What is MPLS in simple terms?

MPLS is a forwarding method that adds short labels to packets as they enter a provider network. Core routers use those labels to select forwarding actions without examining the complete customer IP route at every hop.

What is the difference between an MPLS label and an LSP?

A label is a locally significant value used for a forwarding decision. An LSP is the complete unidirectional path that labelled packets follow from an ingress router towards an egress router.

Does MPLS replace OSPF or IS-IS?

No. In an LDP-based MPLS network, OSPF or IS-IS supplies IP reachability and selects the next hop. LDP distributes label bindings that follow the path chosen by the IGP.

Why are two labels used in an MPLS Layer 3 VPN?

The outer transport label carries the packet to the correct egress provider edge router. The inner VPN label tells that router which VPN route or forwarding context should process the customer packet.

Does MPLS encrypt customer traffic?

No. MPLS separates forwarding contexts but does not encrypt packet contents. IPsec, MACsec or another suitable security technology is required when traffic confidentiality is needed.

What should be checked first when LDP neighbours do not form?

First verify that the link is up, IP addresses are correct and MPLS is enabled on both interfaces. Then confirm IGP reachability to the LDP router IDs and check whether UDP and TCP port 646 are being blocked.

MPLS Explained: Labels, LSPs and Provider Use

What is MPLS?

Multiprotocol Label Switching, or MPLS, forwards packets through a network by using short labels rather than performing a complete IP routing lookup at every hop. Service providers use it to build scalable Layer 2 and Layer 3 VPN services, apply traffic policies and separate customer routes over shared infrastructure.

MPLS operates between the traditional Layer 2 and Layer 3 functions, so it is sometimes described as a Layer 2.5 technology. It does not replace IP routing. An underlying routing protocol such as OSPF or IS-IS is still required to establish reachability between provider routers.

The basic forwarding sequence is:

An ingress router classifies an incoming packet.
It adds one or more MPLS labels.
Intermediate routers swap labels.
A router near the destination removes the transport label.
The egress router forwards the original packet or processes another label.

Engineers studying MPLS should already understand routing tables, OSPF and Cisco IOS verification commands. These foundations are covered in a structured way in the CCNA course, while provider and enterprise routing design is developed further in the CCNP Enterprise course.

How does an MPLS label work?

An MPLS label is a 32-bit shim header inserted between the Layer 2 header and the transported network-layer packet. The label identifies a Forwarding Equivalence Class, or FEC, so packets requiring the same forwarding treatment can follow the same path.

The MPLS header contains four fields:

Field	Size	Purpose
Label	20 bits	Identifies the forwarding entry
Traffic Class	3 bits	Supports QoS marking and congestion handling
Bottom of Stack	1 bit	Set to 1 on the final label in the stack
TTL	8 bits	Limits the packet lifetime and helps prevent loops

A FEC is a group of packets treated in the same way. In a basic LDP network, the FEC usually represents an IP prefix. In an MPLS Layer 3 VPN, a FEC can also represent a customer VPN route.

MPLS routers perform three main label operations:

Operation	Meaning	Typical location
Push	Add a label or label stack	Ingress provider edge router
Swap	Replace the incoming label with an outgoing label	Transit provider router
Pop	Remove the top label	Penultimate or egress router

Labels are locally significant. Label 16 on one link does not have to identify the same FEC as label 16 on another link. Each router selects an outgoing label based on the binding advertised by its downstream neighbour.

Labels 0 through 15 are reserved. Common reserved labels include IPv4 Explicit Null with value 0, IPv6 Explicit Null with value 2 and Implicit Null with value 3. Implicit Null tells an upstream router to remove the top label before sending the packet downstream.

What is a label-switched path?

A label-switched path, or LSP, is the unidirectional path followed by labelled packets for a particular FEC. A return flow normally uses a separate LSP, and its router sequence or label values may be different.

Three router roles are important:

Ingress LER: The label edge router that classifies the packet and pushes a label.
LSR: A label switch router that swaps labels in the provider core.
Egress LER: The edge router that removes or processes the final label and forwards the packet.

Diagram in words:

Customer A
    |
    | Unlabelled IP packet
    v
PE1 -- label 18 --> P1 -- label 21 --> P2 -- unlabelled --> PE2
 ^                    transit LSRs                         ^
Ingress LER                                             Egress LER

This diagram shows an LSP from PE1 to PE2. The labels can change at each hop even though the packet remains associated with the same destination FEC.

An LSP created by Label Distribution Protocol normally follows the shortest path selected by the IGP. LDP distributes label bindings, but it does not calculate the route. OSPF or IS-IS provides the routing decision that LDP follows.

