Understanding Asymmetric Routing in Computer Networks
In the vast landscape of computer networks, various complex phenomena influence the efficiency and reliability of data transmission.…
MPLS (Multiprotocol Label Switching) forwards packets using a short, fixed-length label instead of doing a destination lookup in the IP routing table at every hop. The first router classifies the packet and pushes a label onto it; every router after that switches the packet purely on that label. It is called “multiprotocol” because the payload underneath the label can be IPv4, IPv6, Ethernet, or almost anything else.
MPLS sits between Layer 2 and Layer 3, which is why engineers call it a “Layer 2.5” technology. It was standardised by the IETF in RFC 3031 (January 2001), growing out of Cisco’s Tag Switching and IBM’s ARIS work in the late 1990s.
The MPLS Label, What Is Actually Added to the Packet
MPLS inserts a 4-byte (32-bit) label stack entry between the Layer 2 frame header and the Layer 3 packet header. That 4-byte entry is not all label, it carries four fields:
| Field | Size | What it does |
|---|---|---|
| Label | 20 bits | The forwarding value. Values 0–15 are reserved (label 3 = implicit null, used for PHP). |
| TC / EXP | 3 bits | Traffic Class, carries QoS priority, the MPLS equivalent of DSCP. |
| S (Bottom of Stack) | 1 bit | Set to 1 on the last label. Tells the router the IP header comes next. |
| TTL | 8 bits | Hop count, so MPLS loops still die. |
A packet can carry more than one label at a time, a label stack. In an MPLS VPN this is normal: an outer transport label gets the packet across the provider core, and an inner VPN label tells the last router which customer the packet belongs to.
MPLS Network Components
| Component | Also called | Role |
|---|---|---|
| LER, Label Edge Router | PE (Provider Edge) | Sits at the edge. Classifies incoming IP packets into a FEC and pushes the first label. On the way out it pops the label and forwards normal IP. |
| LSR, Label Switching Router | P (Provider) router | Sits in the core. Never looks at the IP header, it only swaps labels. |
| CE, Customer Edge | — | The customer’s own router. It has no idea MPLS exists. |
| LSP, Label Switched Path | — | The unidirectional path a labelled packet follows from ingress LER to egress LER. Two-way traffic needs two LSPs. |
| FEC, Forwarding Equivalence Class | — | A group of packets treated identically. Usually “all traffic to this destination prefix”, but it can also be per-VPN or per-QoS class. |
| LFIB, Label Forwarding Information Base | Label forwarding table | The table an LSR actually forwards on: incoming label → outgoing label + outgoing interface + next hop. |
How MPLS Forwarding Works, Push, Swap, Pop
MPLS uses exactly three label operations. Most explanations get this wrong by claiming the label is stripped at every hop, it is not. It is swapped.
- PUSH, the ingress LER adds a label to an unlabelled packet.
- SWAP, a core LSR replaces the incoming label with the outgoing label its LFIB specifies. This is what happens at almost every hop.
- POP, the label is removed, exposing whatever is underneath (another label, or the IP packet).
A Real Forwarding Walk-Through
Customer traffic destined for 10.20.0.0/16 crossing a four-router provider core:
- PE1 (ingress LER) receives a plain IP packet from the customer. It matches the destination to a FEC, looks up the label its neighbour advertised for that FEC, and pushes label 300.
- P1 receives the packet with label 300. It does not read the IP header. Its LFIB says “incoming 300 → outgoing 210, send out Gi0/1”, so it swaps 300 for 210.
- P2 receives label 210 and swaps it for the label P3 advertised, say 115.
- P3 is the penultimate hop. PE2 advertised label 3 (implicit null) for this FEC, which is an instruction meaning “don’t bother labelling this, just pop it”. So P3 pops the label and forwards a plain IP packet to PE2.
- PE2 (egress LER) receives a clean IP packet and does one normal routing lookup to hand it to the customer.
That step 4 behaviour is PHP, Penultimate Hop Popping. It exists so the egress router does not have to do two lookups (one label lookup, then one IP lookup) on the same packet. It is on by default on Cisco IOS.
How Routers Learn Labels, LDP
Labels are only locally meaningful. Router A’s label 300 has nothing to do with Router B’s label 300. So every router has to tell its neighbours which label to use when sending it traffic for a given prefix. That job belongs to a label distribution protocol:
- LDP (Label Distribution Protocol), the common one. It discovers neighbours with hello packets on UDP 646, builds a TCP 646 session, then advertises a label for every prefix in the IGP. LDP does not compute paths; it simply hangs labels on the paths your IGP already chose. That is why MPLS still needs an IGP underneath it, usually OSPF or IS-IS.
- RSVP-TE, used when you want traffic engineering: explicit paths, bandwidth reservation, and fast reroute. It signals LSPs that deliberately do not follow the IGP shortest path.
- MP-BGP, distributes the inner VPN labels for MPLS L3VPN (see below).
- Segment Routing (SR-MPLS), the modern replacement. It carries label information inside the IGP itself, so LDP and RSVP-TE can be removed entirely. New builds increasingly start here.
MPLS VPN, The Reason Most Networks Buy MPLS
Label switching alone is not why providers deploy MPLS today (modern hardware does IP lookups at line rate anyway). The real driver is MPLS VPN: carrying many customers’ overlapping private address space across one shared core.
MPLS L3VPN
The provider edge router keeps a separate routing table per customer using VRF (Virtual Routing and Forwarding). Three pieces make it work:
- VRF, an isolated routing and forwarding table on the PE. Two customers can both use 192.168.1.0/24 without colliding.
