Skip to content
Log in Sign up My account

2.1 MPLS Operations

Blueprint 2.1: Describe MPLS operations

  • Label switch routers (LSR) and their roles: ingress, transit, egress, P and PE
  • Label Distribution Protocol (LDP): discovery, sessions, label advertisement
  • Label switching: push, swap and pop, and penultimate hop popping (PHP)
  • Label switched paths (LSP) and the tables behind them: LIB and LFIB

The verb is describe, so the exam tests how MPLS works more than how to type it. Expect questions that show show mpls forwarding-table or show mpls ldp neighbor output and ask what a router does with a labeled packet, which label a router advertises, or why an LDP session is missing. You still need the few configuration commands, because MPLS is the transport underneath the L3VPN objective, and sim items can include a core where LDP is broken.

Why MPLS exists

A plain IP router makes a forwarding decision at every hop by looking up the destination address in the FIB. MPLS adds a short fixed-length label in front of the IP header. Routers in the core forward on that label instead of the IP destination. Today the speed argument is gone (CEF lookups are fast), but the label gives three things IP forwarding cannot:

  • A BGP-free core. Only the edge routers need customer or Internet routes. The core only needs routes and labels to reach the edge routers' loopbacks.
  • Services stacked on labels. A second label can identify a VPN (L3VPN, objective 2.2), a pseudowire (L2VPN) or a traffic engineering path.
  • Overlapping addresses. Because the core never looks at the customer IP header, two customers can use the same private prefixes.

Terminology

Term Meaning
LSR (label switch router) Any router that forwards on labels. Every MPLS router is an LSR.
Edge LSR / LER An LSR at the edge of the MPLS domain that adds labels to IP packets (ingress) or removes them (egress).
Ingress LSR Receives an unlabeled IP packet and pushes a label.
Transit (intermediate) LSR Receives a labeled packet and swaps the top label.
Egress LSR The last LSR of the path, where the packet leaves the MPLS domain.
P router Provider core router. In service provider terms, a transit LSR that has no customer interfaces.
PE router Provider edge router. Connects to customer CE routers and is an edge LSR.
CE router Customer edge router. Does not run MPLS.
FEC (forwarding equivalence class) A group of packets forwarded the same way along the same path. With LDP, one FEC is one IGP prefix.
LSP (label switched path) The sequence of LSRs a labeled packet follows for one FEC. LSPs are unidirectional.

The P and PE names come from the provider VPN model and are what you see on the exam diagrams. A PE is always an edge LSR; a P is always a transit LSR.

The label

An MPLS label is a 4-byte "shim" header placed between the Layer 2 header and the IP header. Ethernet signals it with EtherType 0x8847 for unicast MPLS.

Field Bits Purpose
Label 20 The label value. 0 to 15 are reserved.
TC (formerly EXP) 3 Traffic class, used for QoS.
S (bottom of stack) 1 Set to 1 on the last label in the stack.
TTL 8 Time to live, copied from the IP header by default.

Several labels can be stacked. Each adds 4 bytes, so two labels (the normal L3VPN case) add 8 bytes. That is why MTU problems are common in MPLS cores.

Reserved labels you should know:

Label Name Meaning
0 IPv4 explicit null Keep a label on the last hop, so TC bits reach the egress. The egress pops it.
1 Router alert Send the packet to the control plane of each LSR.
2 IPv6 explicit null Same as 0, for IPv6.
3 Implicit null Advertised but never placed in a packet. Tells the upstream LSR to pop.

IOS allocates its own local labels from 16 upward.

Control plane and data plane

MPLS builds on the normal IP tables and adds two of its own.

