MPLS cheat sheet

MPLS forwards on a 20-bit label, 3-bit EXP (TC), 1-bit bottom-of-stack (S), and 8-bit TTL; the shim header is 4 bytes and sits between L2 and L3 headers.

Label values 0-15 are reserved: 0 = IPv4 explicit null, 2 = IPv6 explicit null, 3 = implicit null (pop, no label sent), 7 = router alert, 13 = GAL, 14 = OAM alert.

An LSR swaps labels; an LER (PE) pushes or pops at the edge; an LER that pops to an IPv4 lookup is the egress. Label space is per-interface (untagged frames) or per-platform (shared).

LIB maps incoming label to {outgoing label, next hop, outgoing interface}; LFIB holds only labels actually used for forwarding; FIB holds unlabelled IP prefixes.

Penultimate-hop popping (PHP) is signalled by advertising implicit null (label 3), so the egress receives a native IP packet and does one lookup.

Control plane is either ordered (LDP/RSVP wait for a route to the FEC before advertising a label) or independent (label advertised before a route exists, e.g. Cisco default).

Label distribution modes: downstream unsolicited (LDP default, advertise without request) vs downstream-on-demand (RSVP-TE, request-driven); retention is liberal (keep all) or conservative (keep only best).

MTU: label stack reduces usable payload; a 4-label stack costs 16 bytes, so interface MTU must be raised or fragmentation/fragmentation-needed handling planned.

LDP runs over UDP 646 for discovery hellos and TCP 646 for session; it binds a label to an FEC derived from the IGP route (host route /32 or /24 for loopbacks).

LDP session formation: hello (UDP multicast 224.0.0.2) → TCP → initialization → keepalive; dual-stack uses a single TCP session with IPv4/IPv6 label mapping TLVs.

LDP label mapping is downstream unsolicited by default; label withdrawal is sent when the FEC is lost, and label release acknowledges it.

LDP-IGP sync: LDP waits for label binding before the IGP advertises the link (or sets max-metric), preventing blackholes during session bring-up.

RSVP-TE uses IP protocol 46; Path message (downstream) carries ERO, RRO, session, sender template, and Tspec; Resv message (upstream) carries label and reservation style.

RSVP reservation styles: Fixed Filter (FF, one tunnel per sender), Shared Explicit (SE, multiple senders share one reservation), Wildcard Filter (WF).

RSVP-TE path setup requires CSPF: prune links failing bandwidth/affinity constraints, then run shortest path; the ERO is built from the resulting path and can be strict or loose.

RSVP refresh is 30 s by default with a 3x multiplier (90 s) for state expiry; hello extension (fast hello, 3 s) detects neighbor loss faster than refresh timeout.

Ingress PE: pop the VPN label (if present) → VRF lookup on the inner IP → push the transport (LDP/RSVP/SR) label toward the egress PE.

Egress PE: pop the transport label (PHP) → VPN label identifies the VRF → inner IP lookup inside that VRF.

The LFIB lookup key is the incoming label; the result is {outgoing label stack, outgoing interface, next hop MAC} plus counters used for verification.

MPLS ECMP hashing uses the label stack plus IP header fields (src/dst, protocol, ports if L4 hashing enabled); entropy label (RFC 6790) provides extra hashing bits when the stack is shallow.

Explicit null (0) forces the egress to keep a label and do a label lookup, useful for QoS/EXP preservation or to keep the packet labelled for OAM.

Implicit null (3) means the penultimate hop pops; the egress receives an unlabelled IP packet and does an IP lookup.

TTL propagation: uniform mode copies the IP TTL into the label TTL; pipe mode hides the MPLS core (TTL set to 255 at ingress, not propagated to egress).

The MPLS header EXP/TC bits are copied into the IP header at egress for uniform-mode QoS; pipe mode preserves the original IP DSCP.

Push adds a new label on top; swap replaces the top label; pop removes the top label; the operations are per-hop and per-LFIB entry.

The S (bottom-of-stack) bit is 1 on the last label; the egress uses it to know when to look at the payload (IP or PW control word).

PHP (penultimate-hop popping) is requested by advertising implicit null (3); the penultimate router pops, the egress does an IP lookup.

PHP is not possible for egress LSRs that need a label for QoS, OAM, or VPN context; advertise explicit null (0) instead.

