MPLS
Course Description
MPLS (Multiprotocol Label Switching) forwards packets based on labels instead of doing a routing table lookup on every router. The PE routers at the edge of the network add a label, and the routers in the core only look at that label to switch the packet. This creates a BGP free core and makes it possible to transport almost anything over the same network: IPv4, IPv6, Ethernet, frame-relay, or PPP. MPLS is mostly found in service provider networks, where MPLS VPN is a popular way to connect the sites of many customers over one shared network. In this course, we start with labels and LDP, build MPLS Layer 3 VPNs with every PE-CE routing protocol, and finish with MPLS Traffic Engineering.
Course Highlights
In this course you will learn:
- Why we use MPLS, and how it creates a BGP free core.
- What the MPLS label looks like, and what CE, PE, and P routers do with labels.
- How LDP discovers neighbors and exchanges labels, and what penultimate hop popping is.
- How to use VRFs to create multiple routing tables on one router.
- How MPLS Layer 3 VPN works with route distinguishers, route targets, and MP-BGP.
- How to configure BGP, OSPF, EIGRP, and RIP as the PE-CE routing protocol.
- How to leak routes between VRFs for extranet VPNs, and filter them with import and export maps.
- How to transport Ethernet with AToM, and IPv6 with 6PE and 6VPE.
- How MPLS Traffic Engineering steers traffic with CSPF, RSVP-TE, fast reroute, and DS-TE.
Presented to you by instructor Rene Molenaar, CCIE #41726
Course at a glance
- 48 lessons in 6 units.
- Format: self-paced lessons with Cisco IOS configurations, packet captures, and video.
- Last updated: October 2026.
Requirements
- A good understanding of IGPs like OSPF, EIGRP, and IS-IS.
- A good understanding of BGP.
- Basic knowledge of tunneling (GRE) and CEF (Cisco Express Forwarding).
Course Schedule
What is MPLS?
MPLS (Multiprotocol Label Switching) is a forwarding mechanism that switches packets based on labels. When a packet enters the MPLS network, the ingress PE (Provider Edge) router adds a label. P (Provider) routers in the core swap the label and forward the packet based on the label alone, without looking at the IP header. The label sits between the layer 2 and layer 3 header, which is why MPLS is often called a layer 2.5 protocol. Routers use LDP (Label Distribution Protocol) to tell each other which label to use for which prefix.
What makes MPLS important is that it works as a tunneling mechanism. The core routers only need to know how to reach the PE routers, so they don’t need BGP or customer routes; this is the BGP free core. Because a packet can carry more than one label, we can stack services on top of the transport label. A VPN label tells the egress PE which customer the packet belongs to, which is how MPLS VPN keeps customers with overlapping IP addresses separated.
Who uses MPLS? Service providers run it in their core to offer Layer 3 VPNs, Layer 2 services like Ethernet over MPLS, and IPv6 over an IPv4 core. Large enterprises use it to separate departments or tenants with VRFs, and they are often customers of an MPLS VPN service. With MPLS Traffic Engineering, operators steer traffic away from the IGP shortest path to use all of the bandwidth they have.
MPLS Learning Roadmap
This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.
MPLS Fundamentals and LDP
We start with the problem MPLS solves: why should every router in the provider network know about every customer route? You’ll learn what the MPLS header looks like, what the CE, PE, and P routers do, and how labels are pushed, swapped, and popped. LDP discovers neighbors with UDP multicast hello packets to 224.0.0.2, then exchanges labels over a TCP session, and with label filtering you control which labels it advertises. The label of the last hop is often removed one router early, which is called penultimate hop popping.
VRFs and MPLS Layer 3 VPN
A VRF (Virtual Routing and Forwarding) gives a router multiple routing tables, a bit like VLANs for routers. VRFs without MPLS are called VRF lite. MPLS Layer 3 VPN uses VRFs only on the PE routers: the RD (route distinguisher) turns customer prefixes into unique VPNv4 routes, MP-BGP carries them between PE routers, and the RT (route target) decides which VRF imports them. After the theory, we walk through the configuration step by step. When customer sites use the same AS number, BGP loop prevention gets in the way, and we fix it with allowas-in or AS override. You can even run MPLS over FlexVPN to extend your VPNs over IPsec tunnels.
PE-CE Routing Protocols
The customer can run almost any routing protocol with the provider. BGP is the most common, but you can also use OSPF, EIGRP, or RIP between the PE and CE routers and redistribute into MP-BGP. OSPF has some extra details: the MPLS backbone acts as a super backbone, routes from other sites can show up as inter-area routes, and a backdoor link between two CE routers requires a sham link. We also look at how to give customers Internet access with a default route, including one that points to the global routing table.
