MPLS Fundamentals Complete Guide

MPLS forwarding concept

At the ingress of an MPLS domain, a label edge router classifies a packet into a Forwarding Equivalence Class (FEC) and pushes one or more labels. Label switch routers in the core swap labels. The egress router removes the label stack and forwards the original packet.

Ingress PE: classify + push

P router: swap

P router: swap/pop

Egress PE: IP/VPN forward

An MPLS label is locally significant between adjacent label-switching routers. The label does not replace routing; control-plane protocols establish reachability and label bindings that the data plane uses.

MPLS shim header and label stack

Field	Size	Purpose
Label	20 bits	Forwarding value.
Traffic Class	3 bits	QoS and congestion-related marking.
Bottom of Stack	1 bit	Marks the last label in the stack.
TTL	8 bits	Limits lifetime and supports loop detection.

Multiple labels can be stacked. In an MPLS Layer 3 VPN, an outer transport label commonly carries the packet across the provider core while an inner VPN label identifies the correct customer routing context at the egress PE.

Router roles and tables

Role/table	Purpose
CE	Customer Edge device exchanges customer routes with a provider PE; it need not run MPLS.
PE / LER	Provider Edge performs customer separation and label push/pop.
P / LSR	Provider core Label Switch Router swaps transport labels.
RIB/FIB	Routing information and IP forwarding decisions.
LIB/LFIB	Label bindings and label-forwarding actions.
VRF	Separate routing and forwarding context, commonly per customer or service.

Label distribution and LSPs

Label Distribution Protocol (LDP) is commonly used to distribute labels for IGP-reachable prefixes. Segment Routing and RSVP-TE are alternative mechanisms for specific architectures. An MPLS Label Switched Path follows label bindings through the domain.

Penultimate Hop Popping (PHP) allows the router before the egress to remove the outer label, reducing work at the egress. An implicit-null label commonly signals PHP; explicit-null can preserve QoS information to the egress.

MPLS Layer 3 VPN concept

In a typical L3VPN, the PE learns customer routes into a VRF. MP-BGP carries VPN routes between PEs using route distinguishers to make overlapping prefixes unique and route targets to control import/export policy. The provider core P routers carry labelled packets without holding every customer route.

Separation versus encryption: MPLS VPNs provide traffic separation, but they do not inherently encrypt payloads. Add encryption when confidentiality against the transport provider or interception is required.

Verification and troubleshooting

Cisco IOS-style operational checks

show mpls interfaces
show mpls ldp neighbor
show mpls forwarding-table
show ip cef
show ip route
show vrf
show ip route vrf CUSTOMER_A
show bgp vpnv4 unicast all

Verify IGP reachability to loopbacks and LDP/label-session formation.
Check that MPLS is enabled on all intended core interfaces.
Inspect LFIB entries and label actions along the path.
For L3VPN, verify VRF assignment, RD/RT policy and PE-CE route exchange.
Check MTU because added labels increase frame size.
Use MPLS-aware ping/traceroute or LSP verification tools where supported.
Distinguish transport-label failure from VPN-route or customer policy failure.

Interview focus

Use these points to practise concise, operations-focused answers. Explain the concept first, then give a verification or troubleshooting example.

What does an MPLS ingress router do? It classifies the packet into an FEC and pushes the appropriate label stack.
What is label swapping? Replacing an incoming label with the outgoing label selected by the LFIB.
What does the Bottom of Stack bit indicate? Whether the current label is the final label in the stack.
Do MPLS VPNs automatically encrypt traffic? No. They provide separation but not inherent payload encryption.
Why are two labels common in an MPLS L3VPN? The outer label transports the packet to the egress PE; the inner label identifies the VPN/forwarding context.

Quick self-check

1. What does an MPLS ingress router do?

Answer: It classifies the packet into an FEC and pushes the appropriate label stack.

2. What is label swapping?

Answer: Replacing an incoming label with the outgoing label selected by the LFIB.

3. What does the Bottom of Stack bit indicate?

Answer: Whether the current label is the final label in the stack.

4. Do MPLS VPNs automatically encrypt traffic?

Answer: No. They provide separation but not inherent payload encryption.

5. Why are two labels common in an MPLS L3VPN?

Answer: The outer label transports the packet to the egress PE; the inner label identifies the VPN/forwarding context.

Frequently asked questions

1. Is MPLS a routing protocol?

Answer: No. It is a forwarding architecture that relies on routing and label-distribution control planes.

2. Can customer networks use overlapping IPv4 prefixes?

Answer: Yes. VRFs and VPN route identifiers allow separation of overlapping customer space.

3. What is PHP?

Answer: Penultimate Hop Popping removes the outer label one hop before the egress.

Standards and further reading

Editorial note: Standards explain protocol behaviour, while commands and defaults can differ by vendor, platform and software release. Verify production changes against current vendor documentation.