MPLS Layer 3 VPNs allow multiple separate customer networks to share a single service provider infrastructure without being able to see each other. This matters for the 350-501 exam because the implementation of Provider Edge to Customer Edge routing and Virtual Routing and Forwarding (VRF) is one of the most heavily tested practical skills in the service provider core blueprint.
Jump to a section
A simple way to picture MPLS Layer 3 VPNs
Because a housing estate needs individual letterboxes yet shares a single postal delivery network, the postal service must keep each household's mail completely separate while it travels through the shared system.
A large housing estate has a single main gate where all postal vans arrive. Inside the estate there are ten smaller streets, each with its own post box. The postal service gives each street a unique colour-coded bag. When a parcel arrives for 42 Acacia Avenue, the sorter at the main gate looks at the street colour, stuffs the parcel into the matching bag, and the van driver delivers only that bag to the correct street. The driver never opens the bag or reads the address label again — the colour tells him where to go. A different colour bag might contain letters for 15 Birch Lane, but the driver treats each bag as a sealed unit. Crucially, two households on different streets can have identical house numbers — say, both number 10 — because the colour bag resolves the ambiguity. The colour bag is like a Virtual Routing and Forwarding (VRF) instance, the sealed bag is the MPLS label, the main gate is the Provider Edge (PE) router, and the individual streets are Customer Edge (CE) routers. The post never leaks between bags because the service is designed to enforce complete separation even while sharing the same vans and drivers.
An MPLS Layer 3 VPN is a technology that lets a service provider carry traffic from many different customers over one shared physical network while keeping each customer's traffic completely isolated. Think of it as a private tunnel through a public highway — your car does not see the cars in the other tunnel.
The key components are Provider Edge routers (PE), Customer Edge routers (CE), and Provider core routers (P). The PE router lives at the edge of the service provider's network and connects directly to the CE router, which is owned by the customer. The P routers sit in the middle of the provider's network and just forward packets as fast as possible.
To achieve isolation, the PE router uses something called a Virtual Routing and Forwarding instance, or VRF. A VRF is like a separate virtual router inside the physical PE router. Each customer gets their own VRF, which contains its own routing table, its own forwarding table, and its own set of interfaces. When a packet arrives from a CE router, the PE looks it up only in the VRF assigned to that customer. It never sees routes from other customers, so data cannot leak between them.
Now here is where MPLS comes in. Normal IP routing would require every router along the path to look at the destination IP address and make a forwarding decision. That works but it is slow and it makes VPN isolation harder. MPLS (MultiProtocol Label Switching) instead attaches a short fixed-length label to each packet. The label tells every P router exactly where to send the packet without ever examining the IP address inside. The PE router at the entrance pushes a label onto the packet. The core routers swap that label for another label and forward it. The last PE router pops the label and delivers the original IP packet to the destination CE.
For a Layer 3 VPN, the PE and CE routers exchange routing information using a standard routing protocol. The most common choices are:
Open Shortest Path First (OSPF) — a link-state protocol that builds a complete map of the customer network.
Border Gateway Protocol (BGP) — the internet's routing protocol, often used when the customer has multiple sites.
Static routing — the network administrator manually configures routes, which is simple but does not scale.
The PE router takes the customer routes it learns from the CE, converts them into a special form called VPN-IPv4 routes (also known as 'VPNv4' routes), and distributes them to other PE routers across the provider's MPLS backbone using Multiprotocol BGP (MP-BGP). The VPN-IPv4 route includes a Route Distinguisher (RD) — an 8-byte number that makes the same customer IP address globally unique. For example, if two customers both use the subnet 10.1.1.0/24, each gets a different RD, so the PEs never confuse them.
The PE routers also assign Route Targets (RTs) — these are like import/export tags. A PE exports routes with a certain RT value and only imports routes that match its configured import RT. This controls which customer sites can talk to each other. If you want a full mesh of central-office branches, you give all sites the same RT. If you want a hub-and-spoke design where branches cannot talk directly to each other, you use different import and export RTs.
Why does this exist? Before MPLS Layer 3 VPNs, service providers used technologies like Frame Relay or ATM to create private circuits. Those were expensive and inflexible. Later, IPsec tunnels over the internet offered privacy but required manual configuration for every pair of sites. MPLS Layer 3 VPNs combine the privacy of a dedicated circuit with the flexibility of IP routing — and the provider manages everything in the core, so the customer just needs a basic router at each site.
