# One-Arm Hub-and-Spoke VPN with MPLS/VPN

DevFeed: [One-Arm Hub-and-Spoke VPN with MPLS/VPN](<https://devfeed.tech/articles/one-arm-hub-and-spoke-vpn-with-mpls-vpn-11067.md>)

Original publisher: [Read original article](<https://blog.ipspace.net/2024/09/hub-spoke-one-arm/>)

Published: 2024-09-24T06:15:00Z

Content type: tutorial

Language: en

Sources: [ipSpace.net blog](<https://devfeed.tech/sources/ipspace-net-blog.md>)

Topics: [MPLS VPN](<https://devfeed.tech/topics/mpls-vpn.md>), [Virtual Private Network](<https://devfeed.tech/topics/vpn.md>), [Network](<https://devfeed.tech/topics/network.md>), [Cisco](<https://devfeed.tech/topics/cisco.md>), [evpn](<https://devfeed.tech/topics/evpn.md>), [Routing (disambiguation)](<https://devfeed.tech/topics/routing.md>), [virtual machines](<https://devfeed.tech/topics/virtual-machines.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Ethernet](<https://devfeed.tech/topics/ethernet.md>)

Tags: [bgp](<https://devfeed.tech/tags/bgp.md>), [cisco](<https://devfeed.tech/tags/cisco.md>), [containers](<https://devfeed.tech/tags/containers.md>), [design](<https://devfeed.tech/tags/design.md>), [ethernet](<https://devfeed.tech/tags/ethernet.md>), [evpn](<https://devfeed.tech/tags/evpn.md>), [mpls-vpn](<https://devfeed.tech/tags/mpls-vpn.md>), [netlab](<https://devfeed.tech/tags/netlab.md>), [network](<https://devfeed.tech/tags/network.md>), [ospf](<https://devfeed.tech/tags/ospf.md>), [routing](<https://devfeed.tech/tags/routing.md>), [virtual-machines](<https://devfeed.tech/tags/virtual-machines.md>), [vpn](<https://devfeed.tech/tags/vpn.md>)

## AI overview

This tutorial explains how to build a one-arm hub-and-spoke VPN using MPLS/VPN. It describes a routing approach using common-services VRFs and a default route advertised by the hub, with examples involving Cisco IOS and FRRouting devices.

## Source excerpt

All our previous designs of the hub-and-spoke VPN (single PE, EVPN) used two VRFs for the hub device (ingress VRF and egress VRF). Is it possible to build a one-arm hub-and-spoke VPN where the hub device exchanges traffic with the PE router over a single link? TL&DR: Yes, but only on some devices (for example, Cisco IOS or FRRouting) when using MPLS transport. Here's a high-level diagram of what we'd like to achieve: Read more ...