JuniperConfig312 downloads

Juniper JunOS MPLS L3VPN

MPLS L3VPN configuration for Juniper MX routers: LDP or RSVP label distribution, VRF instances with PE-CE routing (BGP/OSPF/static), and VPNv4 route reflectors.

↓ example.txt

What is it?

MPLS L3VPN (RFC 4364) allows a service provider to carry multiple customers' IP traffic over a shared MPLS backbone, with full separation between customers. Each customer gets a VRF (Virtual Routing and Forwarding instance) on each PE (Provider Edge) router. Route Distinguishers (RD) make customer routes unique in the BGP VPNv4 table. Route Targets (RT) control which VRFs import/export routes to each other — they implement the VPN topology (hub-and-spoke, any-to-any, extranet). BGP with the VPNv4 address family carries customer routes between PE routers.

When to use

·Service provider offering managed L3 VPN service to enterprise customers
·Large enterprise with multiple business units that need isolated routing but shared infrastructure
·Connecting multiple data centers with full routing isolation between tenants
·Any scenario requiring multiple isolated routing tables over shared MPLS infrastructure

When NOT to use

·Simple site-to-site connectivity — IPSec VPN is simpler
·If MPLS is not available end-to-end — MPLS L3VPN requires MPLS labels throughout the core

How it compares

vs IPSec VPNIPSec encrypts traffic between two points. MPLS L3VPN provides routing isolation without encryption — traffic is labeled not encrypted. MPLS L3VPN scales to thousands of customers on shared infrastructure; IPSec does not.

vs VXLAN EVPNVXLAN EVPN is the data center equivalent of MPLS L3VPN — it uses VXLAN encapsulation instead of MPLS labels. MPLS L3VPN is the SP standard; VXLAN EVPN is the DC standard.

Prerequisites

→MPLS must be running in the core (LDP or RSVP for label distribution)
→BGP with VPNv4 address family must be configured between all PE routers (or via route reflectors)
→IGP (OSPF or IS-IS) must be running in the core so PE loopbacks are reachable
→Route Distinguishers and Route Targets must be planned and allocated before configuration

Config Generator

Hostname *

Router ID *

Local AS *

Label Distribution

Core (P-facing) Interfaces

VPNv4 Route Reflector Peers (iBGP)

VRF Instances (per tenant)

Verification commands

show bgp summary

Verify BGP sessions with route reflectors and PE peers are Established

ExpectedAll PE-to-RR sessions 'Establ' with non-zero VPNv4 prefixes

show route table <vrf-name>.inet.0

Show routes in a specific VRF routing table

ExpectedLists customer routes with next-hop PE loopback and MPLS label

show mpls lsp

Verify MPLS label-switched paths are established between PEs

ExpectedLSPs to all remote PE loopbacks should show 'Up' state

Debug commands

show route table bgp.l3vpn.0

Show the BGP VPNv4 table with all received VPN routes before VRF import

Common mistakes & fixes

SymptomCustomer routes not appearing in VRF routing table

CauseRoute Target mismatch — VRF import RT doesn't match the export RT on the remote PE

FixVerify import and export RT communities match: 'show route table bgp.l3vpn.0' to see all VPN routes and their RT communities. Fix VRF import policy to match the correct RT.

SymptomMPLS label lookup failure — traffic black-holed

CauseLDP or RSVP not establishing LSP to remote PE loopback

FixCheck 'show mpls lsp' — verify LSP to remote PE exists. Check 'show ldp neighbor' or 'show rsvp session'. Verify IGP has a route to the remote PE loopback.

Further learning

Recommended books to go deeper on this topic.

MPLS Fundamentals

Luc De Ghein · Cisco Press · Label switching, LDP, RSVP, L3VPN VRF, PE-CE routing — the MPLS bible

Hardcover ↗

Routing TCP/IP, Volume 2

Jeff Doyle · Cisco Press · BGP as PE-CE protocol in MPLS L3VPN environments

Kindle ↗Hardcover ↗