What does it replace? In enterprise networks, MPLS Layer 3 VPNs have largely replaced leased lines, Frame Relay, and ATM for connecting branch offices. They also compete with SD-WAN, though many organisations now use both: an MPLS Layer 3 VPN for critical traffic and an SD-WAN overlay for cost savings.
Provision the VRF
On the PE router, the engineer creates a VRF with a unique name and assigns a Route Distinguisher (RD). The RD is an 8-byte value (e.g. 65001:100) that ensures the customer's IP prefixes remain unique when advertised across the MPLS core.
Apply Route Targets
The engineer configures import and export Route Targets (RTs) for the VRF. The export RT is attached to routes leaving this VRF; the import RT determines which routes from other PEs enter this VRF. This step defines the VPN membership.
Bind the customer-facing interface to the VRF
The physical or sub-interface connecting to the CE router is assigned to the VRF. Once assigned, the interface's IP address lives inside the VRF context. Any traffic received on that interface is looked up in the VRF's routing table, not the global table.
Configure the PE-CE routing protocol
The engineer configures OSPF, BGP, or static routes inside the VRF to exchange routing information with the CE router. The PE learns the customer's prefixes and places them in the VRF routing table.
Redistribute VRF routes into MP-BGP
The PE automatically (or via explicit redistribution command) takes the VRF routes, prepends the RD to form VPNv4 prefixes, attaches the RT and a VPN label, and advertises them to other PEs using Multiprotocol BGP. This step makes the customer's network reachable from all other sites in the same VPN.
Verify end-to-end connectivity
The engineer uses commands like 'show ip route vrf CUSTOMER', 'ping vrf CUSTOMER', and 'traceroute vrf CUSTOMER' to confirm that traffic flows correctly between sites. They also check 'show bgp vpnv4 unicast all' to ensure VPNv4 routes are being exchanged between PEs.
An IT professional deploying an MPLS Layer 3 VPN for a retail chain with 200 stores will follow a concrete sequence of tasks.
First, they meet with the customer to understand the routing requirements. The customer says: 'Our head office at 10.50.0.0/16 must reach every store. Stores must reach head office but not other stores.' The engineer now knows the RT policy: export the head-office route with RT 100:1 and import it at stores. Each store exports its own routes with RT 100:2, but the head office imports RT 100:2 while stores do not import each other's RT.
Next, they configure the PE routers. On Cisco IOS-XR, the engineer enters global VRF configuration mode:
'vrf RETAIL' to create the VRF.
'rd 65001:1' to set the Route Distinguisher.
'route-target import 100:1' and 'route-target export 100:2' to define the import/export policy.
Then they assign the customer-facing interface to the VRF:
'interface GigabitEthernet0/0/0/1'
'vrf RETAIL'
'ip address 192.168.1.1 255.255.255.252'
'no shutdown'
The engineer now configures the PE-CE routing protocol. For a store with a simple network, they might use static routing:
'router static'
'vrf RETAIL'
'address-family ipv4 unicast'
'10.50.200.0/24 GigabitEthernet0/0/0/1 192.168.1.2'
If the customer runs OSPF, the engineer configures OSPF inside the VRF. Cisco calls this 'OSPF in a VRF' or 'OSPF on a stick'. The configuration looks like:
'router ospf 100 vrf RETAIL'
'router-id 1.1.1.1'
'network 192.168.1.0 0.0.0.3 area 0'
After the CE routes appear in the VRF table, the engineer verifies with 'show ip route vrf RETAIL'. Then they check that MP-BGP is exchanging VPNv4 routes with the other PE routers using 'show bgp vpnv4 unicast all summary'. If a store cannot reach head office, the engineer runs 'ping vrf RETAIL 10.50.0.1' and traces with 'traceroute vrf RETAIL 10.50.0.1'.
Common troubleshooting steps include:
Checking that the VRF has an RD configured — without it, routes are not advertised.
Verifying RT import/export matches between PEs — a mismatch causes black holes.
Ensuring MPLS is enabled on the core interfaces — without labels, packets are dropped.
Confirming that the CE router is sending the correct subnet mask — a /24 vs /32 mismatch causes partial connectivity.
Finally, the engineer documents the VRF, RD, and RT values in a network management system so the operations team can add new stores without guesswork.
