sent a packet, every router it hit had to do a complex routing lookup. This worked, but you noticed problems. The network was getting slow as traffic grew. More importantly, you could not force traffic to go a specific way. For example, you have a cheap but high-latency satellite link and an expensive, low-latency fibre link. With traditional routing, a packet from a critical banking application might choose the cheap satellite link simply because it was the shortest path, causing delays. You had no control.
You decide to implement MPLS. First, you configure your edge routers (the PE routers that connect directly to customers) and your core routers (the P routers in the middle of your network). You enable a routing protocol like OSPF (Open Shortest Path First) on all of them so they know the topology of your network. Then, you enable LDP on all interfaces.
As soon as you enable LDP, the routers start talking to each other. They discover their neighbours and exchange label bindings. Router A says to Router B: 'For the network that is directly connected to me, 10.10.10.0/24, I want you to send me packets for that network with label 150.' Router B does the same for its networks. This automatic process builds a complete map of labels for every destination in your network.
Now, a customer sends an IP packet destined for a remote site. The PE router receives it. It does a routing lookup, finds that the best path uses an LSP (Label Switched Path) to the egress PE. It pushes a label onto the packet. This label corresponds to the next-hop P router. The core P routers receive the packet, perform a lightning-fast 'swap' operation on the label, and forward it along the path. The egress PE router pops the label and delivers the original IP packet to the customer's remote site.
Later, a bank asks for a new MPLS VPN service. You create a Virtual Routing and Forwarding (VRF) instance on the PE routers for this bank. Now, when the bank's packets arrive, the PE router pushes a label stack: an outer label for the P routers to get the packet to the egress PE, and an inner label (the VPN label) that tells the egress PE which VRF table to look up. This is a classic 'label stacking' scenario.
As an engineer, your daily work involves:
Configuring and verifying LDP sessions: checking that neighbour adjacencies are formed using commands like 'show mpls ldp neighbor'.
Monitoring label-switched paths: using tools and commands to trace the path a label takes through the network.
Troubleshooting LDP issues: if labels are not being distributed correctly, you might check for IP connectivity (LDP requires an underlying IGP like OSPF) or check interface ACLs that might be blocking LDP (UDP port 646 and TCP port 646).
Designing label stacks: for advanced services like MPLS TE (Traffic Engineering) or VPNs, you need to plan which labels go where.
Optimising performance: you might use MPLS TE to manually steer traffic away from a congested link and onto a faster path, which is impossible with standard IP routing.
This transition from traditional IP to MPLS is a common project for Service Provider engineers, and understanding exactly how labels are pushed, swapped, and popped is the core skill tested in the 350-501 exam.
The 350-501 exam tests 'MPLS Basics and Label Distribution' relentlessly. You must know this area cold. The exam objective 'spcor-mpls-sr' specifically covers the architecture, the label stack, and LDP operations. Here is exactly what they test and how they try to trap you.
Exam topics that appear frequently:
The forwarding plane vs. the control plane: The exam will ask you to separate the roles. The control plane is where LDP runs (exchanging labels). The forwarding plane is where the actual label lookup and packet forwarding happens. They love to ask which protocol or process belongs to which plane.
Label operations: Push, Swap, and Pop. You must be able to identify which operation happens at each router type (Ingress PE, core P, Egress PE). A common scenario question gives you a diagram of routers and a label stack, and asks what operation a specific router performs.
LDP operation details: LDP uses UDP for neighbour discovery (hello messages) and TCP for session establishment. They will test if you know the port numbers (UDP 646 for hellos, TCP 646 for the session). Also, know that LDP uses 'liberal label retention' by default, meaning it stores all labels it receives, not just the best one.
Label space: 'per-interface' vs. 'per-platform' label space. A typical core router uses per-platform (the same label is used for the same FEC regardless of the interface it was learned on). Edge routers might use per-interface.
FEC (Forwarding Equivalency Class): A FEC is a group of IP packets which are forwarded in the same manner (same path, same treatment). LDP binds a label to a FEC. The exam will test that a FEC is typically a destination IP network prefix.
Penultimate Hop Popping (PHP): This is a very popular topic. PHP means the router before the egress router (the penultimate LSR) pops the label before sending the packet to the egress router. This means the egress router just sees a plain IP packet. The exam often asks: 'Who performs PHP and why?' The answer: the penultimate hop does it to relieve the egress router of the work of doing a double lookup.
Traps they set:
Confusing LDP with a routing protocol: LDP does not find paths. It distributes labels for paths that are already known by a routing protocol like OSPF or IS-IS. A trick question might claim LDP calculates routes. That is wrong.
Label stack order: The outermost label is the first to be processed. A question might show a label stack and ask which label the core router sees. The answer is the top one.
LDP over MPLS: They might ask if LDP operates over an MPLS label. The answer is no—LDP exchanges label information, but the LDP messages themselves are sent as IP packets, not MPLS-encapsulated packets.
PHP confusion: They might claim that the egress PE performs PHP. That is false. The penultimate hop (the P router) does it to optimise the egress router's forwarding.
Graceful restart: Know the term. LDP supports Graceful Restart mechanisms to avoid label loss when a router reboots. This is a specific exam objective.
Key definitions to memorise:
LSR: Label Switch Router (any router that does MPLS forwarding).
LER: Label Edge Router (typically a PE at the edge of the MPLS domain).
LIB: Label Information Base (the table holding all label bindings).
LFIB: Label Forwarding Information Base (the table used to actually forward packets).
LSP: Label Switched Path (the path a labelled packet takes).