Plane IP table MPLS table What it holds
Control RIB (show ip route) LIB (show mpls ldp bindings) Every label binding: the local label for each prefix plus every label each LDP neighbor advertised for it
Data FIB (show ip cef) LFIB (show mpls forwarding-table) Only the bindings in use: local label in, outgoing label and next hop out

The LFIB is built by combining the LIB with the RIB. For each prefix, the router looks up the IGP next hop in the RIB, then takes the label that that next-hop neighbor advertised. Labels learned from other neighbors stay in the LIB, unused, ready in case the IGP path changes.

graph LR
  IGP["IGP (OSPF, EIGRP, IS-IS)"] --> RIB["RIB"]
  LDP["LDP sessions"] --> LIB["LIB<br/>all bindings"]
  RIB --> FIB["FIB (CEF)<br/>push label on IP packets"]
  LIB --> FIB
  RIB --> LFIB["LFIB<br/>swap or pop on labeled packets"]
  LIB --> LFIB

CEF is mandatory for MPLS. If ip cef is disabled, MPLS forwarding does not work.

Exam trap

The FIB and the LFIB do different jobs. An unlabeled IP packet arriving at the ingress LSR is looked up in the FIB, which tells the router which label to push. A labeled packet is looked up in the LFIB by its incoming label. Questions that ask "which table does the ingress PE use to impose the label" want the FIB (CEF).

Label switching step by step

graph LR
  CE1["CE1"] -- "IP" --> PE1["PE1 ingress<br/>PUSH 19"]
  PE1 -- "label 19" --> P1["P1<br/>SWAP 19 to 18"]
  P1 -- "label 18" --> P2["P2 penultimate<br/>POP"]
  P2 -- "IP" --> PE2["PE2 egress<br/>IP lookup"]
  PE2 -- "IP" --> CE2["CE2"]
  1. Push (imposition). PE1 receives an IP packet. Its FIB entry for the destination says "push label 19, send to P1".
  2. Swap. P1 looks up incoming label 19 in its LFIB, replaces it with 18 (the label P2 advertised), and sends it to P2.
  3. Pop (disposition). P2 looks up label 18. The outgoing label is "Pop Label", because PE2 advertised implicit null. P2 removes the label and sends a plain IP packet to PE2.
  4. IP lookup. PE2 receives an unlabeled packet and routes it normally.

Penultimate hop popping (PHP)

Without PHP, the egress LSR would do two lookups: one in the LFIB to find that the label is its own, and a second in the FIB to route the IP packet. PHP moves the pop one hop earlier, so the egress only does the IP lookup. The egress requests PHP by advertising implicit null (label 3) for the prefixes it owns, such as its connected interfaces and loopbacks. The upstream router sees label 3 and installs "Pop Label" in its LFIB.

If the TC bits must survive to the egress, for example because the egress applies QoS based on MPLS TC, configure explicit null: mpls ldp explicit-null. The penultimate router then swaps to label 0, and the egress pops it.

Exam trap

In L3VPN, PHP removes only the outer transport label. The inner VPN label is still there when the packet reaches the egress PE, and the egress PE uses it to pick the VRF. If a question asks what a P router does to the VPN label, the answer is nothing: P routers never look below the top label.

LDP

LDP (RFC 5036) is the protocol that distributes labels for IGP prefixes. It is what the blueprint means by "label distribution", and the default on IOS.

Discovery and session

Step Transport Default
Link hello (discovery) UDP 646 to 224.0.0.2 Every 5 seconds, hold time 15 seconds
Targeted hello (non-adjacent peer) UDP 646 unicast Used for things like LDP session protection
Session TCP 646 Keepalive 60 seconds, hold time 180 seconds
  1. Each LSR sends hellos out every MPLS-enabled interface. The hello carries the LDP ID (router ID plus label space, written 10.255.255.1:0) and the transport address.
  2. When two LSRs hear each other, the one with the higher transport address is active and opens the TCP session to port 646 on the other.
  3. The transport address defaults to the LDP router ID, which is usually a loopback. Each LSR must have a route to the other's transport address, or TCP cannot connect.
  4. After the session is up, each LSR sends Address messages (listing its interface addresses, so neighbors can map an IGP next hop to an LDP peer) and Label Mapping messages.

LDP router ID selection: the mpls ldp router-id command if configured; otherwise the highest IP address on an up loopback; otherwise the highest IP address on any up interface. A new router ID only takes effect when LDP restarts, unless you add force.