Label stack depth for L3VPN = transport label + VPN label (2 labels); for L2VPN with control word, the payload follows the VC label.

Label stack depth for MPLS TE + VPN = TE label + VPN label; for segment routing, the SR label stack is the SID list (one label per segment).

A label swap does not change the payload; only the top label and its EXP/TTL are rewritten.

Label stack size limits: hardware may cap at 3-5 labels; exceeding it causes drops or requires entropy-label/compressed SR to fit.

VRF = per-customer routing table + forwarding table + RD; the RD (8 bytes) is prepended to the IPv4 prefix to make the VPN-IPv4 NLRI unique.

MP-BGP VPNv4 address family (AFI 1, SAFI 128) carries the RD + prefix + label; VPNv6 uses AFI 2, SAFI 128.

Route targets (RT) are extended communities (type 0x00/0x02); export RT is attached on the PE that originates the route, import RT is matched on the receiving PE.

The VPN label is assigned by the egress PE per VRF (or per prefix); the ingress PE pushes it below the transport label.

Route reflector reflects VPNv4 without changing next-hop or labels; the RR needs no VRF, only BGP and the VPNv4 AF.

VRF route leaking uses import/export RT matching; a hub-and-spoke design exports the spoke RT from the hub and imports it into spokes.

PE-CE routing options: static, eBGP, OSPF, EIGRP, RIP; OSPF/EIGRP need a sham-link or BGP cost community to avoid backdoor loops.

MPLS L3VPN requires the transport label to reach the egress PE loopback; if the loopback is not in the IGP/LDP, the VPN route is not forwarded.

A pseudowire (PW) emulates an L2 service over MPLS; the VC label is the inner label, the transport label is the outer label.

LDP-signalled PW (RFC 4447) uses FEC 128 (id + type) for static PWid, FEC 129 for BGP auto-discovery with a global ID.

A control word (4 bytes) is inserted between the VC label and the L2 frame to preserve sequencing, pad small frames, and carry the original control bits.

VPLS uses a full mesh of PWs between PEs; MAC learning is done per VPLS instance, and unknown unicast is flooded to all PWs (split horizon prevents loops).

BGP-AD (RFC 6074) uses BGP NLRI (AFI 25, SAFI 65) to auto-discover PEs and then LDP FEC 129 to signal the PW, replacing manual full-mesh configuration.

VPLS vs VPWS: VPLS is a multipoint bridged LAN (MAC learning, flooding), VPWS is point-to-point (E-Line), no MAC learning.

H-VPLS uses a spoke PW to a hub PE to reduce the full mesh; the hub acts as a PW switch and may use BGP-AD to scale.

PW status signalling (RFC 6870) carries PW state (up/down) in an LDP notification; a PW down triggers the AC to go down.

TE tunnel = path (explicit or dynamic) + bandwidth reservation + affinity; the tunnel is an LSP signalled by RSVP-TE.

Affinity (link attribute) bits are matched with an affinity mask and value: 0x00000000/0x00000000 = any link; 0x00000001/0x00000001 = must have bit 0 set.

CSPF prunes links failing bandwidth/affinity/admin-group constraints, then runs shortest path; the ERO records the chosen path.

TE tunnel bandwidth is reserved per priority (0-7); preemption uses setup/hold priority; lower priority number = higher priority.

MPLS QoS: EXP/TC bits (3 bits) map to per-hop behaviour (PHB); DiffServ tunnel mode copies IP DSCP to EXP at ingress and EXP to DSCP at egress.

MPLS QoS pipe mode preserves the original IP DSCP across the core; uniform mode overwrites it with the EXP value.

Queuing: classify on EXP, mark, then queue (LLQ/CBWFQ); the label stack EXP is the only QoS field available in the core.

TE and QoS interaction: RSVP-TE reserves bandwidth but does not itself queue; the queuing policy must be configured on the interface.

RSVP-TE FRR: local repair at the PLR; the backup tunnel is pre-signalled and merges at the MP (merge point).

FRR protection types: link protection (one backup per link) and node protection (backup avoids the next-hop node).

FRR uses facility backup (one backup tunnel protects all LSPs over a link) or one-to-one backup (dedicated detour per LSP).

