MPLS

Overview

Overview MPLS (Multiprotocol Label Switching) is a high-performance packet forwarding technology that uses short fixed-length labels instead of long IP address lookups to forward packets. Standardized by the IETF in the early 2000s, MPLS became the backbone technology for service provider networks and enterprise WAN services for over two decades.

In traditional IP routing, each router performs a full IP lookup in the routing table for every packet. MPLS replaces this with label-based forwarding: the ingress Label Edge Router (LER) assigns a label to an incoming packet, and all subsequent Label Switching Routers (LSRs) in the MPLS network forward the packet based solely on the label using a simple table lookup — much faster than full IP routing on older hardware.

Labels are 32-bit values inserted between the Layer 2 header and Layer 3 IP header (the "shim header"). Labels can be stacked, enabling VPN services where an outer label identifies the LSP (Label Switched Path) tunnel and an inner label identifies the VPN instance (VRF).

MPLS enables several critical services: Layer 3 VPNs (RFC 4364) where service providers deliver private IP connectivity between enterprise sites, Layer 2 VPNs (VPLS, VPWS) for transparent Ethernet services, and Traffic Engineering (MPLS-TE) where explicit paths are established using RSVP-TE to guarantee bandwidth and route around congestion.

While MPLS is mature technology being replaced at the edge by SD-WAN, it remains ubiquitous in service provider cores and is still offered as a premium enterprise WAN service. Understanding MPLS VPN architecture is directly applicable to understanding how AWS Direct Connect Virtual Interfaces and Transit VIFs work under the hood.

Key concepts

Label Switching Router (LSR)

An MPLS router that forwards packets based on label lookup rather than IP routing table lookup. The ingress LER (Label Edge Router) pushes a label onto packets entering the MPLS network. Core LSRs swap labels. The egress LER pops the label and delivers the original IP packet to the destination.

LDP (Label Distribution Protocol)

The protocol used by MPLS routers to distribute label bindings for IP prefixes. Each router advertises a label for each prefix in its routing table to its LDP neighbors. LDP creates LSPs that follow the existing IGP routing topology. Simple but cannot engineer specific paths.

RSVP-TE (Resource Reservation Protocol - Traffic Engineering)

A signaling protocol that establishes explicit LSPs along administratively specified paths with reserved bandwidth. Used for MPLS traffic engineering. RSVP-TE enables bandwidth guarantees and explicit route constraints (must traverse specific routers, avoid specific links). Used in service provider cores for QoS guarantees.

MPLS L3VPN (RFC 4364)

The most common MPLS VPN service. Each enterprise VPN uses a VRF (Virtual Routing and Forwarding) instance at the PE (Provider Edge) router. Routes are distributed between PE routers using MP-BGP with VPNv4 address family. An outer label identifies the LSP to the remote PE; an inner label (VPN label) identifies the destination VRF. CE (Customer Edge) routers are unaware of MPLS.

When to use it

• Understanding service provider WAN services offered to enterprise customers
• Designing traffic engineering policies to route around congestion in backbone networks
• Configuring MPLS L3VPN for multi-site enterprise connectivity
• Troubleshooting traceroute behavior that skips hops inside an MPLS cloud
• Evaluating MPLS vs SD-WAN vs direct internet for WAN strategy

Interview questions

• Explain how MPLS L3VPN works end-to-end. How does a packet from a branch office reach another branch in the same VPN?

More Networking topics

• iptables and nftables
• IPv6 Addressing & Dual Stack
• Kubernetes Network Policies
• L4 vs L7 Load Balancing
• Latency Diagnosis
• Load Balancing Algorithms
• mTLS & SPIFFE/SPIRE Workload Identity
• MTU & IP Fragmentation
• NAT & PAT
• Network Chaos Engineering
• Network Debugging Toolkit
• Network Observability & Flow Analysis