ISP Guide : How to Configure MPLS for Two Different Clients on a PE Router ?
MPLS L3VPN | Multi-Client PE Configuration 2025
ISP Guide : How to Configure MPLS for Two Different Clients on a PE Router ?
Master multi-tenant MPLS L3VPN configuration on Cisco PE routers. VRF isolation, MP-BGP, RD/RT design, PE-CE routing, and AI-optimized troubleshooting.
SEO + AEO Optimized ✦ AI-Enhanced Guide⚡ Quick Answer — Featured Snippet & AEO Optimized
How do you configure MPLS for two different clients on a single PE router?
To isolate and route traffic for two different clients on a single Provider Edge (PE) router, you must use MPLS Layer 3 VPN (L3VPN) with VRF (Virtual Routing and Forwarding) instances. The core steps are:
- Create two separate VRFs (one per client) with unique Route Distinguishers (RD) and Route Targets (RT)
address-family vpnv4Full CLI configuration, verification, RD/RT design, and AI troubleshooting prompts are provided below.
📊 Article Snapshot
📋 Table of Contents
- MPLS L3VPN Multi-Client Architecture Overview
- Core Concepts: VRF, RD, RT & MP-BGP
- Reference Topology & Lab Parameters
- Step 1: Enable CEF & MPLS Globally
- Step 2: Create VRFs for Client A & Client B
- Step 3: Assign Client Interfaces to VRFs
- Step 4: Configure PE-CE Routing per VRF
- Step 5: Configure MP-BGP (VPNv4) for Route Exchange
- Step 6: Enable MPLS & LDP on Core Interfaces
- Verification & Troubleshooting Commands
- Production Best Practices & Security
- Frequently Asked Questions (AEO Optimized)
- Final Configuration Checklist
1. MPLS L3VPN Multi-Client Architecture Overview
Service providers and large enterprises use MPLS Layer 3 VPN (L3VPN) to host multiple customers on shared infrastructure while maintaining strict routing isolation. The Provider Edge (PE) router is the critical boundary device that separates customer traffic using VRFs (Virtual Routing and Forwarding) and exchanges customer routes across the MPLS core using MP-BGP (Multiprotocol BGP).
When two different clients connect to the same PE router, their routing tables must never overlap or leak unless explicitly configured. MPLS L3VPN achieves this by tagging each customer route with a unique Route Distinguisher (RD) and controlling route import/export with Route Targets (RT).
🎯 Why This Configuration Matters:
- Enables multi-tenancy on a single PE router without routing conflicts
- Allows overlapping IP addresses between different clients
- Provides scalable, standards-based (RFC 4364) service provider architecture
- Supports any PE-CE routing protocol (BGP, OSPF, EIGRP, Static, RIP)
- Forms the foundation for SD-WAN, cloud interconnect, and enterprise WAN segmentation
2. Core Concepts: VRF, RD, RT & MP-BGP
Before configuring the PE router, understand these four foundational MPLS L3VPN components:
3. Reference Topology & Lab Parameters
We will configure a single PE router hosting two clients. The MPLS core (P routers) and remote PE are abstracted for clarity — focus is on the local PE multi-client configuration.
/* Multi-Client PE Router Topology */
┌─────────────────┐ ┌─────────────────┐
│ CLIENT-A CE │ │ CLIENT-B CE │
│ AS: 65100 │ │ AS: 65200 │
│ LAN: 10.1.0.0/16│ │ LAN: 10.2.0.0/16│
└────────┬────────┘ └────────┬────────┘
│ Gi0/0/1 │ Gi0/0/2
│ 192.168.10.2/30 │ 192.168.20.2/30
│ │
┌────────┴────────────────────────────┴────────┐
│ PROVIDER EDGE (PE) ROUTER │
│ IOS-XE / Catalyst 8000 │
│ Local AS: 65000 │
│ Loopback0: 1.1.1.1/32 │
│ Core Interface: Gi0/0/0 → P Router │
└──────────────────────┬───────────────────────┘
│ Gi0/0/0 (MPLS Core)
│ 10.0.0.1/30
│
┌─────────┴──────────┐
│ MPLS CORE (P) │
│ LDP + VPNv4 iBGP │
└────────────────────┘
📋 Configuration Parameters:
- PE Router ASN: 65000
- Client A VRF: VRF_CLIENT_A | RD: 65000:100 | RT: 65000:100
- Client B VRF: VRF_CLIENT_B | RD: 65000:200 | RT: 65000:200
- PE-CE Routing: eBGP (Client A AS 65100, Client B AS 65200)
- Core Protocol: MPLS LDP + OSPF (IGP) + MP-BGP VPNv4
4. Step 1: Enable CEF & MPLS Globally
MPLS and VRFs require Cisco Express Forwarding (CEF) to be enabled globally. This is the foundational switching path for all MPLS L3VPN operations.