The PLR pushes the backup label; the MP pops it and continues the primary LSP; the backup path must not loop through the protected link.

LDP FRR uses the IGP to pre-compute a loop-free alternate (LFA) and installs a backup label; remote LFA uses a tunnel to a PQ node.

TI-LFA (segment routing) computes a post-convergence path and encodes it as a SID list, providing 100% coverage without LFA topology constraints.

BGP PIC (prefix-independent convergence) pre-installs a backup path so the data plane switches without waiting for BGP reconvergence.

Convergence order: detect (BFD/hello) → IGP SPF → LDP/RSVP re-signal → BGP best path → FIB/LFIB update; each stage adds delay.

Verify LDP: show mpls ldp neighbor (state Oper), show mpls ldp bindings (local/remote label), show mpls forwarding-table (in/out label, next hop).

Verify RSVP-TE: show mpls traffic-eng tunnels (state Up), show mpls traffic-eng tunnels brief, show ip rsvp reservation.

Verify L3VPN: show ip vrf, show ip bgp vpnv4 all, show ip route vrf <name>, show mpls forwarding-table vrf <name>.

Verify L2VPN: show mpls l2transport vc, show mpls l2transport binding, show l2vpn vc, show l2vpn bridge-domain.

Common LDP fault: session up but no label for loopback → loopback not in IGP, or LDP not enabled on the interface, or ACL blocking TCP 646.

Common L3VPN fault: VPN route present but no label → next-hop unreachable, or the transport label missing (LDP/RSVP broken) → check show mpls forwarding-table <prefix>.

Common MTU fault: large packets dropped in the core because the label stack exceeds MTU; check show interface MTU and show mpls mtu.

Ping/traceroute with labels: ping mpls ipv4 <prefix>/<len>, traceroute mpls ipv4 <prefix>/<len>; for L2VPN use ping mpls pseudowire <vc-id>.

Segment routing (SR-MPLS) encodes the path as a list of SIDs in the label stack; no per-path signalling state in the core (stateless).

SRGB (segment routing global block) maps SIDs to labels; an index + SRGB base = local label; the same index gives the same SID across the domain.

SR SID types: node SID (prefix), adjacency SID (link), anycast SID (set of nodes), binding SID (map to a policy).

SR-TE policy = ordered SID list + candidate paths; the headend pushes the SID list, and the policy can be dynamic (CSPF/PCE) or explicit.

TI-LFA uses SR to encode the post-convergence path; the repair path is a SID list pushed at the PLR, giving sub-50 ms protection.

SRv6 uses 128-bit SIDs in the IPv6 header (segment routing header); MPLS and SRv6 can coexist with mapping.

PCE (path computation element) computes SR-TE paths and sends them via PCEP; the headend installs the SID list.

Migration: SR-MPLS interoperates with LDP via mapping server (RFC 8661) so LDP and SR domains can exchange labels.

The label is locally significant: the same prefix can have different labels on different routers; the LFIB is the authoritative forwarding table.

An LSP is unidirectional; return traffic uses a separate LSP, so a broken LSP only affects one direction.

The MPLS header is inserted between the L2 header and the L3 header; the L2 type field is 0x8847 (unicast) or 0x8848 (multicast).

A router that only swaps labels is a transit LSR (P router); a router that pushes/pops for a customer is a PE (LER).

Label stacking allows tunnelling: the outer label is the transport LSP, the inner label is the service (VPN/PW) label.

The default label range is 16-1048575 (20 bits); platforms may reserve a subset for static and reserved labels.

MPLS requires an IGP to reach the egress loopback; without a route to the BGP next-hop, the VPN label is not installed.

LDP discovery: basic (UDP 646 to 224.0.0.2) and extended (targeted, unicast) for remote neighbors across a tunnel.

LDP authentication: MD5/TCP-AO on the TCP session; without it, a rogue LSR can inject labels.

RSVP-TE explicit route object (ERO) can be strict (one hop) or loose (subset); the path is computed by CSPF at the headend.

RSVP-TE fast reroute uses the fast-reroute object in the Path message; the PLR signals a backup and merges at the MP.

RSVP-TE make-before-break uses a new LSP with a shared session and a new ERO, then the old LSP is torn down.

