# MPLS VPN MPLS VPN is a virtual private network architecture that uses Multiprotocol Label Switching to connect sites across a provider core network. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## MPLS/VPN with SR-MPLS Core DevFeed: [MPLS/VPN with SR-MPLS Core]() Original publisher: [Read original article]() Published: 2026-09-15T05:45:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [SR-MPLS](), [MPLS VPN](), [networking](), [BGP](), [IS-IS](), [Network](), [GitHub]() Tags: [bgp](), [devices](), [github](), [is-is](), [mpls](), [mpls-vpn](), [netlab](), [sr-mpls](), [vpn]() ### AI overview This article explains how to build and test an MPLS/VPN service over an SR-MPLS core. It describes the required lab topology changes, including enabling MPLS/VPN, disabling LDP, configuring PE routers with IS-IS, SR-MPLS, BGP, MPLS, and VRF modules, and moving PE-to-host links into tenant VRFs. It also outlines how to run the lab using GitHub Codespaces, an Arista cEOS container, and netlab. ### Source excerpt As we discussed in the BGP-Free Core with SR-MPLS blog post, SR-MPLS works as a drop-in replacement for the traditional MPLS control plane. No wonder it works well (when properly implemented) with MPLS/VPN services - the second "fun" scenario in my ITNOG10 Segment Routing workshop. It uses the same topology as the BGP-Free Core scenario: Simplest possible MPLS/VPN network with SR-MPLS core Read more ... ## netlab 26.06: OSPFv3 on FortiOS, MPLS/VPN on SR Linux DevFeed: [netlab 26.06: OSPFv3 on FortiOS, MPLS/VPN on SR Linux]() Original publisher: [Read original article]() Published: 2026-06-08T06:13:00Z Content type: release Language: en Sources: [ipSpace.net blog]() Topics: [MPLS VPN](), [Ubuntu](), [Vagrant](), [Script]() Tags: [bugs](), [getting-started](), [github](), [guide](), [improvements](), [installation](), [mpls-vpn](), [netlab](), [release](), [ubuntu](), [upgrade](), [vagrant]() ### AI overview The netlab 26.06 release adds OSPFv3 support on FortiOS and MPLS/VPN support on SR Linux. It also updates installation compatibility for Ubuntu 26.04, includes Vagrant 2.4.9, and contains other improvements and bug fixes. ### Source excerpt netlab release 26.06 adds OSPFv3 support on FortiOS (by @a-v-popov) and MPLS/VPN support on SR Linux. We also ensured the installation scripts work on Ubuntu 26.04 (everything else was OK) and updated the installed Vagrant version to 2.4.9 (we're not using new Vagrant features; you don't have to upgrade it in an existing installation). Other than that, we added a few improvements and squashed a number of bugs. Upgrading or Starting from Scratch? To upgrade your netlab installation, execute pip3 install --upgrade networklab. New to netlab? Start with the Getting Started document and the installation guide. Need help? Open a discussion or an issue in netlab GitHub repository. ## SR Linux MPLS/VPN Configuration Notes DevFeed: [SR Linux MPLS/VPN Configuration Notes]() Original publisher: [Read original article]() Published: 2026-05-27T05:57:00Z Content type: tutorial Language: en Sources: [ipSpace.net blog]() Topics: [MPLS VPN](), [configuration](), [BGP](), [Network](), [evpn]() Tags: [bgp](), [configuration](), [evpn](), [how-to](), [mpls-vpn](), [netlab]() ### AI overview The article documents troubleshooting SR Linux MPLS/VPN configuration in netlab. It explains that a dynamic MPLS label block and L3VPN BGP address-family configuration are required, and notes that route distinguishers and route targets may need explicit configuration instead of relying on EVPN-derived values. ### Source excerpt After fixing the SR Linux LDP configuration template, I decided to add MPLS/VPN to the netlab SR Linux MPLS features. After all, the one-page recipe seemed simple enough, more so as we already have tested VRF and EVPN templates. Alas, nothing is as simple as it looks. There were two details that tripped me pretty badly. Read more ... ## netlab 26.03: EVPN/MPLS, IOS XR Features DevFeed: [netlab 26.03: EVPN/MPLS, IOS XR Features]() Original publisher: [Read original article]() Published: 2026-03-10T08:11:00Z Content type: release Language: en Sources: [ipSpace.net blog]() Topics: [releases](), [Release