I85PREP
⌘ K
CCNP Service Provider study materials
CCNP Service Provider study resources

CCNP Service Provider: Service Provider MPLS and VPN Technologies

CCNP Service Provider · Work through your exam, one topic at a time.

All guide sections

Service Provider MPLS and VPN Technologies

Domain 3 (30%) is the heaviest: MPLS forwarding, L3VPN, L2VPN/EVPN, and segment routing. Know label operations and which protocol builds each table.

MPLS forwarding

  • A label stack entry has a 20-bit label, EXP bits, bottom-of-stack bit, and TTL. Routers push, swap, or pop.
  • An LSR (P router) swaps labels; an LER (PE) imposes or disposes of them.
  • LDP distributes labels for IGP prefixes. Label 3 (implicit null) supports penultimate hop popping (PHP); label 0 (explicit null) preserves EXP.
  • LDP requires IGP reachability; IGP synchronization prevents black holes.

L3VPN

  • A VRF holds the customer routing table; the RD makes the VPNv4 prefix unique, and route targets (extended communities) control import/export.
  • MP-BGP carries VPNv4/VPNv6 routes between PEs.
  • PE-CE routing can be static, OSPF (with sham links for backdoor links), BGP (AS-override, allowas-in, SOO), or EIGRP.
  • Forwarding: CE -> PE VRF lookup -> VPN label plus transport label -> P swap -> PE pop -> VRF lookup.

L2VPN and EVPN

  • AToM/VPWS provides point-to-point pseudowires; VPLS provides multipoint; EVPN supplies a BGP control plane.
  • EVPN route types: 1 auto-discovery, 2 MAC/IP, 3 inclusive multicast, 4 Ethernet segment, 5 IP prefix.
  • EVPN multihoming uses ESI and designated-forwarder election; VXLAN can encapsulate EVPN.

Segment routing

  • SR-MPLS uses prefix and adjacency SIDs from the SRGB; no LDP is required.
  • TI-LFA provides fast reroute; SR-TE policies steer traffic.

Worked example

A CE sends a packet to 10.10.10.10. PE1's VRF RED maps it to VPN label 24010, and the BGP next hop is PE2's loopback 192.0.2.2, reachable via LDP label 16002. PE1 pushes 24010 and 16002. The P router swaps 16002 to 16009. If PHP applies, the penultimate router pops 16002 and sends only 24010; PE2 pops the VPN label and forwards in VRF RED. If explicit null is used, label 0 remains so EXP survives.

Traps

  • Believing the RD selects the VRF; the route target does.
  • Reusing an RD carelessly across VRFs; RD plus prefix must be unique.
  • Mismatched route targets.
  • Expecting LDP to label BGP routes.
  • Confusing EVPN type 2 (MAC/IP) with type 5 (IP prefix).
  • Forgetting that PHP changes the label stack seen at the egress PE.