Label distribution behavior on IOS

Property IOS default (frame mode) Meaning
Label space Per platform (:0) One label value means the same prefix whatever interface the packet arrives on
Advertisement Downstream unsolicited Labels are sent to all neighbors without being asked
Control Independent Each LSR assigns and advertises labels as soon as the prefix is in its RIB, without waiting for downstream
Retention Liberal Keep labels from all neighbors in the LIB, not just from the current next hop

Liberal retention is why the LIB shows several remote bindings per prefix. It speeds up convergence: if the IGP next hop changes, the label from the new next hop is already known.

LDP assigns labels for IGP prefixes in the routing table. By default it does not assign labels for BGP-learned routes; BGP routes are reached by recursion to the BGP next hop, which is an IGP prefix with a label. That is how a BGP-free core works.

LDP and IGP synchronization

If the IGP comes up on a link before LDP, the IGP may route traffic over a link that has no label bindings yet, and labeled traffic (such as VPN traffic) is dropped. LDP-IGP synchronization (mpls ldp sync under OSPF or IS-IS) makes the IGP advertise the link with maximum metric until LDP is up. You only need to recognise what it solves.

Configuration and verification

MPLS is enabled per interface. The IGP must already carry the loopbacks.

ip cef
mpls label protocol ldp
mpls ldp router-id Loopback0 force
!
interface GigabitEthernet0/0
 mpls ip


mpls ldp router-id Loopback0 force
!
router ospf 1
 mpls ldp autoconfig area 0
Every interface in OSPF area 0 gets LDP. Use no mpls ldp igp autoconfig on an interface to exclude it. Autoconfig is supported with OSPF and IS-IS, not with EIGRP.

mpls label protocol ldp is the default on current IOS releases, so it often does not appear in the running configuration.

Verification ladder (work top down when something fails):

Command Proves
show mpls interfaces MPLS is enabled and operational on the interface
show mpls ldp discovery detail Hellos are sent and received, and the neighbor's transport address is reachable
show mpls ldp neighbor The TCP session is up (State: Oper) and which addresses the peer owns
show mpls ldp bindings The LIB: local and remote bindings per prefix
show mpls forwarding-table The LFIB: what happens to each incoming label
traceroute Labels at each hop ([MPLS: Label 18 Exp 0]) 
R2# show mpls ldp neighbor
    Peer LDP Ident: 10.255.255.3:0; Local LDP Ident 10.255.255.2:0
        TCP connection: 10.255.255.3.29013 - 10.255.255.2.646
        State: Oper; Msgs sent/rcvd: 41/40; Downstream
        Up time: 00:18:22
        LDP discovery sources:
          GigabitEthernet0/1, Src IP addr: 10.2.3.2
        Addresses bound to peer LDP Ident:
          10.2.3.2        10.3.4.1        10.255.255.3

R3 has the higher transport address, so it is the active side: it connects from an ephemeral port to R2's port 646.

Exam trap

show mpls ldp discovery showing xmit/recv means hellos work in both directions. If the neighbor still does not appear in show mpls ldp neighbor, the problem is the TCP session: no route to the peer's transport address, an ACL blocking TCP 646, or an LDP password mismatch (mpls ldp neighbor <ip> password). Do not waste time on the interface configuration once discovery is fine.

Hiding the core: TTL propagation

By default the ingress LSR copies the IP TTL into the label, so customer traceroutes show every P router. no mpls ip propagate-ttl makes the ingress set the label TTL to 255 instead. Customer traceroutes then show the MPLS core as one hop. no mpls ip propagate-ttl forwarded hides the core only from customer traffic while traceroutes from the routers themselves still show every hop.

Exam trap

A traceroute across an MPLS core that shows only the ingress and egress PE is not a fault. It means TTL propagation is disabled. The labels are still being switched.

MTU

Each label adds 4 bytes. A 1500-byte IP packet with two labels is 1508 bytes on the wire. If core links are 1500 bytes, large packets with DF set are dropped. Fixes are a larger MTU on core links (mtu on the interface), mpls mtu on the interface, or ip tcp adjust-mss toward customers.