Route Leaking and Extranet VPNs
By default, each customer VRF only talks to its own sites; this is an intranet VPN. Sometimes customers need to reach each other, or a shared service. With route leaking, we import routes from one VRF into another, which turns it into an extranet VPN. You can do this on a single router with VRF lite route leaking, or between PE routers with route targets. Import maps and export maps let you use a route-map to decide which routes are leaked and which route targets they get.
Layer 2 and IPv6 over MPLS
MPLS doesn’t only carry IPv4. With AToM (Any Transport over MPLS), the provider transports layer 2 frames like Ethernet, frame-relay, PPP, and HDLC, so two customer sites end up in the same layer 2 segment. With 6PE and 6VPE, dual stack PE routers exchange IPv6 prefixes with MP-BGP over an IPv4-only MPLS core. 6PE uses the global routing table; 6VPE uses VRFs.
MPLS Traffic Engineering Fundamentals
An IGP only uses the path with the lowest cost, so other links stay unused. MPLS TE uses constraint-based routing instead. OSPF and IS-IS flood extra link information like available bandwidth and attribute flags into the TE database, the headend router calculates a path with CSPF, and RSVP-TE signals a unidirectional tunnel along that path. You can control the path with explicit paths, the TE metric, affinity attributes, and setup and hold priorities, and reoptimization moves a tunnel to a better path when one becomes available.
Routing Traffic into MPLS TE Tunnels
Once a TE tunnel is up, it does nothing until you route traffic into it. You can use static routes or PBR, or the TE-specific options: autoroute announce adds the tunnel to the SPF tree of the headend router, autoroute destination only adds a route to the tunnel endpoint, and forwarding adjacency advertises the tunnel as a link in the IGP. With multiple tunnels to the same destination, unequal cost load balancing works out of the box, and CBTS selects a tunnel based on the EXP value. You can also run MPLS VPN traffic over TE tunnels.
MPLS TE Fast Reroute and DS-TE
When an LSP fails, the headend router has to calculate and signal a new path, which takes time. MPLS TE Fast Reroute uses pre-built backup tunnels to protect a link or a node, with recovery in about 50 ms, and RSVP hello detects a failed neighbor when the link layer can’t. Regular MPLS TE doesn’t know anything about QoS. DiffServ-Aware TE (DS-TE) makes bandwidth reservations QoS aware, first with Cisco’s traditional mode and later with the IETF mode, which supports multiple class types.
Frequently Asked Questions
Yes. Service providers still run MPLS in their core networks and use it to sell Layer 3 VPNs, Ethernet services, and traffic engineering. Many enterprises have moved their branch WAN connections from MPLS VPN to SD-WAN over regular Internet links, but MPLS is still common where companies need predictable performance. Inside provider networks, it isn’t going away. Read our introduction to MPLS.
Partly. An MPLS VPN is a private WAN service you buy from a provider, usually with an SLA for bandwidth and delay. SD-WAN is an overlay you build yourself, usually over Internet links, with central management and policies that pick the best path for each application. Many companies combine the two and keep MPLS for critical sites, since SD-WAN can also run on top of an MPLS circuit. Learn about Cisco SD-WAN.
Yes, but not the kind most people think of. An MPLS VPN separates customers on a provider network, but it doesn’t encrypt anything. Each customer gets its own VRF on the provider’s routers, and MP-BGP carries their routes across the MPLS core, so customers can even use overlapping IP addresses. Learn how MPLS Layer 3 VPN works.
Not in depth. CCNA 200-301 only expects you to know MPLS as a WAN option at a high level. Configuring LDP, VRFs, and MPLS VPN belongs to CCNP and CCIE level studies, especially the service provider track. If you work for an ISP or a large enterprise with its own MPLS network, it’s well worth learning.
The basics aren’t hard once you know your routing protocols. MPLS VPN builds on an IGP like OSPF or IS-IS and on BGP, so learn those first. Then start with labels and LDP, move on to VRF lite and MPLS Layer 3 VPN, and leave traffic engineering for last. Start with our introduction to MPLS.
MPLS (Multiprotocol Label Switching) is a forwarding mechanism where routers switch packets based on labels instead of the destination IP address. The edge router adds a label, and the core routers only look at that label. Service providers use it to build VPNs and transport many protocols over one network. Read our introduction to MPLS.
Routers use LDP to exchange labels for the prefixes in their routing table. The ingress PE router pushes a label onto the packet, P routers swap the label at each hop, and the label is popped at the end of the path, often by the second-to-last router (penultimate hop popping). Learn about MPLS labels and devices.
Both are ways to tunnel traffic over a shared network. MPLS uses labels and is mostly found in service provider networks and WANs. VXLAN encapsulates Ethernet frames in UDP and is mostly used in data centers to stretch layer 2 segments over a layer 3 fabric. Learn more about VXLAN.