LDP label advertisement is per-FEC; a label withdrawal does not necessarily mean the route is gone (could be a policy change).

RSVP-TE bandwidth reservation is per tunnel and per priority; over-subscription causes path setup failure with RSVP error: bandwidth unavailable.

The ingress PE does a VRF lookup, then pushes the VPN label and the transport label; the order is transport on top, VPN below.

The egress PE pops the transport label (PHP) and uses the VPN label to select the VRF; then it does an IP lookup in that VRF.

The LFIB is programmed from the LIB + FIB; a label without a valid next-hop is not installed.

MPLS ECMP: the hash includes the label stack; with only one label, ECMP may be limited, so entropy labels are used.

The forwarding plane does not run BGP/IGP; it only uses the programmed LFIB/FIB; a control-plane change must be programmed before traffic shifts.

The MPLS TTL is decremented at each LSR; if it reaches 0, the packet is dropped and an ICMP time-exceeded is sent (if not suppressed).

The EXP/TC bits are 3 bits (0-7); they are the only QoS field in the MPLS header and are used for PHB selection.

Push operation: the new label is written on top, the S bit of the old top label is cleared, and the new label's S bit is set if it is the only label.

Pop operation: the top label is removed; if the S bit of the new top label is 1, the payload is IP; otherwise it is another label.

Swap operation: the top label is replaced; the S bit and EXP/TTL are rewritten according to the LFIB entry.

PHP is requested by the egress advertising implicit null (3); the penultimate router pops and forwards the IP packet.

Explicit null (0) is used when the egress needs the label (QoS, OAM, VPN); the penultimate router swaps to 0 and the egress pops.

A label stack of 2 is typical for L3VPN; a stack of 3+ appears with TE + VPN or SR SID lists.

The bottom-of-stack bit is used by the egress to decide whether to look at the payload; a mis-set S bit causes the egress to misinterpret the payload.

RD is 8 bytes: type 0 (2-byte ASN + 4-byte number) or type 1 (4-byte IP + 2-byte number); it is not used for forwarding, only for uniqueness.

RT is an extended community (8 bytes); export RT is attached on the originating PE, import RT is matched on the receiving PE.

VPNv4 NLRI = RD + IPv4 prefix + label; the label is the VPN label assigned by the egress PE.

MP-BGP next-hop for VPNv4 is the egress PE loopback; it must be reachable via the IGP and have a transport label.

VRF definition includes RD, import RT, export RT, and the interfaces; the RD must be unique per VRF on the PE.

PE-CE eBGP: the PE sets the next-hop to itself and advertises the CE prefix into VPNv4 with the VRF's export RT.

PE-CE OSPF: the PE redistributes OSPF into BGP and sets the OSPF domain ID; a sham-link is needed if the CE has a backdoor path.

Inter-AS Option A: back-to-back VRFs on ASBRs; Option B: VPNv4 between ASBRs; Option C: multihop VPNv4 between PEs with BGP-LU between ASBRs.

PW signalling: LDP FEC 128 (static PWid) or FEC 129 (BGP-AD); the VC label is exchanged in the LDP label mapping.

PW control word is optional but recommended for ATM/Frame Relay and for small frames; it carries the sequence number and the original control bits.

VPLS MAC learning: the PE learns source MAC on the AC and on the PW; unknown unicast is flooded to all PWs and ACs in the VPLS.

VPLS split horizon: a frame received on a PW is not sent back out on another PW (only to ACs), preventing loops.

BGP-AD uses the BGP NLRI (AFI 25, SAFI 65) to advertise the VE ID, RD, and RT; then LDP FEC 129 signals the PW.

VPWS (E-Line) is point-to-point; VPLS (E-LAN) is multipoint; both use the same PW signalling.

PW redundancy: primary/backup PW with a precedence value; the AC selects the active PW based on the PW status.

MTU mismatch on a PW causes the PW to stay down or to drop large frames; check show mpls l2transport vc detail.

TE tunnel path options: dynamic (CSPF), explicit (ERO), and loose (subset of hops); the path can be re-optimized.

Affinity is a 32-bit link attribute; the tunnel has an affinity value and mask; a link is usable if (link_affinity & mask) == (tunnel_affinity & mask).

TE bandwidth reservation is per priority (0-7); setup priority and hold priority determine preemption.