notes](), [evpn](), [BGP](), [MPLS VPN](), [SR-MPLS](), [Cisco](), [networking](), [VXLAN]() Tags: [bgp](), [cisco](), [evpn](), [getting-started](), [github](), [guide](), [improvements](), [installation](), [issue](), [mpls](), [mpls-vpn](), [netlab](), [open](), [release](), [release-notes](), [routing](), [sr-mpls](), [vxlan]() ### AI overview The netlab 26.03 release adds Cisco IOS XR capabilities, Juniper cRPD support, EVPN/VXLAN support on Juniper platforms, OpenBSD BGP support, SR-MPLS support for OSPFv2, and EVPN/MPLS improvements. ### Source excerpt netlab release 26.03 is out. Here are the highlights: New Cisco IOS XR features: SR-MPLS, MPLS/VPN, MPLS 6PE, EVPN over MPLS, VRRP, BGP session parameters, routing policies, prefix filters, AS-path filters, community filters, and static routes Juniper cRPD support (mostly by @leec-666) EVPN/VXLAN on Juniper vPTX and vJunos-router by @rickycraft OpenBSD BGP support by @remilocherer SR-MPLS support for OSPFv2 on EOS, FRR, IOS XE, IOS XR EVPN/MPLS improvements, including using SR-MPLS transport For even more details, check the release notes. Read more ... ## netlab: Using L3VPN (MPLS/VPN) with SR-MPLS Core DevFeed: [netlab: Using L3VPN (MPLS/VPN) with SR-MPLS Core]() Original publisher: [Read original article]() Published: 2026-03-02T10:39:01Z Content type: tutorial Language: en Sources: [ipSpace.net blog]() Topics: [MPLS VPN](), [SR-MPLS](), [BGP](), [Containers](), [IS-IS](), [Linux](), [GitHub]() Tags: [bgp](), [containers](), [github](), [is-is](), [linux](), [mpls](), [mpls-vpn](), [netlab](), [sr-mpls]() ### AI overview This tutorial shows how to use netlab to build an MPLS/VPN lab with an SR-MPLS core. It describes a topology using Arista EOS cEOS containers, Linux containers, FRRouting containers, IS-IS, BGP, MPLS, SR-MPLS, and VRFs, and explains how to start the lab in a Linux VM, Windows Subsystem for Linux, a Mac with Apple Silicon, or GitHub Codespaces. ### Source excerpt Someone recently asked me whether it's possible to use netlab to build an MPLS/VPN (technically, BGP/MPLS IP VPN) lab with SR-MPLS core. Of course, let's build a simple lab using Arista EOS and Linux containers to implement this topology: Lab topology Here's the lab topology we'll use (also available on GitHub): Read more ... ## One-Arm Hub-and-Spoke VPN on Arista EOS DevFeed: [One-Arm Hub-and-Spoke VPN on Arista EOS]() Original publisher: [Read original article]() Published: 2025-11-11T06:28:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [MPLS VPN](), [networking](), [IP routing](), [configuration]() Tags: [blog-post](), [design](), [mpls](), [mpls-vpn](), [netlab](), [release](), [router](), [routing]() ### AI overview This article demonstrates how Arista EOS release 4.34.2F enables a different MPLS label for the default route, allowing one-arm hub-and-spoke VPN traffic to pass through the hub CE router as expected. It also describes updated lab templates and configuration for Arista EOS and FRR. ### Source excerpt In September 2024, I described how you can build One-Arm Hub-and-Spoke VPN with MPLS/VPN. In that blog post, I mentioned that the solution doesn't work on Arista EOS because it allocates MPLS labels to whole VRFs (per-VRF label allocation) (the original post has been updated). In early September, I received an email from Daniel Blažek telling me that Arista fixed this particular annoyance in the EOS release 4.34.2F. It still uses per-VRF label allocation, but now, you can assign a different label to the default route. Let's see how that works with our one-arm hub-and-spoke topology: Read more ... ## netlab 25.06: Fixing Nokia SR-OS Configuration Templates DevFeed: [netlab 25.06: Fixing Nokia SR-OS Configuration Templates]() Original publisher: [Read original article]() Published: 2025-06-16T07:23:00Z Content type: release Language: en Sources: [ipSpace.net blog]() Topics: [configuration](), [networking](), [BGP](), [evpn](), [IS-IS](), [MPLS VPN]() Tags: [bgp](), [configuration](), [evpn](), [mpls-vpn](), [netlab](), [new-features](), [ospf](), [release](), [routing](), [vxlan]() ### AI overview The netlab 25.06 release changes release numbering to a YY.MM scheme and adds support for