- RD (Route Distinguisher), an 8-byte value prepended to the IPv4 prefix to make it globally unique inside MP-BGP. It exists purely to keep overlapping prefixes distinct in transit.
- RT (Route Target), a BGP extended community that controls which VRFs a route gets imported into. RTs are what let you build hub-and-spoke or extranet topologies.
The packet then carries two labels: the outer transport label to cross the core, and the inner VPN label that tells the egress PE which VRF to drop the packet into. Our Cisco MPLS multi-VRF lab walks through the configuration end to end.
MPLS L2VPN
Instead of routing for the customer, the provider carries their Layer 2 frames:
- VPWS / pseudowire, a point-to-point circuit. Two customer sites behave as if they were joined by one long cable.
- VPLS, a multipoint service. Many customer sites share one emulated Ethernet broadcast domain.
- EVPN, the current-generation replacement for VPLS, using MP-BGP for MAC learning instead of flooding.
Traffic Engineering and QoS
Plain IP routing sends everything down the shortest path, even when it is congested and an alternate path is idle. MPLS-TE lets you build an LSP along a path you choose, reserve bandwidth on it, and pin specific traffic to it. Combined with the 3-bit TC field, this is how providers deliver a genuine SLA on latency and jitter for voice and video, and what people are really buying when they buy an MPLS circuit.
MPLS-TE also enables Fast Reroute (FRR): a pre-computed backup LSP that takes over in under 50 ms when a link fails, without waiting for the IGP to reconverge.
Where CEF Fits In
Cisco Express Forwarding (CEF) is a hard prerequisite, not an optional optimisation. MPLS label imposition on Cisco platforms is built on the CEF forwarding table, if CEF is disabled on an interface, MPLS will not label packets on it. On any modern IOS/IOS-XE box CEF is on by default, but it is the first thing to check when labels mysteriously are not being imposed.
MPLS vs SD-WAN
These are not competing versions of the same thing. MPLS is a transport a provider sells you; SD-WAN is an overlay you run yourself on top of whatever transport you have, broadband, LTE, or MPLS itself. Many networks run SD-WAN over a cheap internet link plus a smaller MPLS circuit kept for latency-sensitive traffic. The main platforms are compared in Versa vs Cisco SD-WAN, and SD-WAN interview questions covers the concepts in exam form. See the full SD-WAN vs MPLS comparison for cost and design trade-offs.
Real Benefits of MPLS
- Guaranteed performance. A provider can commit to latency, jitter and loss figures on an MPLS circuit because it controls the path. Public internet transit cannot make that promise.
- Traffic engineering. You can move traffic off the shortest path and onto the path you want.
- Any-to-any VPN connectivity. Adding a new site to an L3VPN is one PE configuration, not a full mesh of tunnels to every existing site.
- Protocol independence. The same core carries IPv4, IPv6 (6PE/6VPE) and Ethernet without a redesign.
- Sub-50 ms failover with MPLS-TE Fast Reroute.
- Traffic separation. VRFs keep customers’ routing tables fully isolated from each other.
Three Things People Get Wrong About MPLS
1. “MPLS encrypts your traffic.” It does not. MPLS provides isolation, not confidentiality, it is private in the same sense a leased line is private. Anyone with access to the provider core can read the payload. If you need confidentiality over MPLS you still run IPsec or a VPN on top.
2. “MPLS gives you more bandwidth or higher speed.” A label lookup is not faster than an IP lookup on modern hardware, that argument was true in 1998 when ASICs could not do longest-prefix match at line rate, and it stopped being true years ago. What MPLS actually gives you is predictability: engineered paths, reserved capacity and QoS enforcement. The circuit speed is whatever you paid for.
3. “The label is removed at every hop.” Only the penultimate router pops the label (and only because PHP tells it to). Every other core router swaps one label for another. If labels were removed and re-added at each hop, MPLS would have to consult the IP routing table each time, which is exactly what it exists to avoid.
Frequently Asked Questions
Is MPLS Layer 2 or Layer 3?
Neither. It runs between them, which is why it is called Layer 2.5. It uses Layer 2 style fixed-length switching but is signalled by Layer 3 protocols and sits above the data link header.
How big is an MPLS label?
The label field itself is 20 bits. The full label stack entry, label plus TC, bottom-of-stack bit and TTL, is 4 bytes.
Does MPLS replace routing protocols?
No. MPLS depends on an IGP (OSPF or IS-IS) to build the paths, and on LDP, RSVP-TE or MP-BGP to distribute labels along them. It is a forwarding mechanism layered on top of routing, not a replacement for it.
What is the difference between an LER and an LSR?
An LER (or PE) sits at the network edge and does the label push and pop, plus the IP lookup. An LSR (or P router) sits in the core and only swaps labels, it never looks at the customer IP header.
Is MPLS obsolete?
The data plane is not, labels are still how most provider cores forward. What is being replaced is the control plane: Segment Routing is displacing LDP and RSVP-TE, and EVPN is displacing VPLS. Enterprises are also shifting bulk traffic from MPLS circuits to SD-WAN over broadband for cost reasons, while keeping MPLS for latency-critical flows. See Versa SD-WAN vs Cisco SD-WAN for a platform comparison.
Why does MPLS need CEF?
Label imposition on Cisco routers is built on the CEF forwarding table. Without CEF enabled on the interface, the router will not impose labels.
