MPLS · Topic 7 of 7

BGP Based Layer 3 VPNs and OSPF as the CE to PE Protocol

Learn how an MPLS layer 3 VPN carries customer routes in BGP between PE routers using VRFs and two labels, and how OSPF can run between the CE and the PE.

  • 5 min
  • Includes a diagram
In a nutshell
  • A layer 3 VPN keeps customer routes in a VRF on each PE.
  • PE routers exchange customer routes with BGP using the VPNv4 address family.
  • The route distinguisher makes prefixes unique, and the route target controls import and export.

What it is

A layer 3 VPN gives each customer a private routed network across a shared MPLS provider network.

The customer router, called the CE, connects to a provider edge router, called the PE. The PE keeps the customer routes in a VRF and shares them with other PE routers using BGP.

The core routers, called P routers, carry only labelled packets. They hold no customer routes and need no BGP.

CE 1customer site AOSPF or BGP or staticPE 1VRF for customerMPLS core, two labelsPE 2VRF for customerOSPF or BGP or staticCE 2customer site B

How it works

Customer routes go into a VRF, travel between PEs in BGP, and the packets cross the core with two labels.

The control plane

Each PE has a VRF for the customer. The CE announces its prefixes to the PE, and the PE places them in the VRF.

The PE exports those routes into BGP with a route distinguisher, which makes them unique, and a route target, which says who may import them. The other PE routers hold iBGP sessions with this one, and they import routes whose target matches.

This uses the VPNv4 address family. The PE to PE session runs between loopbacks, and a route reflector can be used in a larger network.

The data plane and two labels

Customer site A connects through CE 1, PE 1, a P router and PE 2 to CE 2 at site B. Packets carry an outer transport label and an inner VPN label, the outer label is removed before PE 2, and the PE routers exchange VPN routes with iBGP VPNv4. A packet from one customer site to another carries two labels as it crosses the core.

LabelAdded byPurpose
Outer, transportThe ingress PE, from LDPGets the packet to the far PE across the core
Inner, VPNThe ingress PE, from BGPTells the far PE which VRF to use

The P routers read only the outer label. The egress PE reads the inner label and delivers the packet into the right VRF. Because the penultimate router normally removes the outer label, the egress sees just the inner one.

RouterOS configuration outline

On RouterOS v6 the pieces are the VRF, a BGP instance for the VRF, and a PE to PE peer for VPNv4.

/ip route vrf add routing-mark=cust-a interfaces=ether3 route-distinguisher=65000:1 import-route-targets=65000:1 export-route-targets=65000:1
/routing bgp instance vrf add routing-mark=cust-a redistribute-connected=yes
/routing bgp peer add name=pe2 remote-address=10.255.255.2 remote-as=65000 update-source=lo address-families=vpnv4
  • ip route vrf defines the table and the route targets.
  • routing bgp instance vrf connects the table to BGP so its routes can be exported.
  • address-families=vpnv4 lets the PE to PE peer carry VPN routes.

RouterOS v7 arranges the VRF and BGP configuration differently. The roles of route distinguisher, route target and VPNv4 remain.

OSPF between the CE and the PE

The CE and PE can use static routes, BGP or OSPF. With OSPF, the PE runs an OSPF instance tied to the customer VRF, so OSPF adjacencies form on the customer interface only.

The customer routes learned by OSPF are redistributed into BGP on the ingress PE. At the egress PE, the BGP routes are redistributed into the OSPF instance of that VRF, and the remote CE learns them.

/routing ospf network add network=10.10.10.0/30 area=backbone

The OSPF instance on the PE should be linked to the VRF table, so the PE does not mix the customer with the main table. Consult the version in use, because the setting that binds an instance to a table differs.

On RouterOS v6, the redistribution needs two switches. The BGP VRF instance redistributes OSPF, and the OSPF instance redistributes BGP.

CE 1OSPF routesredistribute OSPF into BGPPE 1VRFVPNv4 over corePE 2VRFredistribute BGP into OSPFCE 2OSPF routes

Because the routes pass through redistribution, the remote CE normally sees them as external OSPF routes, not as ordinary internal ones.

Choosing the CE to PE protocol

ProtocolGood for
StaticA single site with one prefix
OSPFA customer already running OSPF who wants to keep it
BGPCustomers that want policy control or multihoming
Exam tip

Test in layers. First CE to PE, then the PE to PE VPNv4 session, then the labels in the core, then the remote CE.

What to remember for the exam

Eight facts cover most questions here.

  • A layer 3 VPN keeps customer routes in a VRF on each PE.
  • PE routers exchange customer routes with BGP using the VPNv4 address family.
  • The route distinguisher makes prefixes unique, and the route target controls import and export.
  • P routers carry labels only and have no customer routes.
  • Packets use two labels, the outer transport label and the inner VPN label.
  • The CE can use static routes, BGP or OSPF toward the PE.
  • With OSPF, the PE redistributes between OSPF and BGP in both directions.
  • Remote sites learn routes redistributed from BGP as external OSPF routes.
Watch out

If either redistribution direction is missing, customer routes cross the core one way only.

Common mistakes

These four errors are common.

Running BGP on the P routers for customer routes. They need only labels, not customer routes.

Forgetting the VPNv4 address family. The PE session is up, but no VPN routes are exchanged.

Redistributing in one direction only. The remote site has no route back.

Expecting OSPF routes to look internal. They pass through BGP, so they appear as external routes at the other end.

Check yourself

Work through these three questions.

  • Which two labels does a packet carry across an L3VPN core?

    An outer transport label gets it to the far PE, and an inner VPN label selects the VRF there.

  • How do PE routers exchange customer routes in a BGP based L3VPN?

    They use iBGP with the VPNv4 address family. Route distinguishers make prefixes unique, and route targets control import.

  • Why does the remote CE see external OSPF routes?

    The routes pass through redistribution into and out of BGP. They therefore appear as external routes at the remote CE.

Topic 7 of 7 in MPLS

Test yourself on MPLS

The full MikroTik MTCINE question bank has 475 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.