MPLS

Course at a glance

• 48 lessons in 6 units.
• Exams: covers the MPLS and VRF topics of CCNP ENCOR 350-401, CCNP ENARSI 300-410, and CCIE Enterprise Infrastructure.
• Format: self-paced lessons with Cisco IOS configurations, packet captures, and video.
• Last updated: October 2026.

What is MPLS?

MPLS (Multiprotocol Label Switching) is a forwarding mechanism that switches packets based on labels. When a packet enters the MPLS network, the ingress PE (Provider Edge) router adds a label. P (Provider) routers in the core swap the label and forward the packet based on the label alone, without looking at the IP header. The label sits between the layer 2 and layer 3 header, which is why MPLS is often called a layer 2.5 protocol. Routers use LDP (Label Distribution Protocol) to tell each other which label to use for which prefix.

What makes MPLS important is that it works as a tunneling mechanism. The core routers only need to know how to reach the PE routers, so they don’t need BGP or customer routes; this is the BGP free core. Because a packet can carry more than one label, we can stack services on top of the transport label. A VPN label tells the egress PE which customer the packet belongs to, which is how MPLS VPN keeps customers with overlapping IP addresses separated.

Who uses MPLS? Service providers run it in their core to offer Layer 3 VPNs, Layer 2 services like Ethernet over MPLS, and IPv6 over an IPv4 core. Large enterprises use it to separate departments or tenants with VRFs, and they are often customers of an MPLS VPN service. With MPLS Traffic Engineering, operators steer traffic away from the IGP shortest path to use all of the bandwidth they have.

MPLS Learning Roadmap

This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.

MPLS Fundamentals and LDP

We start with the problem MPLS solves: why should every router in the provider network know about every customer route? You’ll learn what the MPLS header looks like, what the CE, PE, and P routers do, and how labels are pushed, swapped, and popped. LDP discovers neighbors with UDP multicast hello packets to 224.0.0.2, then exchanges labels over a TCP session. The label of the last hop is often removed one router early, which is called penultimate hop popping.

Lessons: Introduction to MPLS, MPLS labels and devices, MPLS LDP, LDP label filtering

VRFs and MPLS Layer 3 VPN

A VRF (Virtual Routing and Forwarding) gives a router multiple routing tables, a bit like VLANs for routers. VRFs without MPLS are called VRF lite. MPLS Layer 3 VPN uses VRFs only on the PE routers: the RD (route distinguisher) turns customer prefixes into unique VPNv4 routes, MP-BGP carries them between PE routers, and the RT (route target) decides which VRF imports them. When customer sites use the same AS number, BGP loop prevention gets in the way, and we fix it with allowas-in or AS override.

Lessons: VRF lite configuration, MPLS Layer 3 VPN explained, MPLS Layer 3 VPN configuration, BGP allowas-in, BGP AS override, MPLS over FlexVPN

PE-CE Routing Protocols

The customer can run almost any routing protocol with the provider. BGP is the most common, but you can also use OSPF, EIGRP, or RIP between the PE and CE routers and redistribute into MP-BGP. OSPF has some extra details: the MPLS backbone acts as a super backbone, routes from other sites can show up as inter-area routes, and a backdoor link between two CE routers requires a sham link. We also look at how to give customers Internet access with a default route.

Lessons: PE-CE OSPF, OSPF sham link, PE-CE EIGRP, PE-CE RIP, OSPF default route, OSPF global default route

Route Leaking and Extranet VPNs

By default, each customer VRF only talks to its own sites; this is an intranet VPN. Sometimes customers need to reach each other, or a shared service. With route leaking, we import routes from one VRF into another, which turns it into an extranet VPN. Import and export maps let you use a route-map to decide which routes are leaked and which route targets they get.

Lessons: VRF lite route leaking, Extranet route leaking, VRF export map, VRF import map

Layer 2 and IPv6 over MPLS

MPLS doesn’t only carry IPv4. With AToM (Any Transport over MPLS), the provider transports layer 2 frames like Ethernet, frame-relay, PPP, and HDLC, so two customer sites end up in the same layer 2 segment. With 6PE and 6VPE, dual stack PE routers exchange IPv6 prefixes with MP-BGP over an IPv4-only MPLS core. 6PE uses the global routing table; 6VPE uses VRFs.

Lessons: Any Transport over MPLS (AToM), IPv6 over MPLS with 6PE and 6VPE

MPLS Traffic Engineering Fundamentals

An IGP only uses the path with the lowest cost, so other links stay unused. MPLS TE uses constraint-based routing instead. OSPF and IS-IS flood extra link information like available bandwidth and attribute flags into the TE database, the headend router calculates a path with CSPF, and RSVP-TE signals a unidirectional tunnel along that path. You can control the path with explicit paths, the TE metric, affinity attributes, and setup and hold priorities.

Lessons: MPLS TE explained, MPLS TE with OSPF, MPLS TE with IS-IS, RSVP-TE, Explicit path options, Affinity attribute, Setup and hold priority, Tunnel reoptimization

Routing Traffic into MPLS TE Tunnels

Once a TE tunnel is up, it does nothing until you route traffic into it. You can use static routes or PBR, or the TE-specific options: autoroute announce adds the tunnel to the SPF tree of the headend router, and forwarding adjacency advertises the tunnel as a link in the IGP. With multiple tunnels to the same destination, unequal cost load balancing works out of the box, and CBTS selects a tunnel based on the EXP value. You can also run MPLS VPN traffic over TE tunnels.

Lessons: Static routes, Autoroute announce, Autoroute destination, Forwarding adjacency, Unequal cost load balancing, Class-based tunnel selection, MPLS VPN over TE tunnels

MPLS TE Fast Reroute and DS-TE

When an LSP fails, the headend router has to calculate and signal a new path, which takes time. MPLS TE Fast Reroute uses pre-built backup tunnels to protect a link or a node, with recovery in about 50 ms. Regular MPLS TE doesn’t know anything about QoS. DiffServ-Aware TE (DS-TE) makes bandwidth reservations QoS aware, first with Cisco’s traditional mode and later with the IETF mode, which supports multiple class types.

Lessons: Fast reroute (FRR), Link protection, Node protection, RSVP hello support, DS-TE traditional, DS-TE IETF mode

Ready to master MPLS?

Get access to all 48 MPLS lessons and every other course on NetworkLessons.com.

Sign up