# One-Arm Hub-and-Spoke VPN on Arista EOS

DevFeed: [One-Arm Hub-and-Spoke VPN on Arista EOS](<https://devfeed.tech/articles/one-arm-hub-and-spoke-vpn-on-arista-eos-11284.md>)

Original publisher: [Read original article](<https://blog.ipspace.net/2025/11/one-arm-hub-spoke-vpn-arista-eos/>)

Published: 2025-11-11T06:28:00Z

Content type: article

Language: en

Sources: [ipSpace.net blog](<https://devfeed.tech/sources/ipspace-net-blog.md>)

Topics: [MPLS VPN](<https://devfeed.tech/topics/mpls-vpn.md>), [networking](<https://devfeed.tech/topics/networking.md>), [IP routing](<https://devfeed.tech/topics/ip-routing.md>), [configuration](<https://devfeed.tech/topics/configuration.md>)

Tags: [blog-post](<https://devfeed.tech/tags/blog-post.md>), [design](<https://devfeed.tech/tags/design.md>), [mpls](<https://devfeed.tech/tags/mpls.md>), [mpls-vpn](<https://devfeed.tech/tags/mpls-vpn.md>), [netlab](<https://devfeed.tech/tags/netlab.md>), [release](<https://devfeed.tech/tags/release.md>), [router](<https://devfeed.tech/tags/router.md>), [routing](<https://devfeed.tech/tags/routing.md>)

## AI overview

This article demonstrates how Arista EOS release 4.34.2F enables a different MPLS label for the default route, allowing one-arm hub-and-spoke VPN traffic to pass through the hub CE router as expected. It also describes updated lab templates and configuration for Arista EOS and FRR.

## Source excerpt

In September 2024, I described how you can build One-Arm Hub-and-Spoke VPN with MPLS/VPN. In that blog post, I mentioned that the solution doesn't work on Arista EOS because it allocates MPLS labels to whole VRFs (per-VRF label allocation) (the original post has been updated). In early September, I received an email from Daniel Blažek telling me that Arista fixed this particular annoyance in the EOS release 4.34.2F. It still uses per-VRF label allocation, but now, you can assign a different label to the default route. Let's see how that works with our one-arm hub-and-spoke topology: Read more ...