# MPLS

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/mpls

## Quick definition

MPLS is a way for data to travel across a network using short labels rather than looking up long IP addresses. Think of it like giving a package a barcode that tells every sorting center exactly where to send it next, without having to read the full address each time. It makes network traffic faster, more reliable, and easier for service providers to manage. MPLS is commonly used in corporate wide area networks (WANs) and by internet service providers to connect remote offices.

## Simple meaning

Imagine you are mailing a package across the country. In the old postal system, each sorting office has to read the full address to figure out where to send it next, which takes time and effort. MPLS works like a system where your package gets a barcode when it first enters the network. Every sorting machine along the route just scans the barcode and knows instantly which truck or train to put it on, without ever reading the address again. This barcode is called a label.

Each label tells the next network device what to do with the data packet. The label is added at the edge of the network and removed when the packet reaches its destination. This makes the journey faster and more predictable because the network does not have to make a new decision at every stop. The path the packet takes is set up ahead of time, much like a train following a predefined track.

MPLS does not care about the type of data inside the packet. It can carry internet traffic, voice calls, video streams, or private corporate data all at once. That is why it is called multiprotocol. It works with many different kinds of network protocols. This flexibility makes it very popular for businesses that need to connect multiple offices securely and reliably without running their own fiber cables.

## Technical definition

MPLS operates at a layer between traditional Layer 2 (data link) and Layer 3 (network) of the OSI model, often referred to as Layer 2.5. It was originally designed to improve the speed and scalability of IP routing by replacing lengthy IP header lookups with fixed-length label lookups. Each MPLS packet carries a stack of labels, with the outermost label being used for forwarding decisions at each hop. The label stack is encapsulated between the Layer 2 header and the Layer 3 payload.

An MPLS network consists of two main types of routers: Label Edge Routers (LERs) and Label Switch Routers (LSRs). LERs sit at the edge of the network and are responsible for pushing a label onto an incoming packet and popping the label when the packet leaves the network. LSRs are internal routers that switch packets based solely on the label value, performing a label swap operation where they replace the incoming label with a new outgoing label. This process is called Label Switching.

The path that a packet takes through an MPLS network is called a Label Switched Path (LSP). LSPs can be established using two main signaling protocols: Label Distribution Protocol (LDP) or Resource Reservation Protocol with Traffic Engineering (RSVP-TE). LDP is simpler and automatically distributes labels to all routers for all known destination networks. RSVP-TE is more advanced and allows network engineers to reserve bandwidth and define explicit paths for traffic engineering purposes.

MPLS supports multiple services. The most common are MPLS Layer 3 VPNs, where each customer has a separate Virtual Routing and Forwarding (VRF) table on the provider edge routers, ensuring customer traffic is isolated. MPLS Layer 2 VPNs, such as Virtual Private LAN Service (VPLS) and Ethernet over MPLS (EoMPLS), extend Ethernet LANs across the MPLS backbone. MPLS Traffic Engineering (MPLS-TE) allows network operators to optimize bandwidth usage by sending traffic along paths that are not necessarily the shortest IP route.

MPLS relies on protocols like OSPF or IS-IS for interior routing to establish reachability within the provider network. BGP is often used to distribute customer routes between provider edge routers. The use of labels instead of IP lookups reduces per-hop processing overhead and enables advanced features like fast reroute, where a backup LSP is pre-calculated to recover traffic within milliseconds of a link failure. In modern IT implementations, MPLS remains a backbone technology for large enterprises and service providers, though it is increasingly complemented or replaced by SD-WAN in some scenarios due to cost and flexibility considerations.

## Real-life example

Think of a major highway system with multiple exits and toll booths. Without MPLS, every car (data packet) would have to stop at every toll booth, and the toll operator would read the full destination address from a card and manually decide which lane the car should take. This takes time and creates delays, especially when traffic is heavy.

MPLS is like an express toll system where each car gets a small electronic tag at the entrance. When the car approaches any toll booth, a sensor reads the tag and instantly opens the correct lane, routing the car onto the fastest path toward its destination. The driver does not have to slow down, and the toll booth does not need to look up the full address. The tag also tells the system when to exit the highway.