The 350-501 exam tests MPLS Layer 3 VPNs in both multiple-choice and simulation-style questions. You will see questions that ask you to identify correct VRF configuration, interpret show command output, and select the right RD/RT values.
Key exam topics you must memorise:
The exact syntax for configuring a VRF on Cisco IOS-XR, including the 'rd' and 'route-target' commands.
The role of the Route Distinguisher (RD) — it makes IPv4 prefixes globally unique, not to control VPN membership.
The role of Route Targets (RTs) — they control which VPNs import/export routes, they do not create uniqueness.
The difference between OSPF in a VRF and regular OSPF — notably the 'capability vrf-lite' command and the use of the DN bit to prevent routing loops.
How MP-BGP carries VPNv4 routes and how the next-hop is resolved through an MPLS LSP.
Trap patterns the exam uses to catch unprepared candidates:
They give you a show command output that shows routes from two different VRFs with overlapping IP subnets. The correct answer is 'the routes are in different VRFs and therefore co-exist' — not 'the router has a duplicate route error'.
They ask 'What happens if two PEs have different RT import values for the same VRF?' The trap answer is 'routes are not exchanged between them'. Actually, routes are not imported by the PE that has the mismatched RT, but the other PE still exports its routes — it is a one-way failure.
They describe a scenario where the CE runs eBGP to the PE. The question asks 'Which attribute does the PE add to the BGP route before advertising it to other PEs?' The correct answer is 'the Route Distinguisher and the VPN label' — not 'the local preference'.
Key definitions to memorise for the exam:
VRF: A virtual routing and forwarding instance that maintains a separate routing table.
RD: An 8-byte value (typically type 0: 2-byte ASN:4-byte number) prepended to the IPv4 prefix to create a VPNv4 prefix.
RT: A BGP extended community attached to VPNv4 routes to control distribution.
PE-CE protocol: The routing protocol running between the provider edge and customer edge routers, typically OSPF, BGP, or static.
VPN label: The inner MPLS label allocated by the egress PE, used to identify the correct VRF at the destination.
Transport label: The outer MPLS label that gets swapped through the core, which directs the packet to the egress PE.
The exam will also test your understanding of multi-VRF scenarios. For example, a PE router connected to two different customers via the same physical interface using sub-interfaces and 802.1Q VLAN tagging. Each sub-interface is assigned to a different VRF. The question might ask 'How many VRF routing tables does the PE maintain?' The answer is two — one per customer, regardless of the number of VLANs.
Finally, be ready for questions about 'OSPF in a VRF' specific behaviours, such as the DN bit (down bit) which is set by the PE on LSA Type 3 to prevent the CE from re-advertising the route back into the MPLS core. Without the DN bit, you get a routing loop.
The VRF creates a separate virtual routing table on the PE router for each customer, ensuring complete traffic isolation.
The Route Distinguisher (RD) makes an overlapping IPv4 prefix unique across the provider network, but does not control VPN membership.
Route Targets (RTs) are BGP extended communities that determine which VRFs import and export routes, defining the VPN topology.
MPLS labels provide fast forwarding through the core without requiring core routers to see the customer IP addresses.
The three common PE-CE routing protocols are OSPF, BGP, and static routing — the provider does not mandate a single protocol.
The DN bit in OSPF over MPLS VPNs prevents routing loops by marking routes learned from the MP-BGP core so the CE does not re-inject them.
These come up on the exam all the time. Here's how to tell them apart.