IOS-XE CLI — Global CEF & MPLS
configure terminal
# Enable CEF (required for MPLS & VRFs)
ip cef
ipv6 cef
# Enable MPLS label distribution globally (optional but recommended)
mpls label protocol ldp
end
5. Step 2: Create VRFs for Client A & Client B
Define the VRF instances, assign unique Route Distinguishers, and configure Route Targets for import/export control.
IOS-XE CLI — VRF Definition & RD/RT
configure terminal
# ============================================
# VRF FOR CLIENT A
# ============================================
vrf definition VRF_CLIENT_A
description Client-A MPLS L3VPN
rd 65000:100
!
address-family ipv4
route-target export 65000:100
route-target import 65000:100
exit-address-family
!
# ============================================
# VRF FOR CLIENT B
# ============================================
vrf definition VRF_CLIENT_B
description Client-B MPLS L3VPN
rd 65000:200
!
address-family ipv4
route-target export 65000:200
route-target import 65000:200
exit-address-family
!
end
⚠️ Important: The RD makes routes unique in the core. The RT controls route sharing. If you ever need Client A and Client B to share specific routes (extranet/hub-and-spoke), you would import each other's RTs. For strict isolation, keep RTs separate as shown above.
6. Step 3: Assign Client Interfaces to VRFs
Bind the physical or subinterfaces facing each client to their respective VRFs. Note: Applying vrf forwarding removes the existing IP address — you must re-apply it.
IOS-XE CLI — Interface VRF Binding
configure terminal
# Client A Interface
interface GigabitEthernet0/0/1
description TO-CLIENT-A-CE
vrf forwarding VRF_CLIENT_A
ip address 192.168.10.1 255.255.255.252
no shutdown
!
# Client B Interface
interface GigabitEthernet0/0/2
description TO-CLIENT-B-CE
vrf forwarding VRF_CLIENT_B
ip address 192.168.20.1 255.255.255.252
no shutdown
!
end
7. Step 4: Configure PE-CE Routing per VRF
Establish routing between the PE and each client's CE router. We'll use eBGP as it's the industry standard for MPLS L3VPN PE-CE peering. Each BGP neighbor is configured under the specific VRF address family.
IOS-XE CLI — PE-CE eBGP per VRF
configure terminal
router bgp 65000
# Client A PE-CE BGP Session
address-family ipv4 vrf VRF_CLIENT_A
neighbor 192.168.10.2 remote-as 65100
neighbor 192.168.10.2 description CLIENT-A-CE
neighbor 192.168.10.2 activate
# Optional: Advertise default route or redistribute connected/static
network 192.168.10.0 mask 255.255.255.252
exit-address-family
!
# Client B PE-CE BGP Session
address-family ipv4 vrf VRF_CLIENT_B
neighbor 192.168.20.2 remote-as 65200
neighbor 192.168.20.2 description CLIENT-B-CE
neighbor 192.168.20.2 activate
network 192.168.20.0 mask 255.255.255.252
exit-address-family
!
end
✅ Pro Tip: If the client uses OSPF or static routing instead of BGP, configure it under the VRF context: router ospf 100 vrf VRF_CLIENT_A or ip route vrf VRF_CLIENT_A .... The VRF isolation remains identical regardless of PE-CE protocol.