Now, imagine there are different types of cars. Some carry urgent medical supplies, others carry regular packages, and some are just tourists. MPLS can give different priority levels by putting different tags on different cars. The urgent medical supply car gets a tag that directs it to a faster, reserved lane, while the tourist car follows a slower, cheaper route. This is called traffic engineering.

In the real world, a company with offices in New York, London, and Tokyo uses MPLS to connect them all. When an employee in New York sends an email to London, the email data is tagged at the New York edge router. The tag tells every router in the network to send the data over the most efficient path. If the direct cable between New York and London is busy, the tag can route through a different path, like via Amsterdam, without any change in how the data travels. The employee never notices, but the network stays fast and reliable.

## Why it matters

MPLS matters because it solves real problems that businesses face when connecting multiple locations over long distances. Without MPLS, companies would have to rely on the public internet for all their traffic, which is unpredictable, less secure, and hard to prioritize. Voice calls might break up, video conferences might freeze, and critical financial transactions could get delayed.

For IT professionals, understanding MPLS is essential because it is the backbone of most enterprise WANs. When a company has offices in different cities, they usually buy MPLS links from a service provider. The IT team must know how to configure the customer edge (CE) router to send traffic correctly to the provider edge (PE) router. They also need to understand routing protocols like BGP and OSPF because MPLS relies on them to work properly.

MPLS also supports Quality of Service (QoS). This means a network administrator can mark certain types of traffic, like VoIP calls, as high priority. The MPLS network will then handle that traffic with less delay and jitter. This is critical for businesses that depend on real-time communication tools like Zoom or Microsoft Teams. Without MPLS, network congestion could ruin those calls.

Finally, MPLS enables secure VPNs. Even though the data travels over a shared provider network, MPLS VPNs keep each customer's traffic completely separate. This gives the security of a private network with the cost savings of a shared infrastructure. As more companies move to cloud services, MPLS also helps with hybrid cloud connectivity by providing a stable, high-performance link to data centers and cloud providers. Knowing MPLS is still a valuable skill, even as newer technologies like SD-WAN become popular, because many organizations operate hybrid networks that combine both.

## Why it matters in exams

MPLS appears in multiple IT certification exams, most notably in Cisco's CCNA, CCNP Enterprise, and CCIE (both Enterprise and Service Provider tracks), as well as Juniper's JNCIA-Junos and JNCIP-SP. In the CCNA exam, MPLS is a relatively lightweight topic. Candidates are expected to understand the basic concept of label switching, the difference between LER and LSR, and the purpose of labels. They may see a question asking which MPLS routers are responsible for pushing and popping labels, or why MPLS is considered faster than traditional IP routing.

In the CCNP Enterprise ENCOR exam, MPLS coverage is deeper. Candidates must understand MPLS Layer 3 VPN architecture, including the roles of VRF, RD, RT, and MP-BGP. They need to know how route targets control the import and export of routes between VRFs. Questions often present a scenario with multiple customer sites and ask which configuration allows traffic to flow only between certain sites. Candidates should be prepared to troubleshoot label distribution failures and understand the difference between LDP and RSVP-TE signaling.

In the CCIE Enterprise Infrastructure lab exam, MPLS is a core technology. Candidates must configure MPLS on a live topology, implement MPLS Layer 3 VPNs with complex route distinguisher and route target designs, and troubleshoot issues like missing labels or incomplete VRF routing tables. The exam also tests MPLS Traffic Engineering features like explicit paths and bandwidth reservation. Questions might require the candidate to verify LSP operation using commands like show mpls ldp neighbor or traceroute mpls.

For service provider focused exams like CCNP Service Provider (SPCOR) and CCIE Service Provider, MPLS is even more fundamental. Topics include Segment Routing, which is the modern evolution of MPLS, as well as MPLS TE in detail, MPLS Layer 2 VPNs, and VPLS. In these exams, candidates must know how MPLS interacts with underlying IGP protocols and BGP and how to optimize label distribution for scalability. The exam may ask about MPLS label stack operations in depth, including the TTL handling and label imposition, disposition, and swapping.