blackhole static routes, static-route redistribution, and link aggregation. It also fixes Nokia SR-OS configuration templates and adds features for VXLAN, EVPN, MPLS/VPN, routing protocols, and inter-VRF route leaking. ### Source excerpt TL&DR: netlab release 25.06 was published last week. Before discussing the new features, let's walk the elephant out of the room: I changed the release versions to YY.MM scheme, so I will never again have to waste my time on the existential question of which number in the release specification to increase. Now for the new features: Read more ... ## BGP PIC Edge Requires Per-Prefix or Per-CE VPN Labels DevFeed: [BGP PIC Edge Requires Per-Prefix or Per-CE VPN Labels]() Original publisher: [Read original article]() Published: 2024-12-04T08:09:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [BGP](), [MPLS VPN](), [Network]() Tags: [bgp](), [blog-post](), [ip-routing](), [mpls](), [mpls-vpn](), [network]() ### AI overview This blog post explains how BGP PIC Edge is intended to switch traffic to a backup PE-CE path before full network convergence. It argues that the mechanism needs per-prefix or per-CE VPN labels; per-VRF labels would create a temporary micro-loop. ### Source excerpt This blog post discusses an old arcane question that has been nagging me from the bottom of my Inbox for almost exactly four years. Please skip it if it sounds like Latin to you, but if you happen to be one of those readers who know what I'm talking about, I'd appreciate your comments. Terminology first: Prefix Independent Convergence allows entries in the forwarding table to point to shared next hops (or next-hop groups), reducing the FIB update bottleneck when changing the next hop for a large number of prefixes (for example, when dealing with a core link failure). More details in the initial blog post and PIC applicability to fast reroute. PIC Edge (as defined by vendor marketing) is the ability to switch to a backup CE route advertised to a backup PE router before the network convergence is complete. Here's (in a nutshell) how PIC Edge is supposed to work: Read more ... ## Running Routing Protocols over Tunnels DevFeed: [Running Routing Protocols over Tunnels]() Original publisher: [Read original article]() Published: 2024-11-05T07:14:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [networking](), [Routing (disambiguation)](), [Protocol (disambiguation)](), [BGP](), [IS-IS](), [MPLS-TE](), [MPLS VPN](), [evpn](), [VXLAN](), [Reason]() Tags: [bgp](), [evpn](), [ip-routing](), [is-is](), [mpls](), [mpls-te](), [ospf](), [protocol](), [recursion](), [routing](), [vxlan]() ### AI overview This article explains why routing protocols over tunnels can cause recursive routing and infinite encapsulation. It distinguishes traffic-engineering and IPsec tunnels from VPN designs, where routing protocols exchange customer and transport prefixes using separated address spaces or families. ### Source excerpt James got confused by a statement made by Hannes Gredler in his IS-IS book: Things behave really badly if the total IGP cost over the tunnel undermines the total topologies' cost. What happens next is that the tunnel "wraps" around itself, ultimately causing a meltdown of the entire network. Let's unpack that, starting with "Why would you need a tunnel?" Read more ... ## Per-Prefix and Per-VRF MPLS/VPN and EVPN Labels/VNIs DevFeed: [Per-Prefix and Per-VRF MPLS/VPN and EVPN Labels/VNIs]() Original publisher: [Read original article]() Published: 2024-10-23T06:38:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [MPLS VPN](), [networking](), [evpn](), [VXLAN]() Tags: [evpn](), [mpls](), [mpls-vpn](), [networking](), [vxlan]() ### AI overview This article explains per-prefix, per-VRF, and per-next-hop label allocation for MPLS/VPN and EVPN. It describes how allocation differs between MPLS and VXLAN data planes and identifies scenarios where per-prefix labels are required or per-VRF labels may be useful. ### Source excerpt Long, long time ago1, in an ancient town far, far away2, an old-school networking Jedi3 was driving us toward a convent4 where we had an SDN workshop5. While we were stuck in the morning traffic jam, an enthusiastic