Core: Network Virtualization

MPLS fundamentals

Miro Kosut

Miro Kosut

— 3 min read
Share

In one line

Label-switched forwarding decoupled from the IP lookup - the substrate that makes scalable VPNs, traffic engineering, and fast reroute possible.

Forwarding plane

Label switch routers (LSRs) swap labels hop-by-hop along a Label Switched Path (LSP); the ingress PE pushes a label, the egress pops it, with penultimate-hop popping (PHP) common. VPNs use a two-label stack: an outer transport label (P routers forward on it) and an inner service/VPN label (the egress PE uses it to pick the VRF).

Control plane / label distribution

  • LDP - hop-by-hop, follows the IGP; simplest, no TE. The two LDP design guards: LDP-IGP synchronization (the IGP advertises a link at maximum cost until LDP is operational on it, so traffic is never attracted onto a path that cannot yet label-switch - without it, L3VPN traffic blackholes, because VPN packets have no IP fallback) and LDP session protection (a targeted-hello session that survives link flaps, so label bindings are retained and reinstalled instantly on recovery).
  • RSVP-TE - explicit, bandwidth-reserved TE paths.
  • BGP-LU (labeled unicast) - labels in BGP for inter-AS / seamless MPLS.
  • Segment Routing - the label is a SID; removes LDP/RSVP state from the core (see Segment Routing).
  • MP-BGP carries the VPN address families (VPNv4/VPNv6, L2VPN) that signal VPN routes and labels.

Traffic engineering and fast reroute (RSVP-TE -> SR)

RSVP-TE turns MPLS into a traffic-engineering tool: instead of following the IGP shortest path, an LSP is placed by constraint-based path computation (CSPF) honouring bandwidth reservations, affinities / administrative-group colours (include/exclude links), priority/preemption, and an optional TE metric - the head-end computes an explicit or dynamic path, signals it with RSVP, and the network holds the reservation. LSPs are reoptimised make-before-break (build the new path before tearing the old), can act as a forwarding adjacency (the IGP sees the LSP as a link), and can be auto-meshed between TE routers. RSVP-TE also gives Fast Reroute (FRR): a precomputed backup tunnel repairs a failure in tens of milliseconds by local repair at the point of failure - link protection (a bypass around the failed link) or node protection (around the failed node) - while the head-end reoptimises globally afterwards. That frames the two recovery scales - local/fast (FRR) vs global (head-end reroute / IGP reconvergence) - and protection (precomputed backup) vs restoration (compute after the fact). The cost is per-LSP RSVP state in the core, which is exactly what Segment Routing removes: SR-TE gives the same constraint-based steering and TI-LFA the same sub-50 ms local repair without RSVP/LDP state (Segment Routing, Fast convergence techniques) - the brownfield RSVP-TE -> SR migration story.

Why it matters for design

MPLS is the foundation for MPLS L3VPN and L2VPN, TE, and the SP / large-enterprise core. The live design choice is which label distribution - and increasingly whether to migrate LDP/RSVP to SR.

Validating the label plane

Verify the data plane, not just the control plane: LSP ping tests end-to-end label forwarding, LSP traceroute isolates the broken hop, and VCCV does the same inside a pseudowire (MPLS L3VPN and L2VPN) - an LSP can be "up" in the control plane while the LFIB blackholes.

IPv6 / dual-stack note

Carry IPv6 over an MPLS core with 6PE (global) and 6VPE (per-VRF); the core can stay IPv4/MPLS while transporting v6.

Spaced repetition

In an MPLS VPN the packet carries a two-label stack - name each label's job.

Outer transport label (P routers forward on it) + inner VPN/service label (egress PE selects the VRF).

The label-distribution protocol that simply follows the IGP hop-by-hop is [...]; explicit bandwidth-reserved TE paths use [...].

The label-distribution protocol that simply follows the IGP hop-by-hop is LDP; explicit bandwidth-reserved TE paths use RSVP-TE.

Carrying IPv6 over an IPv4/MPLS core uses [...].

Carrying IPv6 over an IPv4/MPLS core uses 6PE / 6VPE.

What does RSVP-TE add over LDP, and how?

Traffic engineering - LSPs placed by constraint-based path computation (CSPF) honouring bandwidth, affinities/admin-groups, priority/preemption and a TE metric, signalled explicitly with RSVP and reoptimised make-before-break. The cost is per-LSP RSVP state in the core.

MPLS Fast Reroute (FRR) - what does it protect and how fast?

A precomputed backup tunnel does local repair at the point of failure in tens of ms - link protection (bypass around a failed link) or node protection (around a failed node) - while the head-end reoptimises globally afterwards.

How does Segment Routing replace RSVP-TE's TE and FRR?

SR-TE gives the same constraint-based steering and TI-LFA gives sub-50 ms local repair, both without per-LSP RSVP/LDP state - a stateless core. That is the brownfield RSVP-TE -> SR migration story.

Without [...] an IGP can converge onto a link that carries no labels yet - and L3VPN traffic blackholes, since VPN packets have no IP fallback.

Without LDP-IGP synchronization an IGP can converge onto a link that carries no labels yet - and L3VPN traffic blackholes, since VPN packets have no IP fallback.

Sources

  • Cisco Press, MPLS Fundamentals; Definitive MPLS Network Designs.

domain: Core · blueprint-ref: Core 5.1 Multiprotocol Label Switching · type: concept · status: complete · tags: [core, core/virtualization, tradeoff/scale]

Read more