General IT certifications like CompTIA Network+ touch on MPLS at a high level. They expect you to know that MPLS is a WAN technology that uses labels, offers QoS guarantees, and provides a secure private connection. The questions are straightforward, often multiple choice that asks which WAN technology is connection-oriented and label-based. Even in cloud certification exams like AWS Advanced Networking, some MPLS knowledge is useful because Direct Connect services can be integrated with MPLS-based on-premises networks. So whether you are aiming for a network engineer role or a broader IT certification, MPLS is a topic that will likely appear in your study materials.

## How it appears in exam questions

On certification exams, MPLS questions come in several common patterns. The first is the definition or concept question. For example, the exam might ask: Which layer of the OSI model does MPLS operate at? Or: What is the main advantage of MPLS over traditional IP routing? These questions test your understanding of the fundamental description and benefits. The correct answer is usually that MPLS is Layer 2.5 and that it uses labels for faster forwarding with traffic engineering capabilities.

The second pattern is the role identification question. The exam gives you a network diagram with routers labeled R1, R2, R3, and R4. It asks: Which router is functioning as a Label Edge Router (LER)? Or: On which router does label imposition occur? The right answer is the one at the edge of the MPLS network. A common trap is to confuse LER with LSR or to think that label popping only happens at the last LSR, while in reality, it can be performed at the penultimate hop (Penultimate Hop Popping).

The third pattern is the VPN scenario. A question might describe a company with three offices and a service provider MPLS network. It lists the VRF names, Route Distinguishers (RDs), and Route Targets (RTs). You must determine which sites can communicate. For example, if Site A has an export RT of 65000:100 and an import RT of 65000:200, and Site B exports 65000:200 and imports 65000:100, you need to recognize they can talk to each other. A separate site C that imports and exports only 65000:300 is isolated. These questions test your understanding of VRF route propagation.

The fourth pattern is the troubleshooting question. The exam shows the output of show mpls ldp bindings or show mpls forwarding-table. It might show that a specific network prefix has an LFIB entry with a label but no outgoing interface, or that the label is not being learned. You need to identify the root cause: perhaps LDP is not enabled on the interface, or the two routers have different LDP router IDs, or an ACL is blocking UDP port 646 which LDP uses. The correct fix is to enable mpls ip on the interface or ensure IP connectivity between LDP peers.

There are also traffic engineering questions, especially at the CCNP and CCIE level. You might be asked to interpret the output of show mpls traffic-eng tunnels or to configure a tunnel with an explicit path. The task may be to troubleshoot why traffic is not using the TE tunnel. The cause could be that the IGP metric is not set correctly, or the path is not valid because a hop in the explicit path is not reachable. Another common question asks about fast reroute: what is the difference between link protection and node protection? Link protection uses a backup tunnel that bypasses only the failed link, while node protection bypasses the entire neighboring router. Understanding these nuances is critical for high-scoring answers.

## Example scenario

A company called GlobalTech has three offices: headquarters in Chicago, a branch in Dallas, and another branch in Seattle. They need all three offices to communicate securely and reliably for voice calls, file sharing, and video conferencing. They decide to use an MPLS WAN from a service provider.

The Chicago office has a Customer Edge (CE) router connected to the provider's Edge (PE) router in Chicago. Similarly, Dallas and Seattle each have their own CE-PE connections. The provider's internal routers are Label Switch Routers (LSRs) that form the MPLS backbone.

When an employee in Chicago sends a large presentation file to the Dallas office, the Chicago CE router forwards the packet to the Chicago PE router. The PE router checks the destination IP address and determines that the packet must go to the Dallas site. It then looks up the VRF associated with GlobalTech's VPN. The PE router pushes an MPLS label onto the packet. This label tells the network that the packet is part of GlobalTech's VPN and gives the next-hop router in the provider core.

The packet now travels through the MPLS core. At each LSR, the router swaps the label with a new label based on its label forwarding table (LFIB). This is much faster than performing a routing table lookup for each packet. The path might go Chicago -> Kansas City -> Dallas. If the direct link to Dallas is congested, the MPLS network can automatically send the packet through an alternative path, such as Chicago -> Denver -> Dallas, using traffic engineering.

