Service-provider VPN architecture and underlay dependencies
Identify which service the provider offers
A provider VPN carries customer traffic over shared infrastructure while preserving the intended service separation. A Layer2 service transports the relevant customer link-layer traffic under its supported model, whereas a Layer3 service has provider-edge routing participation for the customer. A pure Layer2 transport does not require the provider to route each customer IP packet, but integrated routing/bridging and other composite services have additional roles. Do not turn a simplified contrast into a claim that an entire device never performs any routing.
Separate edge and core responsibilities
Customer-edge, provider-edge and provider-core roles describe their relationship to the service. The core can transport labeled traffic without maintaining every customer route, while a provider edge maintains the relevant service context. An underlay route to a remote edge and the service-specific forwarding context solve different problems. A reachable loopback does not prove that the required label-switched path, service label and attachment all work. Trace the actual failure stage instead of leaking customer routes into a shared global table as a shortcut.
Follow control and data planes
An interior routing protocol establishes relevant provider reachability. LDP, segment-routing or another supported mechanism can provide the selected transport-label behavior; one deployment need not use every label-distribution method. BGP address families advertise particular routing information and attributes. In a conventional MPLS VPN path, an outer transport label and an inner service/VPN label have different purposes. Label significance, penultimate-hop behavior and the exact stack depend on the selected architecture. A numeric label is not a universally permanent end-to-end customer identifier.
Diagnose from evidence and boundaries
Inspect relevant routing, neighbor, label, forwarding and interface observations under the supported platform syntax. A configured BGP neighbor and an established session are different facts; an established session and a useful imported route are also different. Inter-provider options divide reachability, signaling and trust responsibilities in different ways. State which option and participating nodes the example uses before asserting what an AS boundary router must carry. MPLS separation does not automatically encrypt the customer’s data. This is written role and failure reasoning, not an actual provider configuration or proof of advanced service implementation competence. Current official versions and exact IOS XE/IOS XR command forms need their specific documentation.