How do the MPLS control plane and data plane differ?

The control plane learns routes, selects paths and exchanges label bindings. The data plane uses the resulting forwarding entries to push, swap or remove labels from actual packets.

Several tables are involved:

Table	Information stored
Routing Information Base	Routes learned through connected, static or dynamic routing
Forwarding Information Base	Optimised IP forwarding entries derived from the routing table
Label Information Base	Local and remote label bindings learned by the control plane
Label Forwarding Information Base	Incoming and outgoing label actions used for packet forwarding

For LDP-based MPLS, the sequence is:

OSPF or IS-IS establishes IP reachability.
LDP neighbours form across MPLS-enabled links.
Routers advertise label bindings for eligible prefixes.
Each router combines the IGP next hop with the downstream label.
The LFIB is programmed for labelled forwarding.

This dependency explains why an LDP session alone is not enough. If the IGP points towards a different next hop from the available label binding, traffic may be dropped or forwarded as IP instead of MPLS.

How does an MPLS packet cross a provider network?

At the ingress PE, an ordinary IP packet is classified and given a transport label. Core routers use that label to forward the packet, while the router immediately before the egress PE will often remove it through penultimate hop popping.

Consider this topology:

PE1 loopback 1.1.1.1
    |
10.12.12.0/30
    |
P1  loopback 2.2.2.2
    |
10.23.23.0/30
    |
PE2 loopback 3.3.3.3

Assume PE1 sends a packet to 3.3.3.3:

PE1 performs an IP lookup and associates 3.3.3.3/32 with an LDP FEC.
PE1 pushes the label advertised by P1.
P1 checks its LFIB instead of doing a normal IP destination lookup.
If PE2 advertised Implicit Null, P1 removes the label.
PE2 receives the IP packet and performs the final IP lookup.

The removal at P1 is called penultimate hop popping, or PHP. It reduces label processing on the egress router. Explicit Null can be used when the label must remain present to carry traffic-class information to the egress PE.

How do MPLS Layer 3 VPNs use two labels?

An MPLS Layer 3 VPN commonly uses an outer transport label and an inner VPN label. The outer label moves the packet to the correct egress PE, while the inner label identifies the destination VPN or forwarding context on that PE.

Diagram in words:

[Ethernet][Transport label][VPN label][Customer IP packet]
             |                |
             |                +-- Selects the VPN route or VRF context
             +-- Reaches the egress PE through the provider core

The core P routers normally need only provider infrastructure routes. They do not need every customer route. Provider edge routers hold customer routes in virtual routing and forwarding tables, or VRFs, while Multiprotocol BGP distributes VPN routes and their associated VPN labels.

Route distinguishers make overlapping customer prefixes unique in MP-BGP. Route targets control which VPN routes are imported into or exported from a VRF. For a supporting explanation of BGP neighbour types and route processing, read BGP basics for CCNP.

MPLS does not encrypt customer traffic. If confidentiality is required, providers and customers may add technologies such as IPsec or MACsec where supported and appropriate.

How can you configure a basic MPLS LDP lab?

A basic lab needs IGP reachability between loopbacks, Cisco Express Forwarding, MPLS on core-facing interfaces and stable LDP router IDs. Verify the IP underlay before expecting labels to work.

The following Cisco IOS example uses OSPF area 0 and LDP.

PE1 configuration

hostname PE1
ip cef
mpls label protocol ldp
mpls ldp router-id Loopback0 force

interface Loopback0
 ip address 1.1.1.1 255.255.255.255
 ip ospf 10 area 0

interface GigabitEthernet0/0
 ip address 10.12.12.1 255.255.255.252
 ip ospf 10 area 0
 mpls ip
 no shutdown

router ospf 10
 router-id 1.1.1.1

P1 configuration

hostname P1
ip cef
mpls label protocol ldp
mpls ldp router-id Loopback0 force

interface Loopback0
 ip address 2.2.2.2 255.255.255.255
 ip ospf 10 area 0

interface GigabitEthernet0/0
 ip address 10.12.12.2 255.255.255.252
 ip ospf 10 area 0
 mpls ip
 no shutdown

interface GigabitEthernet0/1
 ip address 10.23.23.1 255.255.255.252
 ip ospf 10 area 0
 mpls ip
 no shutdown

router ospf 10
 router-id 2.2.2.2

PE2 configuration

hostname PE2
ip cef
mpls label protocol ldp
mpls ldp router-id Loopback0 force

interface Loopback0
 ip address 3.3.3.3 255.255.255.255
 ip ospf 10 area 0

interface GigabitEthernet0/0
 ip address 10.23.23.2 255.255.255.252
 ip ospf 10 area 0
 mpls ip
 no shutdown

router ospf 10
 router-id 3.3.3.3

Confirm that PE1 has an OSPF route to the PE2 loopback:

