← Back to Lab Index
Lab 06 §3.1 Expert ⏱ 75 min

MPLS LDP & L3VPN (VPNv4/VPNv6)

Build a full MPLS L3VPN with LDP label distribution, MP-BGP VPNv4, and multi-protocol PE-CE routing.

Network Topology
MPLS CORE + PE EDGE DMVPN WEST DMVPN EAST CUSTOMER EDGE + BORDER CORE-1 10.255.1.1 CORE-2 10.255.1.2 CORE-3 10.255.1.3 CORE-4 10.255.1.4 EDGE-1 10.255.2.1 EDGE-2 10.255.2.2 EDGE-3 10.255.2.3 EDGE-4 10.255.2.4 HUB-WC-1 172.16.10.254 HUB-WC-2 172.16.10.253 HUB-EC-1 172.16.20.254 HUB-EC-2 172.16.20.253 SPK-WC-1 .10.1 SPK-WC-2 .10.2 SPK-WC-3 .10.3 SPK-EC-1 .20.1 SPK-EC-2 .20.2 SPK-EC-3 .20.3 BORDER-1 10.255.3.1 BORDER-2 10.255.3.2 CE-CORP-1 10.255.6.1 CE-CORP-2 10.255.6.2 P Router (CORE) PE Router (EDGE) DMVPN Hub DMVPN Spoke Border (ASBR) Customer Edge (CE) AS 65000 — OSPF Area 0 — LDP

Prerequisites

Task Sheet — CCIE Exam Format

Task 1Hard
Enable MPLS on all P router (CORE-1 through CORE-4) interfaces. Use 'mpls ldp autoconfig' under OSPF. Set LDP router-id to Loopback0.
✓ Verify: show mpls ldp neighbor
Task 2Medium
Set custom MPLS label range 2000-9999 on all P and PE routers to prevent overlap with reserved labels.
✓ Verify: show mpls label range
Task 3Hard
Configure VRF CORP on EDGE-1 and EDGE-4: RD 65000:100, RT import/export 65000:100. Apply to CE-facing interfaces.
✓ Verify: show ip vrf detail CORP
Task 4Expert
Configure MP-BGP AS 65000 on all PE routers (EDGE-1 through EDGE-4). Use CORE-1 and CORE-2 as Route Reflectors for VPNv4 address-family.
✓ Verify: show bgp vpnv4 unicast all summary
Task 5Hard
Configure PE-CE OSPF (process 10 vrf CORP) on EDGE-1 facing CE-CORP-1. Redistribute BGP into OSPF and vice versa.
✓ Verify: show ip route vrf CORP
Task 6Expert
Verify MPLS path using 'mpls traceroute' between CE-CORP-1 and CE-CORP-2. All hops must show MPLS labels.
✓ Verify: mpls traceroute 10.255.6.2/32

Key Concepts

MPLS L3VPN separates customer traffic using VRFs (Virtual Routing and Forwarding instances) on PE routers. Each VRF has a Route Distinguisher (RD) to make customer prefixes globally unique in MP-BGP, and Route Targets (RT) to control which prefixes are imported/exported between VRFs — enabling both full mesh and hub-and-spoke VPN topologies.

LDP (Label Distribution Protocol) assigns and distributes labels for IP prefixes in the MPLS domain. Each LSR (Label Switch Router) builds a Label Forwarding Information Base (LFIB) mapping incoming labels to outgoing labels and interfaces. The outermost label (transport) is popped at the penultimate router (PHP) before delivering to PE, leaving only the VPN label.

MP-BGP carries VPNv4 routes (RD + IPv4 prefix) with extended community attributes (Route Targets). PE routers are iBGP peers; Route Reflectors eliminate the need for full iBGP mesh. The VPN label carried in MP-BGP tells the egress PE which VRF to deliver the packet to.

Verification Commands

show mpls ldp neighbor
All LDP sessions: Oper — between all P and PE routers
show mpls forwarding-table
Label bindings for all loopback /32 routes
show bgp vpnv4 unicast all summary
All PE neighbors: established, prefixes received > 0
show ip route vrf CORP
CE-CORP-2 prefix reachable via BGP label path

Common Mistakes & Troubleshooting

LDP session not forming

LDP uses TCP port 646. Verify OSPF adjacency is up first (LDP needs IGP reachability to peer). Check 'show mpls ldp discovery' — if no neighbors found, check multicast 224.0.0.2 reachability.

VPNv4 routes not in VRF routing table

Check RT import/export match between PE routers. Use 'show bgp vpnv4 unicast all' to see if routes are received but filtered. Verify 'send-community both' is configured for VPNv4 neighbors.

MPLS traceroute shows '!' instead of labels

PHP (penultimate hop popping) removes the transport label one hop before PE — this is normal. If ALL hops show '!', MPLS is not forwarding — check 'show mpls interfaces'.

Solution Configs

Attempt the tasks yourself before viewing solutions.
Type SOLUTION to unlock.

CORE-1 (P Router)

! See solution-configs/CORE-1.cfg

EDGE-1 (PE Router)

! See solution-configs/EDGE-1.cfg
Study Timer
45:00
CCIE EI v1.0 Blueprint: §3.1  ·  ← All Labs  ·  Independent study resource. Not affiliated with Cisco Systems, Inc.
⬇ Initial Configs — Load These to Start the Lab
⬇ CORE-1-initial.cfg ⬇ CORE-2-initial.cfg ⬇ EDGE-1-initial.cfg
Solution Configs — Reveal After Completing Tasks
⬇ CORE-1.cfg ⬇ EDGE-1.cfg

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.