Question patterns: Expect multiple-choice questions that ask: 'Which statement is true regarding the forwarding of an MPLS packet?', 'What is the purpose of the label stack?', or 'Which protocol advertises label bindings for a FEC?' The answers are usually short and direct. There will also be scenario-based questions where you must trace the path of a packet and identify the labels at each hop.
MPLS replaces slow IP routing lookups with fast, exact-match label lookups to improve forwarding speed and enable traffic engineering.
The three fundamental MPLS label operations are Push (adding a label at the ingress), Swap (changing a label at a core router), and Pop (removing a label at the egress or penultimate hop).
LDP (Label Distribution Protocol) is a control plane protocol that uses UDP for neighbour discovery and TCP for session establishment to distribute label bindings for FECs.
Penultimate Hop Popping (PHP) is an optimisation where the router before the egress router pops the final label, so the egress router only needs to process a plain IP packet.
A label stack allows multiple labels to be carried on a single packet, enabling advanced services like MPLS VPNs where the top label is for transport and the inner label identifies the VPN.
MPLS runs on top of a Layer 3 routing protocol (like OSPF or IS-IS) but operates at Layer 2.5 in the OSI model, between the data link layer and the network layer.
These come up on the exam all the time. Here's how to tell them apart.
IP Routing (Connectionless)
Each IP packet is independently routed based on destination IP.
Each router performs a longest-prefix-match lookup.
Hard to engineer traffic paths explicitly; paths are determined by the routing algorithm.
MPLS Forwarding (Connection-Oriented)
Packets follow a pre-determined Label Switched Path (LSP).
Each LSR performs a simple exact-match label lookup.
Allows explicit traffic engineering using stacked labels and MPLS-TE.
LDP
Distributes labels based on paths learned by IGP.
Uses liberal label retention (stores all received labels).
Does not do path calculation; relies on underlying IGP.
RSVP-TE
Signals labels and reserves resources along an explicit path.
Uses conservative label retention (stores only labels from next hop).
Performs path calculation and can engineer traffic onto specific links.
Push Operation
Adds a new label to the top of an MPLS label stack.
Typically performed by the Ingress PE router.
Increases the label stack depth by one.
Pop Operation
Removes the outermost label from the label stack.
Typically performed by the Egress or Penultimate Hop router.
Decreases the label stack depth by one.
Per-Interface Label Space
Labels are unique only per interface; the same label can be used on different interfaces for different FECs.
Requires more memory as the same FEC might have different labels per interface.
Less common; used in older or edge-specific scenarios.
Per-Platform Label Space
Labels are globally unique across the entire router; a single label maps to a FEC regardless of ingress interface.
More memory-efficient and simpler to manage.
The default mode for core LSRs.
Mistake
MPLS is faster than regular IP routing because it uses a smaller, faster routing table.
Correct
MPLS forwarding is faster primarily because label lookup involves a simple exact match on a short identifier, whereas IP routing often requires a longest-prefix-match lookup which is computationally more complex. The table size is a secondary factor, not the primary reason.
Beginners often confound the mechanism (lookup type) with the data structure (table size).
Mistake
LDP discovers routes and determines the best path for traffic, just like OSPF.
Correct
LDP does not discover routes or calculate paths. It distributes labels for routes that have already been discovered by an interior gateway protocol (IGP) like OSPF or IS-IS. The IGP decides the path; LDP just provides a label for that path.
Both LDP and OSPF are control plane protocols, so beginners assume they do the same job. The distinction between path selection and label distribution is subtle but critical for the exam.
Mistake
The label in MPLS is always removed at the egress router (Egress PE).
Correct
The label is usually removed one hop earlier, at the penultimate hop router. This is called Penultimate Hop Popping (PHP). The egress router receives a plain IP packet, not a labelled packet.
The instinct is to think the label must travel all the way to the destination. The concept of 'popping before the end' to offload work is counter-intuitive for a beginner.
Mistake
MPLS VPNs require two labels because one is for security and one is for routing.
Correct
MPLS VPNs use two labels: the outer (top) label is a transport label that gets the packet to the egress PE router via the core P routers. The inner (second) label is a VPN label that tells the egress PE router which VRF to use for forwarding the packet to the correct customer network.
The function of the second label is often misunderstood as 'encryption' or 'security', when it is purely a routing identifier within the VPN context.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
MPLS stands for Multiprotocol Label Switching. It is often described as operating at Layer 2.5 in the OSI model, sitting between Layer 2 (Data Link) and Layer 3 (Network).
Generally yes, because MPLS forwarding uses a simple, exact-match lookup on a short label, whereas IP routing often requires a longer, more complex longest-prefix-match lookup. However, the speed advantage is reduced by modern hardware, and MPLS's primary value is its flexibility and traffic engineering features.
An IGP (like OSPF or IS-IS) discovers neighbours and builds a view of the network topology to calculate the best paths. LDP uses the routes learned by the IGP to distribute labels for those routes, enabling MPLS forwarding. LDP is dependent on the IGP.
PHP is a mechanism where the router that is one hop before the destination (the penultimate hop) removes the MPLS label from the packet before sending it to the egress router. This offloads the work of label processing from the egress LSR.
The LIB is built dynamically using LDP. LSRs exchange label bindings via LDP sessions. Each router receives label mappings from its neighbours for remote FECs and installs the best label (based on the IGP's path) into its LIB and subsequently into the LFIB.
The label stack allows multiple MPLS labels to be carried on a single packet. This is essential for services like MPLS VPNs, where the top label directs the packet through the core and the inner label identifies the VPN, or for MPLS Traffic Engineering, where a stacked label can provide explicit path control.
You've finished MPLS Basics and Label Distribution. Continue through the 350-501 study guide to build a complete picture of the exam.
Done with this chapter?