PE1# show ip route 3.3.3.3
O    3.3.3.3/32 [110/3] via 10.12.12.2, GigabitEthernet0/0

Check the LDP neighbour:

PE1# show mpls ldp neighbor
Peer LDP Ident: 2.2.2.2:0; Local LDP Ident 1.1.1.1:0
    TCP connection: 2.2.2.2.646 - 1.1.1.1.646
    State: Oper; Msgs sent/rcvd: 24/25

Inspect PE1's LFIB entry for the PE2 loopback:

PE1# show mpls forwarding-table 3.3.3.3 32
Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id     Switched      interface
17         16         3.3.3.3/32       0             Gi0/0      10.12.12.2

On P1, the same FEC may show Pop Label because PE2 advertised Implicit Null:

P1# show mpls forwarding-table 3.3.3.3 32
Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id     Switched      interface
16         Pop Label  3.3.3.3/32       0             Gi0/1      10.23.23.2

Label values are dynamically assigned and can differ from this sample output.

How do you troubleshoot an MPLS LDP failure?

Troubleshoot MPLS from the underlay upwards: interfaces, IP reachability, IGP routes, LDP discovery, LDP sessions and finally LFIB entries. Checking labels before confirming the IP path often hides the actual fault.

1. Verify interface and IP status

show ip interface brief
show interfaces GigabitEthernet0/0

Both ends must use compatible addressing, and the interface must be up/up.

2. Verify the IGP route

show ip ospf neighbor
show ip route 3.3.3.3
ping 3.3.3.3 source Loopback0

LDP uses TCP port 646 for sessions, but routers first discover directly connected neighbours with UDP port 646. Reachable and stable loopbacks are commonly used as LDP identifiers.

3. Confirm MPLS is enabled on both link ends

show mpls interfaces
show running-config interface GigabitEthernet0/0

A frequent lab error is configuring mpls ip on only one side. LDP discovery will not form correctly across that link.

4. Check LDP discovery and neighbour state

show mpls ldp discovery
show mpls ldp neighbor

If discovery exists but the TCP session does not form, verify reachability to the LDP router ID and check access control lists that may block TCP 646.

5. Inspect bindings and forwarding entries

show mpls ldp bindings 3.3.3.3 32
show mpls forwarding-table 3.3.3.3 32
show ip cef 3.3.3.3 detail

A remote binding without a usable LFIB entry can indicate an IGP next-hop problem. The routing path and the downstream label advertisement must align.

6. Test the complete path

traceroute 3.3.3.3 source Loopback0
traceroute mpls ipv4 3.3.3.3/32

The MPLS traceroute command depends on platform and IOS feature support. In production, avoid unnecessary debug commands because they can generate significant control-plane output.

Why do service providers use MPLS?

Service providers use MPLS because it separates transport forwarding from customer services and supports many isolated VPNs across shared routers and links. It also provides established mechanisms for QoS, resiliency and controlled path selection.

Important use cases include:

Layer 3 VPNs: Separate customer routing tables with VRFs and MP-BGP.
Layer 2 VPNs: Transport Ethernet services such as pseudowires and VPLS.
Scalable cores: Keep customer VPN routes on PE routers rather than every P router.
Traffic engineering: Steer selected traffic over non-default paths when technologies such as RSVP-TE or Segment Routing are deployed.
Fast recovery: Use protection mechanisms designed to reduce disruption after a link or node failure.
QoS: Map service classes into the MPLS Traffic Class field and apply provider policies.

MPLS does not automatically make every packet faster, and it does not remove the need for capacity planning. Its main value is predictable service construction, traffic separation and operational control at provider scale.

Modern networks may use SR-MPLS, where Segment Routing applies MPLS labels without relying on LDP for every transport label. The forwarding plane still uses MPLS label operations, but the control and path-programming model is different.

MPLS summary

MPLS forwards packets through labels associated with FECs. An ingress PE pushes labels, transit routers swap them, and a penultimate or egress router removes them. LSPs are unidirectional, LDP-based paths depend on the IGP, and MPLS VPNs commonly use separate transport and VPN labels.

For practical study, build the three-router lab, break OSPF or LDP deliberately, and identify which verification command reveals the failure first. This method develops the troubleshooting skills expected in advanced routing work.

Reviewed by Network Rhinos networking trainers.

To practise MPLS alongside advanced routing, VPN concepts and structured troubleshooting, enquire about CCNP Enterprise course batch details.

MPLS Explained: Labels, LSPs and Service Provider Use