CSPF uses the IGP TED (traffic engineering database) to compute the path; it prunes links that fail bandwidth, affinity, or admin-group constraints.

MPLS QoS: classify at ingress (IP DSCP or ACL), mark EXP, queue in the core based on EXP, and optionally mark DSCP at egress.

Tunnel mode: the EXP is set from the IP DSCP at ingress; the egress copies EXP back to DSCP (uniform) or preserves the original (pipe).

Shortest-path vs TE: IGP picks the shortest path; TE can pick a longer path to avoid congestion, using bandwidth reservations.

FRR link protection: the PLR has a backup tunnel that bypasses the protected link and merges at the next-hop's next-hop (MP).

FRR node protection: the backup tunnel bypasses the next-hop node entirely; the MP is the node after the protected node.

Facility backup: one backup tunnel protects all LSPs over a link; one-to-one backup: a dedicated detour per LSP.

The PLR pushes the backup label; the MP pops it and forwards along the primary LSP; the backup path must not use the protected link.

LDP FRR: LFA computes a loop-free alternate using the IGP; remote LFA uses a tunnel to a PQ node to extend coverage.

TI-LFA: the repair path is encoded as a SID list (post-convergence path); it provides 100% coverage without LFA constraints.

BFD is used for fast detection (sub-second) of link/node failure; without BFD, IGP hello (default 10 s/3x) is too slow.

Convergence: detection → IGP SPF → LDP/RSVP re-signal → BGP best path → FIB/LFIB update; FRR bypasses the IGP/BGP steps.

LDP: show mpls ldp neighbor (state Oper), show mpls ldp bindings (local/remote label), show mpls forwarding-table (in/out label).

RSVP-TE: show mpls traffic-eng tunnels (state Up), show ip rsvp reservation, show ip rsvp sender.

L3VPN: show ip vrf, show ip bgp vpnv4 all, show ip route vrf <name>, show mpls forwarding-table vrf <name>.

L2VPN: show mpls l2transport vc, show mpls l2transport binding, show l2vpn vc, show l2vpn bridge-domain.

Ping/traceroute: ping mpls ipv4 <prefix>/<len>, traceroute mpls ipv4 <prefix>/<len>, ping mpls pseudowire <vc-id>.

Common fault: LDP session up but no label for the loopback → loopback not in IGP, LDP not enabled on the interface, or ACL blocking TCP 646.

Common fault: VPN route present but no label → next-hop unreachable or transport label missing; check show mpls forwarding-table <prefix>.

Common fault: large packets dropped in the core → label stack exceeds MTU; check interface MTU and show mpls mtu.

SR-MPLS encodes the path as a SID list; the core is stateless (no per-path signalling), and the headend pushes the list.

SRGB (segment routing global block) maps SIDs to labels; index + SRGB base = local label; the same index gives the same SID across the domain.

SID types: node SID (prefix), adjacency SID (link), anycast SID (set of nodes), binding SID (map to a policy).

SR-TE policy = ordered SID list + candidate paths; the headend pushes the SID list; the policy can be dynamic (CSPF/PCE) or explicit.

TI-LFA uses SR to encode the post-convergence path; the repair path is a SID list pushed at the PLR, giving sub-50 ms protection.

SRv6 uses 128-bit SIDs in the IPv6 header (segment routing header); MPLS and SRv6 can coexist with mapping.

PCE computes SR-TE paths and sends them via PCEP; the headend installs the SID list.

Migration: SR-MPLS interoperates with LDP via a mapping server (RFC 8661) so LDP and SR domains can exchange labels.

The label is locally significant: the same prefix can have different labels on different routers; the LFIB is authoritative.

An LSP is unidirectional; return traffic uses a separate LSP, so a broken LSP only affects one direction.

The MPLS header is inserted between the L2 and L3 headers; the L2 type field is 0x8847 (unicast) or 0x8848 (multicast).

A router that only swaps labels is a transit LSR (P router); a router that pushes/pops for a customer is a PE (LER).

Label stacking allows tunnelling: the outer label is the transport LSP, the inner label is the service (VPN/PW) label.

The default label range is 16-1048575 (20 bits); platforms may reserve a subset for static and reserved labels.