Lab: build an LDP core and read the tables

Topology: four IOSv routers in a line. R1 and R4 are edge LSRs, R2 and R3 are core LSRs. OSPF area 0 carries all loopbacks.

graph LR
  R1["R1 PE<br/>Lo0 10.255.255.1"] -- "Gi0/0 .1  10.1.2.0/30  .2 Gi0/0" --- R2["R2 P<br/>Lo0 10.255.255.2"]
  R2 -- "Gi0/1 .1  10.2.3.0/30  .2 Gi0/0" --- R3["R3 P<br/>Lo0 10.255.255.3"]
  R3 -- "Gi0/1 .1  10.3.4.0/30  .2 Gi0/0" --- R4["R4 PE<br/>Lo0 10.255.255.4"]

Steps

  1. Address the links and loopbacks as shown. Configure OSPF on every router and confirm with show ip route ospf that each router sees all four loopbacks.

  2. Enable LDP with autoconfig. On R2, for example:

    mpls ldp router-id Loopback0 force
router ospf 1
 router-id 10.255.255.2
 network 10.0.0.0 0.255.255.255 area 0
 mpls ldp autoconfig

  3. On R2, confirm two LDP neighbors with show mpls ldp neighbor.

  4. Read the LIB for R4's loopback on R2:

    R2# show mpls ldp bindings 10.255.255.4 32
  lib entry: 10.255.255.4/32, rev 14
        local binding:  label: 19
        remote binding: lsr: 10.255.255.1:0, label: 18
        remote binding: lsr: 10.255.255.3:0, label: 18

    R2 holds R1's binding too (liberal retention), even though R1 is not the next hop for 10.255.255.4. The fact that both neighbors chose label 18 is a coincidence: labels are local to each router.

  5. Read the LFIB on R2:

    R2# show mpls forwarding-table
Local      Outgoing   Prefix             Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id       Switched      interface
16         Pop Label  10.255.255.1/32    0             Gi0/0      10.1.2.1
17         Pop Label  10.255.255.3/32    0             Gi0/1      10.2.3.2
18         Pop Label  10.3.4.0/30        0             Gi0/1      10.2.3.2
19         18         10.255.255.4/32    0             Gi0/1      10.2.3.2

    Label 19 in, label 18 out toward R3: a swap. The entries for R1's and R3's own prefixes show "Pop Label" because R1 and R3 advertised implicit null for them.

  6. From R1, run traceroute 10.255.255.4 source Loopback0 and read the labels at each hop. Expect hop 1 (R2) to show [MPLS: Label 19 Exp 0], the label R2 advertised and R1 pushed, hop 2 (R3) to show label 18 after R2's swap, and hop 3 (R4) to reply with no label because R3 popped it (PHP).

  7. Break it. On R3, replace the catch-all network statement with two statements that cover only the link subnets, so Lo0 is no longer in OSPF. Watch show mpls ldp discovery detail on R2: R3's transport address is no longer reachable and the session drops. Restore it.
  8. Break it again. Configure no mpls ip propagate-ttl on R1 and repeat the traceroute. The core hops disappear.

Quick check

R5 advertised label 3 for its loopback. What does its upstream neighbor put in its LFIB for that prefix?

"Pop Label". Label 3 is implicit null: the upstream router removes the top label and forwards the packet without it. Label 3 is never seen in a packet.

The LIB on a P router shows three remote bindings for a prefix, but the LFIB has one outgoing label. Why?

IOS uses liberal label retention, so it keeps every neighbor's binding in the LIB. The LFIB uses only the label from the neighbor that is the IGP next hop for the prefix (or one per next hop with equal-cost paths).

Two directly connected routers with mpls ip show each other in show mpls ldp discovery but have no LDP session. Name two likely causes.

No route to the neighbor's transport address (usually the loopback is missing from the IGP), or TCP port 646 is blocked by an ACL. An LDP MD5 password mismatch is a third.

References