Cisco IOS XRConfig1 downloads

Cisco IOS XR MPLS L3VPN (PE Router)

Full MPLS L3VPN PE configuration for IOS XR: VRF definitions, LDP, MP-BGP VPNv4, and CE peering. The flagship SP service on ASR 9000 and NCS 5500.

↓ example.txt

What is it?

MPLS L3VPN (Layer 3 Virtual Private Network) is the dominant technology for providing IP VPN services over a service provider MPLS backbone. On IOS XR PE routers, each customer gets a dedicated VRF instance that completely separates their routing table. The PE router uses MP-BGP with the VPNv4 address family to exchange customer routes between PE routers, using Route Distinguishers to make routes unique and Route Targets to control VRF route import/export. LDP provides the label-switched path through the MPLS core, while the PE-CE link uses BGP, OSPF, or static routing. IOS XR is the primary platform for MPLS L3VPN in production SP networks worldwide.

When to use

·Service provider offering Layer 3 VPN connectivity to enterprise customers over an MPLS backbone
·Enterprises with multiple sites needing full-mesh or hub-spoke Layer 3 VPN
·When customers need traffic isolation with separate routing tables and potentially overlapping IP space
·Any network using Cisco ASR 9000 or NCS 5500 as PE routers in an MPLS core
·When per-customer QoS policies, separate routing tables, and VPN service SLAs are required

When NOT to use

·Simple campus or enterprise networks without MPLS core â€” use VRF-lite instead
·Networks without LDP or Segment Routing across all P routers â€” MPLS forwarding plane is required
·When SD-WAN is deployed as the overlay â€” SD-WAN replaces the PE-CE BGP model with tunnel-based connectivity

How it compares

vs MPLS L2VPN (VPLS/EVPN)L3VPN provides routed connectivity â€” the SP participates in customer routing. L2VPN provides a transparent Layer 2 service. L3VPN is simpler for most enterprise use cases; L2VPN is needed when customers require bridged connectivity.

vs IPsec VPNIPsec is an encrypted overlay over the internet, ideal for remote access. MPLS L3VPN runs over a private backbone with QoS guarantees and no encryption overhead. MPLS is preferred for predictable latency and bandwidth guarantees.

vs SD-WANSD-WAN uses encrypted tunnels over any underlay (internet, MPLS, LTE) with centralized control. MPLS L3VPN is the traditional carrier service. Many enterprises use SD-WAN on top of MPLS as the transport underlay.

Prerequisites

→MPLS LDP or Segment Routing must be running on all P and PE routers with OSPF/IS-IS providing loopback reachability
→iBGP full mesh or route reflectors must be configured for VPNv4 routes to propagate between all PEs
→VRF and Route Target design must be planned before configuration â€” RT import/export determines customer connectivity
→IOS XR requires commit after all changes â€” stage VRF, LDP, and BGP configuration as a single commit

Config Generator

Hostname *

Local AS Number *

PE Loopback0 IP (Router ID) *

Route Reflector Neighbors

LDP-enabled Interfaces (core P links)

VRF Definitions (one per customer)

Verification commands

show mpls ldp neighbor

Verify LDP sessions are Operational to all P and PE neighbors

ExpectedAll core neighbors show LDP state Oper (Operational)

show bgp vpnv4 unicast summary

Verify MP-BGP VPNv4 sessions to route reflectors are established

ExpectedAll RR neighbors show Established with non-zero VPNv4 prefixes

show bgp vrf <vrf-name> summary

Verify CE BGP session state for a specific customer VRF

ExpectedCE neighbor in Established state with prefixes received

show route vrf <vrf-name>

Verify customer routes in the VRF routing table

ExpectedLocal CE routes and remote PE-learned routes marked B visible in the VRF

Debug commands

show mpls forwarding

Verify MPLS label forwarding table for VPN labels

WarningCheck that VPN label entries exist for remote PE loopbacks with correct outgoing labels

show bgp vrf <vrf-name> <prefix>

Show detailed BGP path for a specific VPN prefix including RT and label

WarningVerify RT import matches, next-hop is reachable, and label is assigned

Common mistakes & fixes

SymptomVRF routes not propagating between PE routers

CauseRoute-target mismatch â€” import RT on receiving PE does not match export RT on sending PE

FixVerify RT with show bgp vrf <name> <prefix> on receiving PE. Confirm import/export RT values match across all PEs for that VPN.

SymptomLDP session not establishing with P router

CauseLDP not enabled on the correct interface, or OSPF not advertising the loopback used as LDP router-id

FixVerify show mpls ldp neighbor and show ospf interface brief. LDP uses loopback0 by default â€” ensure it is reachable via OSPF.

SymptomCE BGP session established but no routes imported to PE

CauseMissing import route-target in VRF, or PE not redistributing CE BGP routes into VPNv4

FixVerify VRF RT import with show vrf <name> detail. Check show bgp vrf <name> for prefix count and RT values.

Further learning

Recommended books to go deeper on this topic.

MPLS Fundamentals

Luc De Ghein · Cisco Press · Label switching, LDP, RSVP, L3VPN VRF, PE-CE routing — the MPLS bible

Hardcover ↗

Routing TCP/IP, Volume 2

Jeff Doyle · Cisco Press · BGP as PE-CE protocol in MPLS L3VPN environments

Kindle ↗Hardcover ↗