MPLS L3VPN Best Practices: PE/CE Routing, VPNv4, and Troubleshooting

Part 1 — MPLS L3VPN Architecture

1.1 — The Three Router Roles

• CE (Customer Edge) — the customer's router. Has no knowledge of MPLS. Runs a standard routing protocol (BGP, OSPF, EIGRP, or static) toward the PE. The CE sees only its own VPN routes.
• PE (Provider Edge) — the most complex role. Maintains per-customer VRF instances, runs PE-CE routing, redistributes customer routes into VPNv4 BGP, and imposes/disposes the MPLS label stack.
• P (Provider Core) — pure label-switching routers. They see only transport labels, never VPN labels or customer IP addresses. P routers run IGP (IS-IS or OSPF) and LDP/RSVP for label distribution.

1.2 — The Label Stack

Every MPLS L3VPN packet carries two labels when traversing the core:

• Top label (transport label) — assigned by LDP/RSVP, used by P routers to switch the packet hop-by-hop toward the egress PE. This label is swapped at every P router.
• Bottom label (VPN label) — assigned by the egress PE, identifies which VRF to deliver the packet into upon arrival. P routers never look at this label.

At the penultimate hop (the P router directly connected to the egress PE), the transport label is popped (PHP — Penultimate Hop Popping), leaving only the VPN label. The egress PE uses the VPN label to identify the VRF and forwards into the correct customer routing table.

Part 2 — PE Configuration

Step 1 — Enable MPLS in the Core

# Enable CEF (required for MPLS)
PE1(config)# ip cef

# Enable MPLS on core-facing interfaces
PE1(config)# interface GigabitEthernet0/1
PE1(config-if)#  mpls ip
PE1(config-if)#  no shutdown

# Verify LDP neighbors and label bindings
PE1# show mpls ldp neighbor
PE1# show mpls ldp bindings
PE1# show mpls forwarding-table

Step 2 — VRF and Route Distinguisher

# Define VRF with RD and route targets
PE1(config)# vrf definition CUST-ACME
PE1(config-vrf)#  rd 65001:100
PE1(config-vrf)#  address-family ipv4
PE1(config-vrf-af)#   route-target export 65001:100
PE1(config-vrf-af)#   route-target import 65001:100

# Bind CE-facing interface to VRF
PE1(config)# interface GigabitEthernet0/0
PE1(config-if)#  vrf forwarding CUST-ACME
PE1(config-if)#  ip address 10.1.0.1 255.255.255.252

Step 3 — VPNv4 BGP Between PEs

PE1(config)# router bgp 65001
PE1(config-router)#  bgp router-id 1.1.1.1
PE1(config-router)#  no bgp default ipv4-unicast

# iBGP session to PE2 (via Route Reflector in large networks)
PE1(config-router)#  neighbor 2.2.2.2 remote-as 65001
PE1(config-router)#  neighbor 2.2.2.2 update-source Loopback0

# Enable VPNv4 address family
PE1(config-router)#  address-family vpnv4
PE1(config-router-af)#   neighbor 2.2.2.2 activate
PE1(config-router-af)#   neighbor 2.2.2.2 send-community extended

# PE-CE BGP (customer routing)
PE1(config-router)#  address-family ipv4 vrf CUST-ACME
PE1(config-router-af)#   neighbor 10.1.0.2 remote-as 65100
PE1(config-router-af)#   neighbor 10.1.0.2 activate
PE1(config-router-af)#   neighbor 10.1.0.2 as-override
# as-override replaces CE AS in BGP path — needed when all CE sites use same AS

Part 3 — PE-CE Routing Protocol Options