MPLS requires an IGP to reach the egress loopback; without a route to the BGP next-hop, the VPN label is not installed.

LDP discovery: basic (UDP 646 to 224.0.0.2) and extended (targeted, unicast) for remote neighbors across a tunnel.

LDP authentication: MD5/TCP-AO on the TCP session; without it, a rogue LSR can inject labels.

RSVP-TE explicit route object (ERO) can be strict (one hop) or loose (subset); the path is computed by CSPF at the headend.

RSVP-TE fast reroute uses the fast-reroute object in the Path message; the PLR signals a backup and merges at the MP.

RSVP-TE make-before-break uses a new LSP with a shared session and a new ERO, then the old LSP is torn down.

LDP label advertisement is per-FEC; a label withdrawal does not necessarily mean the route is gone (could be a policy change).

RSVP-TE bandwidth reservation is per tunnel and per priority; over-subscription causes path setup failure with RSVP error: bandwidth unavailable.

The ingress PE does a VRF lookup, then pushes the VPN label and the transport label; the order is transport on top, VPN below.

The egress PE pops the transport label (PHP) and uses the VPN label to select the VRF; then it does an IP lookup in that VRF.

The LFIB is programmed from the LIB + FIB; a label without a valid next-hop is not installed.

MPLS ECMP: the hash includes the label stack; with only one label, ECMP may be limited, so entropy labels are used.

The forwarding plane does not run BGP/IGP; it only uses the programmed LFIB/FIB; a control-plane change must be programmed before traffic shifts.

The MPLS TTL is decremented at each LSR; if it reaches 0, the packet is dropped and an ICMP time-exceeded is sent (if not suppressed).

The EXP/TC bits are 3 bits (0-7); they are the only QoS field in the MPLS header and are used for PHB selection.

Push operation: the new label is written on top, the S bit of the old top label is cleared, and the new label's S bit is set if it is the only label.

Pop operation: the top label is removed; if the S bit of the new top label is 1, the payload is IP; otherwise it is another label.

Swap operation: the top label is replaced; the S bit and EXP/TTL are rewritten according to the LFIB entry.

PHP is requested by the egress advertising implicit null (3); the penultimate router pops and forwards the IP packet.

Explicit null (0) is used when the egress needs the label (QoS, OAM, VPN); the penultimate router swaps to 0 and the egress pops.

A label stack of 2 is typical for L3VPN; a stack of 3+ appears with TE + VPN or SR SID lists.

The bottom-of-stack bit is used by the egress to decide whether to look at the payload; a mis-set S bit causes the egress to misinterpret the payload.

RD is 8 bytes: type 0 (2-byte ASN + 4-byte number) or type 1 (4-byte IP + 2-byte number); it is not used for forwarding, only for uniqueness.

RT is an extended community (8 bytes); export RT is attached on the originating PE, import RT is matched on the receiving PE.

VPNv4 NLRI = RD + IPv4 prefix + label; the label is the VPN label assigned by the egress PE.

MP-BGP next-hop for VPNv4 is the egress PE loopback; it must be reachable via the IGP and have a transport label.

VRF definition includes RD, import RT, export RT, and the interfaces; the RD must be unique per VRF on the PE.

PE-CE eBGP: the PE sets the next-hop to itself and advertises the CE prefix into VPNv4 with the VRF's export RT.

PE-CE OSPF: the PE redistributes OSPF into BGP and sets the OSPF domain ID; a sham-link is needed if the CE has a backdoor path.

Inter-AS Option A: back-to-back VRFs on ASBRs; Option B: VPNv4 between ASBRs; Option C: multihop VPNv4 between PEs with BGP-LU between ASBRs.

PW signalling: LDP FEC 128 (static PWid) or FEC 129 (BGP-AD); the VC label is exchanged in the LDP label mapping.

PW control word is optional but recommended for ATM/Frame Relay and for small frames; it carries the sequence number and the original control bits.

VPLS MAC learning: the PE learns source MAC on the AC and on the PW; unknown unicast is flooded to all PWs and ACs in the VPLS.

VPLS split horizon: a frame received on a PW is not sent back out on another PW (only to ACs), preventing loops.

BGP-AD uses the BGP NLRI (AFI 25, SAFI 65) to advertise the VE ID, RD, and RT; then LDP FEC 129 signals the PW.