engineer sitting beside me wanted to know my opinion about per-prefix and per-VRF MPLS/VPN label allocation. At that time, I had lived in a comfortable Cisco IOS bubble for way too long, so my answer was along the lines of "Say what???" Nicola Modena6 quickly expanded my horizons, and I said, "Gee, I have to write a blog post about that!" As you can see, it took me over a decade. Read more ... ## One-Arm Hub-and-Spoke VPN with MPLS/VPN DevFeed: [One-Arm Hub-and-Spoke VPN with MPLS/VPN]() Original publisher: [Read original article]() Published: 2024-09-24T06:15:00Z Content type: tutorial Language: en Sources: [ipSpace.net blog]() Topics: [MPLS VPN](), [Virtual Private Network](), [Network](), [Cisco](), [evpn](), [Routing (disambiguation)](), [virtual machines](), [Containers](), [Ethernet]() Tags: [bgp](), [cisco](), [containers](), [design](), [ethernet](), [evpn](), [mpls-vpn](), [netlab](), [network](), [ospf](), [routing](), [virtual-machines](), [vpn]() ### AI overview This tutorial explains how to build a one-arm hub-and-spoke VPN using MPLS/VPN. It describes a routing approach using common-services VRFs and a default route advertised by the hub, with examples involving Cisco IOS and FRRouting devices. ### Source excerpt All our previous designs of the hub-and-spoke VPN (single PE, EVPN) used two VRFs for the hub device (ingress VRF and egress VRF). Is it possible to build a one-arm hub-and-spoke VPN where the hub device exchanges traffic with the PE router over a single link? TL&DR: Yes, but only on some devices (for example, Cisco IOS or FRRouting) when using MPLS transport. Here's a high-level diagram of what we'd like to achieve: Read more ... ## Hub-and-Spoke VPN Topology DevFeed: [Hub-and-Spoke VPN Topology]() Original publisher: [Read original article]() Published: 2024-09-16T06:24:00Z Content type: tutorial Language: en Sources: [ipSpace.net blog]() Topics: [MPLS VPN](), [networking](), [Firewall](), [Routing (disambiguation)](), [BGP](), [evpn]() Tags: [bgp](), [design](), [evpn](), [firewall](), [mpls-vpn](), [network](), [ospf](), [routing]() ### AI overview This article examines hub-and-spoke VPN topology in MPLS/VPN and EVPN networks, focusing on routing traffic through a central firewall. It explains VRF separation, route propagation and leaking, firewall interface designs, stateful inspection challenges, and routing protocol considerations. ### Source excerpt Hub-and-spoke topology is by far the most complex topology I've ever encountered in the MPLS/VPN (and now EVPN) world. It's used when you want to push all the traffic between sites attached to a VPN (spokes) through a central site (hub), for example, when using a central firewall. You get the following diagram when you model the traffic flow requirements with VRFs. The forward traffic uses light yellow arrows, and the return traffic uses dark orange ones. Read more ... ## BGP, EVPN, VXLAN, or SRv6? DevFeed: [BGP, EVPN, VXLAN, or SRv6?]() Original publisher: [Read original article]() Published: 2024-07-25T05:55:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [networking](), [Routing (disambiguation)](), [BGP](), [evpn](), [SRv6](), [MPLS VPN](), [SR-MPLS](), [Virtual Private Network](), [VXLAN]() Tags: [bgp](), [evpn](), [mpls-vpn](), [protocol](), [routing](), [sr-mpls](), [srv6](), [vpn](), [vxlan]() ### AI overview This article explains how to choose among BGP, EVPN, VXLAN, MPLS VPN, SR-MPLS, and SRv6 based on network requirements. It distinguishes ordinary hop-by-hop IP forwarding from traffic engineering and from multiple forwarding domains such as L2VPNs and L3VPNs. ### Source excerpt Daniel Dib asked an interesting question on LinkedIn when considering an RT5-only EVPN design: I'm curious what EVPN provides if all you need is L3. For example, you could run pure L3 BGP fabric if you don't need VRFs or a limited amount of them. If many VRFs are needed, there is MPLS/VPN, SR-MPLS, and SRv6. I received a similar question numerous times in my previous life as a consultant. It's usually caused by vendor marketing polluting PowerPoint slide decks with acronyms without explaining the fundamentals1. Let's fix that. Read more ... ## Again: What Exactly Is MPLS? DevFeed: [Again: What Exactly Is MPLS?]