VPN Technologies · Topic 2 of 3
MPLS Layer 3 VPN
Describe how an MPLS Layer 3 VPN keeps customers apart using VRFs, route distinguishers, route targets, VPNv4 MP-BGP and a two label stack on IOS XE.
- 5 min
- Includes a diagram
- PE routers hold the VRFs. P routers do not.
- The RD makes overlapping prefixes unique. It does not control import.
- The RT controls which VRFs import a route.
What it is
An MPLS Layer 3 VPN lets a provider carry many customers over one shared core, with each customer's routes kept separate.
The customer routers (CE) speak ordinary IP to the provider edge (PE). The PE keeps one VRF for each customer, and the core P routers know nothing about customer routes.
This builds on the previous page and on VRFs. The new parts are the route distinguisher, the route target and MP-BGP.
How it works
Customer routes travel between PE routers in MP-BGP, and the traffic travels inside labelled packets.
The building blocks
| Item | Purpose |
|---|---|
| VRF | Separate routing table for each customer on the PE |
| Route distinguisher (RD) | Makes overlapping customer prefixes unique |
| Route target (RT) | Extended community that says which VRFs import a route |
| VPNv4 address | RD plus the IPv4 prefix |
| MP-BGP | Carries VPNv4 routes between PE routers |
The RD is a 64 bit value added to a prefix. Two customers can both use 10.1.1.0 slash 24, because each has a different RD. The RD does not control who receives a route.
The RT controls distribution. A VRF exports routes with its export RT. Another VRF imports only routes that carry an RT it is set to import.
PE configuration
PE1(config)# vrf definition CUST-A
PE1(config-vrf)# rd 65000:1
PE1(config-vrf)# address-family ipv4
PE1(config-vrf-af)# route-target export 65000:1
PE1(config-vrf-af)# route-target import 65000:1
PE1(config-vrf-af)# exit-address-family
PE1(config)# interface GigabitEthernet0/1
PE1(config-if)# vrf forwarding CUST-A
PE1(config-if)# ip address 192.168.1.1 255.255.255.252The PE then runs a BGP session to the other PE, normally between loopbacks.
PE1(config)# router bgp 65000
PE1(config-router)# neighbor 10.255.0.2 remote-as 65000
PE1(config-router)# neighbor 10.255.0.2 update-source Loopback0
PE1(config-router)# address-family vpnv4
PE1(config-router-af)# neighbor 10.255.0.2 activate
PE1(config-router-af)# neighbor 10.255.0.2 send-community extended
PE1(config-router)# address-family ipv4 vrf CUST-A
PE1(config-router-af)# redistribute ospf 2 vrf CUST-AExtended communities carry the RT, so they have to be sent to the peer. IOS XE often adds send-community extended by itself when you activate a VPNv4 neighbour, but it is shown here to make the point. The address-family ipv4 vrf section links BGP to the customer VRF.
PE to CE routing
The PE learns customer routes from the CE with a static route or a routing protocol such as OSPF, EIGRP, RIP or eBGP. Those routes are placed into the VRF, redistributed into MP-BGP and sent to the remote PE.
The remote PE puts the routes into its own VRF and redistributes them to the remote CE. The CE sees an ordinary IP network and does not run MPLS.
The two label stack
A customer packet crossing the core carries two labels.
- The outer label, from LDP, gets the packet to the egress PE.
- The inner label, from MP-BGP, tells the egress PE which VRF or interface to use.
P routers switch on the outer label only. They never see the customer packet or the inner label. This is why P routers need no VRFs and no BGP VPN routes.
The BGP next hop of a VPNv4 route is the remote PE loopback. The core must have an LSP to that loopback, or the VPN does not work.
Verifying and troubleshooting
PE1# show ip vrf
PE1# show ip route vrf CUST-A
PE1# show bgp vpnv4 unicast all summary
PE1# show mpls forwarding-table vrf CUST-AWhen a customer route is missing at the far site, follow it in order.
- Is it in the local VRF?
- Is it exported with the right RT?
- Does the remote VRF import that RT?
- Is the VPNv4 session Established?
If the route is in the remote VRF but traffic fails, the usual cause is a missing LSP between the PE loopbacks.
Think of the RD as the label that makes a prefix unique, and the RT as the address list that decides who receives it.
What to remember for the exam
Eight facts cover most questions on this topic.
- PE routers hold the VRFs. P routers do not.
- The RD makes overlapping prefixes unique. It does not control import.
- The RT controls which VRFs import a route.
- A VPNv4 address is the RD plus the IPv4 prefix.
- MP-BGP carries VPNv4 routes between PE routers.
- Extended communities carry the RT, so
send-community extendedis needed. - Packets carry two labels, an outer transport label and an inner VPN label.
- A working LSP between PE loopbacks is required.
Matching RDs do not make two VRFs share routes. Only matching route targets do.
Common mistakes
These five mistakes appear often.
Using the RD for filtering. Import and export are controlled by RTs.
Import and export RT mismatch. The remote VRF never receives the route.
No extended community. The RT is lost and nothing is imported.
Missing LSP to the PE loopback. Routes are present but traffic is dropped.
Running a VRF on a P router. It is not needed, because P routers see only labels.
Check yourself
Work through these three questions.
What is the job of a route target?
It controls which VRFs import a route, by marking exported routes and being matched on import.
Why do P routers not need customer routes?
They forward on the outer transport label only and never see the inner VPN label or the customer packet.
What does a VPNv4 address contain?
It contains the 64 bit route distinguisher followed by the IPv4 prefix.
Topic 2 of 3 in VPN Technologies
Test yourself on VPN Technologies
The full Cisco CCNP 300-410 ENARSI question bank has 857 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.