MPLS L3VPN is a technology that lets a service provider carry completely separate, private network traffic for many different customers over a single shared core infrastructure. For the 300-410 exam, you need to understand how this keeps each customer's data isolated and routable without them seeing each other's networks. It replaces older, less scalable methods like leased lines or Frame Relay.
Jump to a section
A simple way to picture MPLS L3VPN Basics
A large apartment building with a central mailroom.
Each apartment (a customer site) has its own numbered mailbox. The building manager, however, runs a premium service for tenants who want extra privacy for certain packages. Instead of using the regular mail slot, these tenants get a special locked box inside the mailroom that only they and the manager have keys to. The manager uses a colour-coded label on each special box that matches a tag on the package. He doesn't read the contents; he just looks at the colour tag on the package and places it into the box with the matching coloured label. Outside in the street, the postman only sees the building's main address — he never knows which apartment has a special box or what colour label it uses. The building manager splits his work: normal mail goes to the regular mail slot, but special packages get routed by colour tag alone. This means two different companies renting apartments in the same building can receive their own private, completely separate shipments without any risk of mixing them up. The colour tag is like a VPN label, the building manager is like a Provider Edge router, and the special box is a virtual routing table for one specific customer.
MPLS stands for Multiprotocol Label Switching. It is a method of forwarding packets through a network using short, fixed-length labels instead of the traditional destination IP address. Think of it like a postal sorting office that uses a routing number on a letter rather than reading the full address every time.
L3VPN stands for Layer 3 Virtual Private Network. This means the service provider (the company that owns the network cables and routers) participates in the routing of customer data at the network layer (Layer 3 of the OSI model). The provider learns the customer's IP routes and uses MPLS labels to forward traffic privately between the customer's different sites.
Before MPLS L3VPN, companies connected remote offices using leased lines (a dedicated physical cable) or Frame Relay (a virtual circuit). Both were expensive and hard to scale. If you had 100 offices, you might need 100 separate connections. MPLS L3VPN solves this by letting all sites share one provider network while keeping each company's traffic completely separate.
Here is how it works step by step:
A Customer Edge (CE) router sits at the customer's site. It connects to a Provider Edge (PE) router owned by the service provider. The PE router is the smart device that handles the VPN magic. Inside the provider's core, there are Provider (P) routers. These just forward labels as fast as possible, they do not care about the customer's routes.
To keep each customer's traffic separate, the PE router uses a Virtual Routing and Forwarding (VRF) instance. A VRF is like a private routing table per customer. If the provider has three customers, each gets their own VRF on the PE router. Routes from Customer A never go into Customer B's VRF.
When a customer packet arrives at the PE from the CE, the PE looks at the incoming interface and knows which VRF to use. It checks the route in that VRF. If the destination is another site for the same customer, the PE adds two MPLS labels to the packet:
The outer label (also called the transport label) tells the P routers where to send the packet across the provider core. This works just like a regular MPLS label.
The inner label (also called the VPN label) tells the far-end PE router which VRF should receive the packet.
The P routers only look at the outer label. They swap it for a new label at each hop and forward the packet. When the packet reaches the egress PE router, it strips off the outer label, reads the inner label, and knows exactly which VRF and which customer site to deliver the packet to.
Why is this important? It means the core of the provider network does not need to hold any customer routes. The P routers only need to know how to get to the PE routers. This scales incredibly well. A provider can carry thousands of customer VPNs without crashing its core routers.
The PE routers learn customer routes from the CE routers using either static routing or a dynamic routing protocol like OSPF or BGP. The PE routers then advertise these routes to other PE routers using Multiprotocol BGP (MP-BGP) with a special attribute called the Route Distinguisher (RD). The RD makes the customer's routes globally unique even if two customers use the same private IP addresses (like 192.168.1.0/24). The Route Target (RT) is a different attribute that controls which VRFs receive which routes. It works like a membership list: if a VRF has RT 100:1, it will receive all routes tagged with RT 100:1.
