QME CommunicationsTelecommunications network configuration reference

MPLS Layer 3 VPN provider edge

Platform: Cisco IOS XR 7.5 · Role: provider edge router · Last reviewed 2026-09-22

Role in the network

A provider edge router terminates customer attachment circuits, keeps each customer's routes in a separate virtual routing and forwarding instance, and carries those routes across the shared MPLS core inside multiprotocol BGP. The core routers in the middle never see a customer route; they only switch labels. This is what makes the service scale, and it is why the route distinguisher and route target assignment plan matters more than any individual line of configuration.

Identifier plan

Route distinguisher and route target scheme used throughout the example.
FormatType 0: AS:index — 64512:<service id>
Route distinguisherUnique per VRF per PE: 64512:1001 on this router
Route target, any-to-any64512:1001 imported and exported by every site
Route target, hub64512:9001 exported by hub, imported by spokes
Route target, spoke64512:9002 exported by spokes, imported by hub only
Customer attachmentBundle-Ether10.1001, 192.0.2.129/30, VLAN 1001
Route reflectors203.0.113.10 and 203.0.113.11

Configuration

! ---------------------------------------------------------------------------
! VRF definition. The route distinguisher makes otherwise identical customer
! prefixes unique inside the provider's BGP table; the route targets decide
! which sites see them. Keep the two concepts separate in your plan: an RD is
! about uniqueness, an RT is about topology.
! ---------------------------------------------------------------------------
vrf CUST-ACME-L3VPN
 description Customer ACME any-to-any L3VPN service 1001
 address-family ipv4 unicast
  import route-target
   64512:1001
  !
  export route-target
   64512:1001
  !
 !
 address-family ipv6 unicast
  import route-target
   64512:1001
  !
  export route-target
   64512:1001
  !
 !
!
! ---------------------------------------------------------------------------
! Customer attachment circuit. Per-VRF limits are not optional: without them a
! single customer route leak consumes the shared RIB on every PE in the mesh.
! ---------------------------------------------------------------------------
interface Bundle-Ether10.1001
 description CUST-ACME site 1 attachment circuit
 vrf CUST-ACME-L3VPN
 ipv4 address 192.0.2.129 255.255.255.252
 ipv6 address 2001:db8:113:1001::1/64
 encapsulation dot1q 1001
!
! ---------------------------------------------------------------------------
! Core facing interfaces carry labels, not customer addresses.
! ---------------------------------------------------------------------------
interface HundredGigE0/0/0/0
 description Core link to core-rtr-01
 ipv4 address 203.0.113.66 255.255.255.252
 mtu 9192
!
router isis CORE
 is-type level-2-only
 net 49.0001.0203.0113.0005.00
 address-family ipv4 unicast
  metric-style wide
  mpls ldp auto-config
 !
 interface Loopback0
  passive
 !
 interface HundredGigE0/0/0/0
  point-to-point
  address-family ipv4 unicast
   metric 100
  !
 !
!
mpls ldp
 router-id 203.0.113.5
 session protection
 interface HundredGigE0/0/0/0
 !
!
! ---------------------------------------------------------------------------
! BGP. Two sessions upward to the route reflectors carrying VPNv4 and VPNv6,
! and one session per customer VRF for the attachment circuit.
! ---------------------------------------------------------------------------
router bgp 64512
 bgp router-id 203.0.113.5
 address-family vpnv4 unicast
  retain route-target all
 !
 address-family vpnv6 unicast
 !
 neighbor-group RR-CLIENT
  remote-as 64512
  update-source Loopback0
  address-family vpnv4 unicast
   soft-reconfiguration inbound always
  !
  address-family vpnv6 unicast
   soft-reconfiguration inbound always
  !
 !
 neighbor 203.0.113.10
  use neighbor-group RR-CLIENT
  description Route reflector 1
 !
 neighbor 203.0.113.11
  use neighbor-group RR-CLIENT
  description Route reflector 2
 !
 vrf CUST-ACME-L3VPN
  rd 64512:1001
  address-family ipv4 unicast
   label mode per-vrf
   maximum-paths ebgp 2
   redistribute connected
  !
  neighbor 192.0.2.130
   remote-as 65001
   description CUST-ACME site 1 CE
   address-family ipv4 unicast
    route-policy CUST-ACME-IN in
    route-policy CUST-ACME-OUT out
    maximum-prefix 500 80 restart 30
    as-override
    site-of-origin 64512:1001
   !
  !
 !
!
! ---------------------------------------------------------------------------
! Customer policy. Accept only what the customer is contracted to advertise;
! send them the VPN routes plus a default.
! ---------------------------------------------------------------------------
prefix-set CUST-ACME-PREFIXES
  192.0.2.128/26 le 32,
  2001:db8:113:1001::/64 le 128
end-set
!
route-policy CUST-ACME-IN
  if destination in CUST-ACME-PREFIXES then
    set local-preference 100
    pass
  else
    drop
  endif
end-policy
!
route-policy CUST-ACME-OUT
  if destination in (0.0.0.0/0) then
    pass
  elseif source in (192.0.2.128/26 le 32) then
    drop
  else
    pass
  endif
end-policy

Verification

CommandExpected result
show bgp vrf CUST-ACME-L3VPN summary Customer edge neighbour Established, prefix count within the contracted limit.
show bgp vpnv4 unicast rd 64512:1001 Local customer prefixes present with the expected route target extended community attached.
show mpls forwarding vrf CUST-ACME-L3VPN A local label per VRF (per-vrf label mode) pointing at the attachment circuit.
show route vrf CUST-ACME-L3VPN 192.0.2.132/30 Remote site prefix learned via BGP VPNv4 with a label stack and a core next hop.
ping vrf CUST-ACME-L3VPN 192.0.2.133 End-to-end reachability inside the VRF only; the same address must be unreachable from the global table.

Operational notes

Standards

Back to the configuration library