Bridging · Topic 2 of 4

L2TP and VPLS Bridging

Learn how a VPLS pseudowire bridges two LANs over MPLS and LDP on RouterOS, why a loopback and tunnel path are needed, and how to compare VPLS with EoIP.

4 min

In a nutshell

VPLS bridges sites at Layer 2 over MPLS.
LDP must run between the two routers.
Each router uses a loopback /32 address as its LDP identity.

What it is

VPLS carries Ethernet frames between sites over an MPLS network, so the sites share one Layer 2 segment.

It does the same job as EoIP, but it uses MPLS labels and a signalling protocol called LDP instead of an IP tunnel. Each pair of routers builds a pseudowire, which is a virtual Ethernet link, and the bridge joins it to the LAN.

L2TP can supply the IP path between the routers when no direct MPLS network exists.

How it works

LDP builds labels between the routers, a VPLS interface uses them, and a bridge connects the interface to the LAN.

What VPLS needs

Three things must be in place before a VPLS interface works:

IP reachability between the two routers, which L2TP can provide
LDP running between them, so they exchange MPLS labels
a loopback address on each router, used as its LDP identity

The loopback is a /32 address on a bridge with no ports. It does not depend on any physical link, so the identity stays stable.

Step 1: loopback and addressing

/interface bridge add name=loopback
/ip address add address=10.255.0.1/32 interface=loopback

Router B gets its own loopback address in the same way. A route to each loopback must exist, for example through the tunnel interface.

Step 2: LDP

/mpls ldp set enabled=yes lsr-id=10.255.0.1 transport-address=10.255.0.1
/mpls ldp interface add interface=l2tp-out1

This is the RouterOS v6 form, which uses set. In v7 the LDP instance is created with add and uses a slightly different parameter list, so check your version.

The lsr-id is the router's LDP identity. The LDP interface list names the interfaces on which neighbours are found, and here that includes the tunnel.

Step 3: the VPLS interface

/interface vpls add name=vpls-to-b remote-peer=10.255.0.2 vpls-id=10:10 disabled=no

Setting	What it does
`remote-peer`	The LDP identity of the far router.
`vpls-id`	Identifier that must be the same on both ends.
`cisco-style`	Compatibility with another vendor's pseudowire form.
`mac-address`	Address of the VPLS interface.
`mtu`	Size limit for frames on the interface.

Step 4: the bridge

/interface bridge add name=bridge-lan
/interface bridge port add bridge=bridge-lan interface=ether2
/interface bridge port add bridge=bridge-lan interface=vpls-to-b horizon=1

The horizon value gives a split horizon. Ports with the same horizon value do not forward frames to one another. In a full mesh of VPLS interfaces this prevents loops.

MTU

MPLS adds labels to every frame, and the VPLS interface adds more. The links must therefore carry larger frames than a normal Ethernet link.

If the path cannot grow, large frames are dropped. Test with big pings across the bridge before you trust the link.

Comparison with EoIP

Feature	EoIP	VPLS
Transport	IP protocol 47	MPLS labels
Signalling	None, manual tunnel ID	LDP
Setup effort	Low	Higher
Needs loopbacks and LDP	No	Yes
Standard form	MikroTik only	Standard, works with other vendors

Verification

/mpls ldp neighbor print
/interface vpls print
/interface bridge host print

A working LDP neighbour appears in the neighbour list. The VPLS interface shows the flag R, and the bridge learns MAC addresses from the far site.

What to remember for the exam

Seven facts cover most VPLS questions.

VPLS bridges sites at Layer 2 over MPLS.
LDP must run between the two routers.
Each router uses a loopback /32 address as its LDP identity.
remote-peer is the far router's LDP address, and vpls-id must match on both ends.
The VPLS interface is added to a bridge with the LAN port.
A horizon value stops loops in a full mesh.
VPLS is more work than EoIP, but it is a standard.

Exam tip

If the VPLS interface will not come up, check the LDP neighbour list before anything else.

Common mistakes

These four errors appear again and again.

No loopback. Without a stable LDP identity, the neighbour or the pseudowire is unreliable.

No route to the far loopback. The peer address is unreachable, so LDP and VPLS fail.

Different vpls-id values. The ends do not match, so the pseudowire does not form.

Ignoring the MTU. MPLS and VPLS add bytes, so large frames fail.

Watch out

VPLS ports in a full mesh need the same horizon value, or frames can loop between the sites.

Check yourself

Work through these three questions.

What must run between two routers before a VPLS interface can come up?
LDP must run between them, with a reachable loopback address on each router.
Which setting names the far router, and which must match on both ends?
remote-peer names the far router, and vpls-id must match on both ends.
What does a horizon value do on VPLS bridge ports?
Ports with the same horizon value do not forward frames to one another, which prevents loops in a full mesh.

Topic 2 of 4 in Bridging

Test yourself on Bridging

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.