In summary, MPLS L3VPN creates a scalable, private, any-to-any network for each customer over a shared infrastructure. It uses VRFs for separation, labels for forwarding, and MP-BGP for route exchange.
Create the VRF on the PE Router
Use the command 'ip vrf CUSTOMER-NAME'. This creates a logical container for a separate routing table. All routes and interfaces assigned to this VRF will be isolated from the global routing table and other VRFs.
Assign Route Distinguisher and Route Target
Inside the VRF configuration, set 'rd 65000:1' (example) to make the customer's routes globally unique. Then set 'route-target both 65000:1' to control which VRFs can send and receive these routes. The 'both' keyword means export and import use the same value.
Assign the PE-CE Interface to the VRF
On the interface connecting to the CE router (e.g., GigabitEthernet0/0/0.100), use 'ip vrf forwarding CUSTOMER-NAME'. This moves the interface into the VRF, and the IP address must be re-assigned because the previous global address is removed.
Configure PE-CE Routing
Set up a routing protocol (e.g., BGP or OSPF) between the PE and CE. In BGP, use 'address-family ipv4 vrf CUSTOMER-NAME' and redistribute connected routes or use network statements. The CE sends its routes, and the PE learns them inside the VRF.
Enable MP-BGP Between PE Routers
Configure BGP on the PE with the provider's AS number. Use 'address-family vpnv4' to enable the exchange of VPN routes with other PEs. Activate the neighbor relationship using 'neighbor X.X.X.X activate'. This ensures the customer's VPN routes are shared across the provider core.
An IT professional working for a managed service provider (MSP) is responsible for setting up a new MPLS L3VPN for a retail chain with 50 stores, a central warehouse, and a head office. The customer wants all sites to be able to communicate with each other, but they want to keep their network completely private from other customers on the same provider network.
The IT pro's day-to-day tasks involve:
Configuring the VRF on each Provider Edge (PE) router that connects to a customer site. They must give the VRF a name (like 'CUSTOMER-RETAIL') and assign a Route Distinguisher and Route Target — often the same value, for example 65000:100.
Assigning the customer-facing interface on the PE router to the VRF. If they forget this step, the CE router will not be able to talk to the correct VRF.
Configuring a routing protocol (like BGP or OSPF) between the CE router and the PE router within the VRF. They might set up BGP and advertise the customer's local subnets.
Verifying that the PE router can see the customer's routes using commands like 'show ip route vrf CUSTOMER-RETAIL' or 'show bgp vpnv4 unicast all'.
Troubleshooting when a site goes down. If one store cannot reach the warehouse, the IT pro checks whether the CE router is up, whether the PE-CE routing is working, and whether the MPLS labels are being exchanged correctly between PE routers.
Working with the customer to design the IP addressing scheme. Since the customer might use overlapping IP ranges (e.g., 192.168.1.0/24 at two different stores), the Route Distinguisher ensures these routes are unique within the provider network.
In a modern datacentre, the IT pro might also use automation tools like Ansible or Python scripts to deploy the same VRF configuration to dozens of PE routers at once. They constantly monitor the number of VPN routes in the network to ensure it does not exceed the router's capacity. They also coordinate with network security teams to apply Access Control Lists (ACLs) within the VRF, restricting which customer devices can talk to each other.
A critical part of the job is understanding how MPLS labels are assigned. If a P router in the core fails, the IT pro must check whether the LDP (Label Distribution Protocol) sessions have re-converged and whether the backup path is using the correct outer labels. They also need to know the difference between a Layer 3 VPN and a Layer 2 VPN (like VPLS) to advise the customer on the best solution.
In the 300-410 ENARSI exam, 'MPLS L3VPN Basics' is heavily tested. You will see between 5 and 10 questions directly on this topic. The exam expects you to know the configuration steps, verification commands, and the underlying theory.