When the packet reaches the Dallas PE router, it pops the label and forwards the original IP packet to the Dallas CE router, which then delivers it to the employee's computer. The entire process happens in milliseconds, and the employee never knows which exact route the data took. If someone in Seattle wants to communicate with Chicago, the process is similar. Each site can communicate with any other site, and because MPLS uses VRFs, traffic from GlobalTech is completely isolated from other customers of the same provider.

Now imagine that the voice call traffic between Chicago and Dallas is flagged with a high priority QoS value. The MPLS network recognizes the label and forwards it with low latency. Meanwhile, large file transfers receive lower priority to avoid compromising call quality. This illustrates how MPLS supports Quality of Service (QoS) in addition to connectivity.

## Common mistakes

- **Mistake:** Thinking MPLS is a completely separate Layer 3 routing protocol like OSPF or BGP.
  - Why it is wrong: MPLS does not exchange routing information. It uses labels to forward packets based on routing tables built by traditional routing protocols like OSPF or BGP. MPLS is a forwarding mechanism, not a routing protocol.
  - Fix: Remember: routing protocols build the map; MPLS follows the signs (labels) along that map.
- **Mistake:** Believing that all MPLS routers perform label push, swap, and pop on the exact same interface.
  - Why it is wrong: Only Label Edge Routers (LERs) push and pop labels. Label Switch Routers (LSRs) inside the network perform label swap. The interface operations differ based on the router's position in the network.
  - Fix: Identify the edge vs. core routers in any topology. Edge routers add/remove labels; core routers swap them.
- **Mistake:** Confusing Route Distinguisher (RD) with Route Target (RT) and thinking they perform the same function.
  - Why it is wrong: RD makes VPN routes globally unique across the provider network. RT controls the import and export of routes between VPNs. They serve different purposes and are both needed.
  - Fix: Think of RD as a unique ID number on a sticker, and RT as a routing policy that decides which stickers to accept and share.
- **Mistake:** Assuming MPLS automatically provides encryption and security for VPN traffic.
  - Why it is wrong: MPLS VPNs provide isolation, but they do not encrypt data by default. Traffic travels over the provider backbone in clear text. If encryption is needed, IPsec or other encryption must be added on top.
  - Fix: Understand that MPLS VPNs are private by separation, not by encryption. For secure data, always consider additional encryption like IPsec.
- **Mistake:** Thinking that MPLS requires a full mesh of direct physical connections between all routers.
  - Why it is wrong: MPLS works over any network topology, including partial mesh, hub-and-spoke, or hierarchical designs. Labels allow packets to traverse multiple hops without direct links.
  - Fix: MPLS uses label switching to route through intermediate routers. The network only needs a path; it does not need direct physical connections between all endpoints.

## Exam trap

{"trap":"In a question describing MPLS VPN, the options include 'CE routers must be configured with MPLS labels' as a correct statement.","why_learners_choose_it":"Learners define MPLS as a label-based technology and think all routers in the MPLS network must handle labels. The CE router does not participate in MPLS label switching.","how_to_avoid_it":"CE routers are outside the MPLS domain. They send standard IP packets to the PE router. The PE router is the one that adds the label. Never choose that CE routers use MPLS labels."}

## Commonly confused with

- **MPLS vs SD-WAN:** SD-WAN uses software to control wide area networks dynamically over the internet, while MPLS relies on a dedicated provider network and fixed label switching. SD-WAN is more flexible and cheaper, but MPLS offers more predictable performance and carrier-grade SLAs. (Example: A small startup might use SD-WAN to connect to cloud apps using broadband internet, while a bank uses MPLS for low-latency, reliable connections between branches.)
- **MPLS vs Frame Relay:** Frame Relay is an older Layer 2 technology that also used labels (DLCIs) but was connection-oriented and lacked traffic engineering capabilities. MPLS is more advanced as it works with IP routing and supports multiple protocols and VPNs. (Example: Frame Relay was like slow train tracks from the 1990s, while MPLS is a modern high-speed railway that can handle many types of trains (IP, IPv6, Ethernet).)
- **MPLS vs VPN (IPsec):** IPsec VPNs encrypt all data and can run over the public internet, while MPLS VPNs do not encrypt data but isolate traffic using VRFs. IPsec is typically used for remote access, whereas MPLS is used for site-to-site private connections. (Example: A traveling employee uses IPsec VPN to connect to the office, while the office network uses MPLS to connect all branches together securely.)
- **MPLS vs VLAN:** VLAN operates at Layer 2 to segment traffic within a local switch, using VLAN tags. MPLS uses labels at Layer 2.5 to route across different networks and geographic locations. VLAN cannot extend across a WAN without MPLS or other tunneling. (Example: VLAN separates departments in the same building, while MPLS connects those department networks across different cities.)