() Original publisher: [Read original article]() Published: 2024-07-11T05:26:00Z Content type: opinion Language: en Sources: [ipSpace.net blog]() Topics: [Software-defined networking](), [MPLS VPN](), [networking](), [SD-WAN](), [Routing (disambiguation)]() Tags: [analysis](), [blog-post](), [mpls](), [mpls-vpn](), [network](), [routing](), [sd-wan](), [traffic-engineering](), [vpn]() ### AI overview This opinion piece distinguishes MPLS as a data-plane encapsulation supported by control-plane protocols from MPLS/VPN services commonly offered by service providers. It argues that cheaper public Internet, rather than a shift toward cloud computing alone, drove the decline of MPLS/VPN services, while noting that MPLS remains in use for several networking applications. ### Source excerpt Brad Casemore published an interesting analysis explaining why Cisco should accept being a mature company with mature products (yeah, you have to subscribe to view it). I always loved reading his articles, but unfortunately, this time, he briefly ventured into the "I don't think this word means what you think it means" territory: MPLS worked - and it still works - but it provided optimal value in an earlier time when the center of gravity was not the cloud. The cloud challenged the efficacy of MPLS, and it wasn't long before SD-WAN, cloud connects, and interconnects [...] represented an implacable threat to a status quo that had once seemed unassailable. The second part of the paragraph is (almost) true, but it had nothing to do with MPLS. Read more ... ## netlab: Global and Node VRFs DevFeed: [netlab: Global and Node VRFs]() Original publisher: [Read original article]() Published: 2024-04-29T06:37:00Z Content type: tutorial Language: en Sources: [ipSpace.net blog]() Topics: [configuration](), [MPLS VPN](), [evpn]() Tags: [configuration](), [evpn](), [mpls-vpn](), [netlab](), [route]() ### AI overview This tutorial explains how netlab handles global and node VRFs, including how it assigns and propagates IDs, route distinguishers, and route targets. It concludes that node VRFs should generally be used only when necessary because identically named node VRFs can receive different values and fail to work as intended in MPLS/VPN or EVPN environments. ### Source excerpt When designing the netlab VRF configuration module, I tried to make it as flexible as possible while using the minimum number of awkward nerd knobs. As is often the case1, the results could be hard to grasp, so let's walk through the various scenarios of using global and node VRFs. netlab allows you to define a VRF in the lab topology vrfs dictionary (global VRF) or in a node vrfs dictionary (node VRF). In most cases, you'd define a few global VRFs and move on. Read more ... ## BGP AS Numbers for a Private MPLS/VPN Backbone DevFeed: [BGP AS Numbers for a Private MPLS/VPN Backbone]() Original publisher: [Read original article]() Published: 2024-03-13T07:30:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [BGP](), [MPLS VPN](), [Virtual Private Network](), [Firewall](), [Internet]() Tags: [bgp](), [design](), [firewall](), [internet](), [mpls-vpn](), [vpn]() ### AI overview The article explains how to choose public or private AS numbers for a private MPLS/VPN backbone. It recommends using a private ASN when edge eBGP sessions connect the backbone to external ISPs, removing the private ASN from the public AS path, and assigning unique private ASNs to sites rather than VPNs. ### Source excerpt One of my readers was building a private MPLS/VPN backbone and wondered whether they should use their public AS number or a private AS number for the backbone. Usually, it doesn't matter; the deciding point was the way they want to connect to the public Internet: We also plan to peer with multiple external ISPs to advertise our public IP space not directly from our PE routers but from dedicated Internet Routers, adding a firewall between our PEs and external Internet routers. They could either run BGP between the PE routers, firewall, and WAN routers (see BGP as High-Availability Protocol for more details) or run BGP across a bump-in-the-wire firewall: Read more ...