MPLS Layer 3 VPN
PE router participates in customer Layer 3 routing (exchanges routes via OSPF/BGP/static)
Customer IP subnets must be unique within the VPN (with RD assisting uniqueness)
Scales to hundreds of sites with route reflectors because routing is centralised
MPLS Layer 2 VPN (VPWS/VPLS)
PE router transports Layer 2 frames; customer routers handle all Layer 3 routing
Customer IP subnets can be overlapping even within the same VPN
Scaling requires full-mesh pseudowires or split-horizon groups for VPLS
Route Distinguisher (RD)
8-byte value prepended to IPv4 prefix to create a VPNv4 prefix
Must be unique per VRF on a given PE (though can be shared across PEs)
Does not influence which VRFs import or export routes; its only job is uniqueness
Route Target (RT)
BGP extended community attached to VPNv4 routes during advertisement
Controls VRF import/export policy — defines the VPN topology
Same RT can be used across many VRFs to create full-mesh or hub-and-spoke designs
OSPF in a VRF (PE-CE)
Requires 'capability vrf-lite' or 'vrf' keyword under the OSPF process
Uses the DN bit in Type 3 LSAs to prevent routing loops from MP-BGP redistribution
Only runs between PE and CE; does not participate in the provider core OSPF
OSPF in the global routing table
Runs in the global routing table; no VRF context
No DN bit; relies on SPF algorithm for loop prevention
Can run across the entire provider network including core links
PE Router
Runs VRFs and participates in MP-BGP for VPNv4 routes
Performs label imposition (push) and disposition (pop) for MPLS
Connects directly to customer CE routers; has customer-facing interfaces
P Router
Does not run VRFs; only swaps MPLS labels
Performs label swap; never looks at IP headers or VPN information
Connects only to other P routers or PE routers; no customer-facing interfaces
Mistake
The Route Distinguisher (RD) controls which VPN customers can talk to each other.
Correct
The RD only makes an IPv4 prefix globally unique inside the MPLS network. Route Targets (RTs) control which VRFs import and export routes.
The names 'Distinguisher' and 'Target' sound similar, so beginners assume they do similar jobs. The exam uses this confusion for trick questions.
Mistake
MPLS Layer 3 VPNs encrypt traffic like IPsec does.
Correct
MPLS Layer 3 VPNs provide traffic separation and privacy through logical isolation (VRF and labels), but they do not encrypt the payload. The data is sent in clear text inside the MPLS core.
The word 'private' in 'VPN' leads learners to assume encryption. In reality, MPLS VPNs rely on the fact that a customer's traffic never enters another customer's VRF unless configured.
Mistake
A VRF is configured on every router in the service provider network, including core P routers.
Correct
VRFs are only configured on PE routers. Core P routers do not need VRFs because they only swap MPLS labels and never examine the IP header.
Beginners think VPN isolation requires every router to participate, but MPLS labels handle separation without the core knowing anything about the customer.
Mistake
You can use the same IPv4 subnet in two different VRFs on the same PE router only if you use different interfaces.
Correct
You can use the same IPv4 subnet in multiple VRFs on the same PE router regardless of the interface, because each VRF has its own routing table. The RD ensures the routes are unique in MP-BGP.
People assume overlapping IP subnets cause a conflict, but the VRF separation prevents any ambiguity at the PE. The exam tests this with trick scenarios showing overlapping subnets in show command output.
Mistake
MPLS Layer 3 VPNs require the customer to run BGP with the provider.
Correct
The PE-CE routing protocol can be OSPF, static, RIP, or BGP. The provider only requires that the PE learns routes from the CE and redistributes them into MP-BGP.
Since MP-BGP is used inside the provider core, beginners assume BGP must also be the PE-CE protocol. The exam tests this by describing a scenario where OSPF is used between PE and CE.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A VLAN separates traffic at Layer 2 (the data link layer) using switch port segregation. A VRF separates traffic at Layer 3 (the network layer) using separate routing tables. A VRF can span multiple VLANs, and a single VLAN can carry traffic for multiple VRFs using sub-interfaces.
The RD makes a customer's IP prefix globally unique so two customers using the same 10.0.0.0/8 do not collide. The RT controls which VRFs can import or export those prefixes — it builds the VPN topology. They serve completely different roles and both are mandatory.
No. P routers only need MPLS enabled on their interfaces. They swap MPLS labels based on the label forwarding table (LFIB) without ever examining the IP header or VRF information. VRF awareness exists only on PE routers.
If PE-A exports routes with RT 100:1 but PE-B imports only RT 200:2, PE-B will not install those routes in its VRF. Traffic from sites behind PE-B cannot reach sites behind PE-A, and vice versa. The VPN is effectively broken for those sites.
Yes. The CE router runs a single OSPF process that peers with both the PE and other routers inside the customer site. The PE injects the VPN routes into this OSPF process using sham links or by setting the DN bit to prevent loops.
No. In a Layer 3 VPN, the PE router participates in the customer's routing (Layer 3). In a Layer 2 VPN, the PE transports Ethernet frames (Layer 2) between customer sites, and the customer's own routers do the routing. The exam uses different configurations for each.
You've finished MPLS Layer 3 VPNs. Continue through the 350-501 study guide to build a complete picture of the exam.
Done with this chapter?