## Step-by-step breakdown

1. **Step 1: IP Routing Table is Established** — Before MPLS can work, the provider network must know how to reach every IP prefix. Routers run an IGP like OSPF or IS-IS to exchange loopback addresses and internal routes. BGP may be used for customer routes. This underlying routing table is the foundation for label distribution.
2. **Step 2: Label Distribution Protocol (LDP) Establishes Label Bindings** — LDP runs between LSRs. Each LSR assigns a local label to every IP prefix in its routing table and sends this binding to its LDP neighbors. This way, each router knows which label to use when forwarding packets to a particular prefix. LDP uses UDP and TCP port 646.
3. **Step 3: Label Switched Path (LSP) is Built** — Using the labels learned from LDP, each router populates its Label Forwarding Information Base (LFIB). The LFIB maps incoming labels to outgoing labels and interfaces. The path from the ingress LER to the egress LER is now established as an LSP.
4. **Step 4: Packet Arrives at Ingress LER** — A data packet arrives at the ingress PE router from the customer's CE router. The PE router performs a routing lookup in the VRF table, finds the destination IP, and determines it should use a specific label. It pushes (imposes) the label onto the packet and forwards it into the MPLS core.
5. **Step 5: Packet is Label Switched Across the Core** — Each intermediate LSR receives the labeled packet. It uses the incoming label to perform an LFIB lookup. The router swaps the label with a new outgoing label (label swap) and forwards the packet out the appropriate interface. This continues hop by hop until the packet reaches the egress LER.
6. **Step 6: Egress LER Pops the Label** — The egress PE router receives the labeled packet. In many implementations, the penultimate LSR (the router before the egress PE) removes the label using Penultimate Hop Popping (PHP). Then the egress LER receives a plain IP packet, performs a routing lookup in the VRF, and forwards it to the destination CE router.

## Practical mini-lesson

In a real-world IT environment, configuring and troubleshooting MPLS requires solid understanding of both routing and labeling. Let us start with configuration. On a Cisco router, you first enable Cisco Express Forwarding (CEF) globally, as MPLS relies on CEF. Then, you enable MPLS on the interfaces facing the core using the command mpls ip. You also need a routing protocol (OSPF or IS-IS) configured to exchange loopback addresses between all routers. LDP is enabled by default once mpls ip is configured on the interface.

Once configured, you verify the operation with the show mpls ldp neighbor command. This should list all adjacent LSRs and show that LDP sessions are established. Next, look at the label bindings using show mpls ldp bindings. You should see labels assigned to every route in the IGP. If a router is missing bindings for certain prefixes, check if the underlying IP routing table knows about those prefixes. If routes are missing, fix the IGP or BGP configuration first.

For MPLS VPN configuration, the complexity increases. You must create VRF instances on the PE routers, assign an RD and RT, and attach the VRF to the customer-facing interface. Then, you need MP-BGP to exchange VPNv4 routes between PE routers. This involves configuring the address-family vpnv4 on the BGP session and activating neighbor relationships using the correct update-source. A common mistake is forgetting to advertise the PE router loopback in the IGP, which breaks multiprotocol BGP sessions.

Troubleshooting often starts with checking the VRF routing table using show ip route vrf <vrf-name>. If the routes from remote sites are missing, verify BGP by using show bgp vpnv4 unicast all summary and show bgp vpnv4 unicast all. Confirm that route targets match between sites. Also, verify that the MPLS label forwarding table is populated using show mpls forwarding-table. If labels are missing for the VPN prefix, check if the PE router is receiving the VPNv4 routes from the remote PE.