Common question types:
'Drag and drop': You might be asked to order the steps of MPLS L3VPN configuration: create the VRF, assign RD and RT, assign the interface to the VRF, configure BGP between CE and PE, enable MP-BGP between PE routers.
'Multiple choice single answer': You could be given a show command output and asked what a particular field means — for example, 'show ip vrf detail' displays the RD and RT, and they might ask which one is misconfigured.
'Simulation': The exam may present a topology with two CE routers and two PE routers. You must identify why a ping from one CE to the other fails. Traps include: missing VRF interface assignment, incorrect RT export/import values, or missing address-family under BGP.
Traps the exam loves to set:
They will give you a scenario where the RD is different between two PE routers for the same customer. This is fine — RD only needs to be unique per VRF on a single PE. The RT must match for routes to be imported correctly. Many candidates confuse RD and RT. Memorise: RD makes routes unique. RT controls route propagation.
They will test whether you know that the Route Target (RT) is what controls which VRF receives a route, not the Route Distinguisher (RD). A common trap question: 'Two sites cannot ping each other even though the VRF has the same RD configured on both PEs.' The correct answer is likely that the RT import/export values do not match.
They will ask about the difference between IPv4 VRF and VPNv4 address families. Remember: 'address-family ipv4 vrf' is used for PE-CE routing, and 'address-family vpnv4' is used for PE-PE MP-BGP exchange.
Key definitions to memorise:
VRF: Virtual Routing and Forwarding — a separate routing table per customer.
RD: Route Distinguisher — 8 bytes that make a customer's prefixes globally unique.
RT: Route Target — a BGP community attached to routes that controls import/export between VRFs.
CE: Customer Edge — the router at the customer premises.
PE: Provider Edge — the provider router that connects to the customer and does VPN processing.
P: Provider router — core router that only does label switching.
MP-BGP: Multiprotocol BGP — the protocol used to exchange VPNv4 routes between PE routers.
You will also need to know the commands: 'ip vrf NAME', 'rd 65000:1', 'route-target both 65000:1', 'interface GigabitEthernet0/0/0.100', 'ip vrf forwarding NAME', 'router bgp 65000', 'address-family ipv4 vrf NAME'.
Finally, the exam may include a scenario where you have to interpret 'show mpls l2transport vc' or 'show mpls forwarding-table' to find label mappings for a VPN. Practise reading those outputs.
MPLS L3VPN uses VRFs to create completely separate routing tables for each customer on a shared provider infrastructure.
The Route Distinguisher (RD) makes customer IP prefixes globally unique but does not control traffic separation.
The Route Target (RT) controls which VRFs import and export routes; mismatched RTs are the most common cause of routing failures.
PE routers run MP-BGP to exchange VPNv4 routes between each other, while P routers only forward based on outer MPLS labels.
The CE router does not run MPLS; it sends standard IP packets and is completely unaware of the VPN infrastructure.
Verification commands like 'show ip vrf detail' and 'show bgp vpnv4 unicast all' are essential for troubleshooting connectivity.
Encryption is not built into MPLS L3VPN; additional technologies like IPsec are required for data confidentiality.
These come up on the exam all the time. Here's how to tell them apart.
MPLS L3VPN
Uses MPLS labels inside the provider core for forwarding.
Traffic is separated by VRFs but not encrypted by default.
Requires service provider infrastructure and coordination.
IPsec VPN
Uses encryption and tunnelling over the public internet.
Provides strong encryption (AES) and authentication.
Can be deployed over any internet connection, no provider needed.
Route Distinguisher (RD)
Makes a customer's IP prefix globally unique in the provider network.
An 8-byte value, typically formatted as ASN:nn.
Attached to a route at the originating PE and never changed.
Route Target (RT)
Controls which VRFs import or export a route.
Acts like a community tag that determines route propagation.
Must match between PEs for routes to be shared correctly.
Provider Edge (PE) Router
Holds VRFs and customer routing tables.
