← Interview Prep

MPLS L3VPN — Theory

MPLS/BGP L3VPN (RFC 4364): CE/PE/P roles, VRFs, RD vs RT, the MP-BGP VPNv4/VPNv6 control plane, the two-label (transport + VPN) data plane, hub-and-spoke/extranet via RT policy, VRF-lite, 6VPE, and inter-AS.

MPLS L3VPN (RFC 4364, "2547bis") is how a provider gives many customers their own private, overlapping IP networks over one shared backbone — while the core routers stay blissfully unaware of any customer routes. It's the canonical use of MP-BGP + MPLS, and the interview favorite because it ties RD, RT, VRFs, and a two-label stack into one story.

The idea: each customer gets a VRF on the edge routers; MP-BGP carries their routes (made globally unique by an RD, filtered into VRFs by RT) between edge routers; a two-label stack forwards the packet across a core that only ever reads the outer label.

Roles

VRF, RD, RT

• VRF — a private routing + forwarding table per customer on the PE. Customer A's 10.0.0.0/24 and customer B's 10.0.0.0/24 live in separate VRFs and never collide.
• RD (Route Distinguisher, 8 bytes) — prepended to a prefix to make it globally unique for transport in BGP: RD:10.0.0.0/24 becomes a VPNv4 route. RD is just for uniqueness, not policy — one RD per VRF is typical.
• RT (Route Target) — an extended community that controls topology: a PE exports a VRF's routes tagged with RT(s) and imports routes matching RT(s). Symmetric import/export = any-to-any; asymmetric = hub-and-spoke, extranet, or shared services.

Control plane

1. CE advertises its prefixes to the PE (CE–PE eBGP/OSPF/static).
2. The ingress PE puts them in the customer VRF, attaches the RD, one or more export RTs, and allocates a VPN label.
3. It advertises the VPNv4 route via MP-BGP (address family VPNv4/VPNv6) to remote PEs — usually through route reflectors, with next-hop-self.
4. The egress PE imports the route into any VRF whose import RT matches, strips the RD, and re-advertises to that CE.

Data plane — the two-label stack

  CE --- PE1 =============== P === P =============== PE2 --- CE
                 [ transport | VPN | IP packet ]
  outer = transport label (LDP/RSVP/SR) -> reaches egress PE2, swapped hop by hop
  inner = VPN/service label  -> tells PE2 which VRF/CE to hand the packet to

• The ingress PE pushes two labels: outer transport (from LDP/RSVP/SR toward the egress PE) + inner VPN label.
• P routers swap only the outer label — they never see the VPN label or the customer IP.
• PHP: the penultimate P pops the transport label so the egress PE receives the packet with just the VPN label, looks it up, and forwards into the right VRF/CE.

Background: MPLS, MP-BGP.

Topologies & variations

• Hub-and-spoke / extranet — engineered purely with RT import/export policy (spokes export a spoke-RT and import a hub-RT; the hub does the reverse).
• Internet access & shared services — route leaking between the VPN VRF and a global/services VRF via RTs.
• VRF-lite — VRFs without MPLS/MP-BGP (802.1Q sub-interfaces end to end): isolation for a few VRFs, but no scale — every hop needs the VRF.
• 6VPE — the same design for IPv6 (VPNv6).
• Inter-AS & CsC — carrying a VPN across provider boundaries — see Inter-AS Options A/B/C.