VPWS (E-Line) is point-to-point; VPLS (E-LAN) is multipoint; both use the same PW signalling.

PW redundancy: primary/backup PW with a precedence value; the AC selects the active PW based on the PW status.

MTU mismatch on a PW causes the PW to stay down or to drop large frames; check show mpls l2transport vc detail.

TE tunnel path options: dynamic (CSPF), explicit (ERO), and loose (subset of hops); the path can be re-optimized.

Affinity is a 32-bit link attribute; the tunnel has an affinity value and mask; a link is usable if (link_affinity & mask) == (tunnel_affinity & mask).

TE bandwidth reservation is per priority (0-7); setup priority and hold priority determine preemption.

CSPF uses the IGP TED (traffic engineering database) to compute the path; it prunes links that fail bandwidth, affinity, or admin-group constraints.

MPLS QoS: classify at ingress (IP DSCP or ACL), mark EXP, queue in the core based on EXP, and optionally mark DSCP at egress.

Tunnel mode: the EXP is set from the IP DSCP at ingress; the egress copies EXP back to DSCP (uniform) or preserves the original (pipe).

Shortest-path vs TE: IGP picks the shortest path; TE can pick a longer path to avoid congestion, using bandwidth reservations.

FRR link protection: the PLR has a backup tunnel that bypasses the protected link and merges at the next-hop's next-hop (MP).

FRR node protection: the backup tunnel bypasses the next-hop node entirely; the MP is the node after the protected node.

Facility backup: one backup tunnel protects all LSPs over a link; one-to-one backup: a dedicated detour per LSP.

The PLR pushes the backup label; the MP pops it and forwards along the primary LSP; the backup path must not use the protected link.

LDP FRR: LFA computes a loop-free alternate using the IGP; remote LFA uses a tunnel to a PQ node to extend coverage.

TI-LFA: the repair path is encoded as a SID list (post-convergence path); it provides 100% coverage without LFA constraints.

BFD is used for fast detection (sub-second) of link/node failure; without BFD, IGP hello (default 10 s/3x) is too slow.

Convergence: detection → IGP SPF → LDP/RSVP re-signal → BGP best path → FIB/LFIB update; FRR bypasses the IGP/BGP steps.

LDP: show mpls ldp neighbor (state Oper), show mpls ldp bindings (local/remote label), show mpls forwarding-table (in/out label).

RSVP-TE: show mpls traffic-eng tunnels (state Up), show ip rsvp reservation, show ip rsvp sender.

L3VPN: show ip vrf, show ip bgp vpnv4 all, show ip route vrf <name>, show mpls forwarding-table vrf <name>.

L2VPN: show mpls l2transport vc, show mpls l2transport binding, show l2vpn vc, show l2vpn bridge-domain.

Ping/traceroute: ping mpls ipv4 <prefix>/<len>, traceroute mpls ipv4 <prefix>/<len>, ping mpls pseudowire <vc-id>.

Common fault: LDP session up but no label for the loopback → loopback not in IGP, LDP not enabled on the interface, or ACL blocking TCP 646.

Common fault: VPN route present but no label → next-hop unreachable or transport label missing; check show mpls forwarding-table <prefix>.

Common fault: large packets dropped in the core → label stack exceeds MTU; check interface MTU and show mpls mtu.

SR-MPLS encodes the path as a SID list; the core is stateless (no per-path signalling), and the headend pushes the list.

SRGB (segment routing global block) maps SIDs to labels; index + SRGB base = local label; the same index gives the same SID across the domain.

SID types: node SID (prefix), adjacency SID (link), anycast SID (set of nodes), binding SID (map to a policy).

SR-TE policy = ordered SID list + candidate paths; the headend pushes the SID list; the policy can be dynamic (CSPF/PCE) or explicit.

TI-LFA uses SR to encode the post-convergence path; the repair path is a SID list pushed at the PLR, giving sub-50 ms protection.

SRv6 uses 128-bit SIDs in the IPv6 header (segment routing header); MPLS and SRv6 can coexist with mapping.

PCE computes SR-TE paths and sends them via PCEP; the headend installs the SID list.

Migration: SR-MPLS interoperates with LDP via a mapping server (RFC 8661) so LDP and SR domains can exchange labels.