Runs MP-BGP to exchange VPNv4 routes with other PEs.
Adds and removes MPLS labels for customer traffic.
Provider (P) Router
Only forwards labelled packets in the core.
Swaps outer labels based on the label forwarding table.
Does not hold any customer routes or VPN state.
MPLS L3VPN
Operates at Layer 3, routing IP packets between customer sites.
Provides any-to-any connectivity between all sites.
The provider participates in routing decisions.
MPLS L2VPN (VPWS)
Operates at Layer 2, providing a point-to-point link between two sites.
Acts like a virtual leased line bridging Ethernet frames.
The provider does not see the customer's Layer 3 data.
Mistake
MPLS L3VPN requires the customer and provider to use the same routing protocol (e.g., both must run OSPF).
Correct
The PE and CE can use any supported routing protocol (static, EIGRP, OSPF, BGP, or connected routes) independently of what the provider uses internally.
Beginners think the whole path must speak one language, but the provider's core uses MPLS labels, not the CE's routing protocol.
Mistake
The Route Distinguisher (RD) is what keeps different customers' traffic separate.
Correct
The RD only makes routes globally unique to avoid overlapping prefix problems. Traffic separation is achieved by the VRF and the Route Target (RT) mechanism.
The acronyms RD and RT look alike, and exam objectives often group them together, leading to confusion about their actual roles.
Mistake
A VRF is a physical interface or a separate device.
Correct
A VRF is a logical construct — a separate routing table and forwarding table within a single router. Multiple VRFs can exist on one physical interface as long as sub-interfaces or VLANs are used.
The idea of a 'virtual' router inside a physical one is abstract; beginners assume it must be a separate hardware device.
Mistake
MPLS L3VPN automatically encrypts customer traffic.
Correct
MPLS L3VPN does not provide encryption by default. It provides traffic separation, but the data can still be read if intercepted. Encryption (like IPsec) must be added separately if needed.
The word 'private' in 'Virtual Private Network' leads people to think it is encrypted, confusing it with SSL or IPsec VPNs.
Mistake
The inner label in an MPLS L3VPN packet identifies the destination customer site directly.
Correct
The inner label identifies the egress PE router's VRF, not the specific customer site. The egress PE then uses that VRF to forward to the correct CE.
Beginners oversimplify the label stack, thinking one label equals one destination, but the interworking between labels and VRFs is more nuanced.
Mistake
You need to configure MPLS on the CE router for MPLS L3VPN to work.
Correct
The CE router does not need to run MPLS at all. It just sends regular IP packets to the PE. The PE encapsulates them with MPLS labels. The CE is MPLS-unaware.
Since the technology is called 'MPLS L3VPN', beginners assume both ends must speak MPLS, not realising the customer edge is kept simple.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A VLAN operates at Layer 2 to separate broadcast domains on a switch. A VRF operates at Layer 3 to separate routing tables on a router. VLANs segment the network by physical or logical ports; VRFs segment routing decisions by customer.
No. The CE router sends standard IP packets. It does not need to know anything about MPLS labels. The PE router adds and removes the labels.
It shows the VRF name, the assigned Route Distinguisher, the Route Target import and export values, and the interfaces assigned to that VRF. It is the first command to check when troubleshooting VPN connectivity.
Check that the CE can ping its directly connected PE interface. Then verify the VRF configuration on each PE, ensuring the RT import/export values match. Finally, check MP-BGP sessions between PEs using 'show bgp vpnv4 unicast all summary'.
The P router (Provider core router) only swaps MPLS labels based on the outer label. It does not maintain any customer routes. Its job is to forward labelled packets quickly across the core toward the egress PE.
Yes. Because each VRF has its own routing table, two different customers can use the same IP subnet (e.g., 192.168.1.0/24) without conflict. The RD makes the routes unique in the control plane.
You've finished MPLS L3VPN Basics. Continue through the 300-410 study guide to build a complete picture of the exam.
Done with this chapter?