8. Step 5: Configure MP-BGP (VPNv4) for Route Exchange
PE routers must exchange customer routes across the MPLS core using the VPNv4 address family. This is where iBGP peering between PEs happens, along with extended community (RT) propagation.
IOS-XE CLI — MP-BGP VPNv4 Configuration
configure terminal
router bgp 65000
# Define the remote PE neighbor (under global BGP first)
neighbor 2.2.2.2 remote-as 65000
neighbor 2.2.2.2 description REMOTE-PE-ROUTER
neighbor 2.2.2.2 update-source Loopback0
neighbor 2.2.2.2 next-hop-self
# Activate VPNv4 address family for MPLS L3VPN
address-family vpnv4
neighbor 2.2.2.2 activate
neighbor 2.2.2.2 send-community extended
neighbor 2.2.2.2 next-hop-self
exit-address-family
!
end
🔍 Why send-community extended is critical:
Route Targets are carried as BGP extended communities. Without this command, the remote PE will receive the VPNv4 routes but will not know which VRF to import them into — causing complete L3VPN failure. Always verify this is applied to all VPNv4 neighbors.
9. Step 6: Enable MPLS & LDP on Core Interfaces
MPLS label switching must be enabled on all interfaces facing the MPLS core (P routers or other PEs). LDP will automatically distribute labels for IGP routes.
IOS-XE CLI — Core Interface MPLS/LDP
configure terminal
# Core-facing interface
interface GigabitEthernet0/0/0
description TO-MPLS-CORE-P-ROUTER
ip address 10.0.0.1 255.255.255.252
mpls ip
mpls ldp discovery transport-address interface
no shutdown
!
# Enable LDP Router ID (best practice: use Loopback)
mpls ldp router-id Loopback0 force
end
10. Verification & Troubleshooting Commands
Use these operational commands to validate VRF isolation, MP-BGP peering, label distribution, and end-to-end L3VPN connectivity.
IOS-XE CLI — MPLS L3VPN Verification
# 1. Verify VRFs are created and interfaces assigned
show vrf detail
show ip interface brief vrf VRF_CLIENT_A
show ip interface brief vrf VRF_CLIENT_B
# 2. Check VRF routing tables (isolated per client)
show ip route vrf VRF_CLIENT_A
show ip route vrf VRF_CLIENT_B
# 3. Verify MP-BGP VPNv4 neighbor state
show bgp vpnv4 unicast all summary
# 4. View VPNv4 routes received from remote PE
show bgp vpnv4 unicast all
# 5. Check which routes are imported into each VRF
show ip bgp vpnv4 vrf VRF_CLIENT_A
show ip bgp vpnv4 vrf VRF_CLIENT_B
# 6. Verify MPLS LDP neighbor & label bindings
show mpls ldp neighbor
show mpls ldp bindings
show mpls forwarding-table
# 7. Test end-to-end VRF connectivity
ping vrf VRF_CLIENT_A 10.1.1.1 source 192.168.10.1
ping vrf VRF_CLIENT_B 10.2.2.2 source 192.168.20.1
# 8. Trace MPLS label-switched path
traceroute vrf VRF_CLIENT_A 10.1.1.1
ASN:ClientID or PE-Loopback:VRF-ID. Never reuse RDs across different VRFs.
neighbor x.x.x.x password), prefix-lists, and maximum-prefix limits on CE-facing BGP sessions to prevent route leaks or hijacking.
mpls ldp sync under your IGP process.
maximum routes per VRF and monitor via SNMP/Telemetry.
12. Frequently Asked Questions (AEO Optimized)
Structured for Google Featured Snippets, ChatGPT answers, Perplexity AI, voice search, and Answer Engine Optimization (AEO).
13. Final Configuration Checklist
✅ Multi-Client MPLS PE Deployment Checklist:
ip cef)send-community extended applied to VPNv4 peers🌐 Multi-Client MPLS L3VPN Successfully Configured!
Your PE router now securely isolates and routes traffic for two independent clients over a shared MPLS core — with full VRF separation, MP-BGP scalability, and production-ready best practices.
📚 Bookmark This Guide | Share with Your Network Team🏷️ SEO & AEO Tags — Related Keywords:
<