A real issue that occurs is when the provider network uses MPLS but the customer connection is via a different interface without MPLS configured. Then packets might be sent without labels, and the core LSR will drop them because it expects a label header. Always ensure that the CE-PE link is configured correctly, and that the PE router is set to push labels only for traffic bound to other PE routers. For traffic engineering, the configuration becomes very advanced, involving explicit paths, tunnel interfaces, and RSVP-TE signaling. In production, network operators rely heavily on monitoring tools to detect label loss, LDP session failures, and traffic path deviations.

Professionals need to know that MPLS is not a set-and-forget technology. Changes in the IGP, such as new link metrics or router additions, can affect LSP path selection. Regular audits of LDP state and label bindings are essential. Also, MPLS has TTL handling; the TTL can be either copied from the IP packet or set independently to hide the provider core topology. Understanding these details separates a competent engineer from a beginner. Hands-on practice with lab tools like EVE-NG or GNS3 is invaluable to truly learn MPLS configuration and troubleshooting.

## Memory tip

Remember the 'MPLS Pizza' mnemonic: MPLS uses a label (like a pizza topping name) instead of reading the full recipe (IP address) at every step; the path is pre-planned, so delivery is fast and consistent.

## FAQ

**Is MPLS faster than the internet?**

MPLS can be faster and more consistent because it uses dedicated paths and traffic engineering to avoid congestion. The public internet routes unpredictably and can experience jitter, while MPLS provides Quality of Service (QoS) guarantees.

**Does MPLS require special hardware?**

Yes, MPLS requires routers that support MPLS forwarding in hardware, usually enterprise or service provider-grade routers. Standard home routers do not support MPLS. Many modern routers from Cisco, Juniper, and Huawei have the necessary capabilities.

**Can MPLS be used with IPv6?**

Yes, MPLS is multiprotocol, meaning it can carry IPv6 packets. Label distribution for IPv6 can be done using LDP or SR-MPLS. MPLS is often used to transport IPv6 over an IPv4 backbone or vice versa.

**What is the difference between MPLS and VPN?**

MPLS is a core technology for efficient packet switching, while VPN is a broader concept that creates private network connections over a shared infrastructure. MPLS can be used as the underlying transport to build VPNs (MPLS VPNs).

**Is MPLS secure?**

MPLS provides security through network isolation using VRFs, which means customer traffic is separated in the provider network. However, MPLS does not encrypt data by default. For encryption, additional protocols like IPsec are needed.

**Is MPLS being replaced by SD-WAN?**

Not entirely. SD-WAN is growing in popularity for its flexibility and lower cost using internet links, but many enterprises still rely on MPLS for mission-critical traffic that requires high reliability and strict SLAs. Many networks use a hybrid of both.

**What is Penultimate Hop Popping (PHP)?**

PHP is a feature where the second-to-last router in an MPLS LSP removes the label before sending the packet to the egress LER. This reduces the workload on the egress router because it does not have to pop the label itself, improving performance.

## Summary

MPLS is a powerful networking technology that sits between Layer 2 and Layer 3 of the OSI model. It uses short labels rather than full IP addresses to forward data packets quickly and efficiently across a Wide Area Network. The core idea is simple: at the edge of the network, a label is attached to each packet, and interior routers use that label to make forwarding decisions without needing to deeply inspect every packet. This approach speeds up data flow, makes the network more predictable, and enables advanced features like Traffic Engineering and Quality of Service.

For IT certification candidates, MPLS is especially relevant in Cisco, Juniper, and other vendor-specific exams. You need to understand the roles of LER and LSR routers, how LDP works, and how VPNs (Layer 3 and Layer 2) operate over an MPLS backbone. The most common exam questions present scenarios where you must identify which router does what, interpret show commands, or troubleshoot label distribution issues. Avoiding mistakes like confusing RD with RT, or thinking CE routers use MPLS labels, will help you score higher.

In the real world, knowing MPLS is valuable for network engineers and administrators who manage corporate WANs. Even as SD-WAN gains ground, MPLS remains a mainstay for organizations that demand high reliability and guaranteed performance. Understanding MPLS also builds a foundation for learning Segment Routing, which is the next evolution of label-based networking. Whether you are studying for your first network certification or aiming for a CCIE, mastering MPLS concepts and hands-on skills will serve you well in your IT career.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/mpls