# MPLS Layer 3 VPN Explained **URL:** \ **Category:** Lessons Discussion\ **Created:** [December 29, 2016, 8:08pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287 "2016-12-29T20:08:31Z")\ **Posts on this page:** 20\ **Page:** 9
**Author:** ![dorsinai1004](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/d/f17d59/32.png) [@dorsinai1004](https://forum.networklessons.com/u/dorsinai1004)\ **Post date:** [January 30, 2021, 11:59am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/167 "2021-01-30T11:59:42Z")
Hey rene, During the lesson you keep writing about prefix. Is a prefix consists the IP address which is 32 bits long or both the IP address and the subnet mask which are 64 bits long combined. At first place I assumed you meant just the IP address portion but after i saw your diagram I got a bit confused. ![image](https://cdn-forum.networklessons.com/uploads/default/original/2X/4/403c799ddf3a38a6ea91b88ee0419b5b168ffe0f.png) ![image](https://cdn-forum.networklessons.com/uploads/default/original/2X/a/a93aeb0f4f04234dc7048aba15e950f9c6daf068.png) Can you please clarify it to me? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [January 31, 2021, 4:39pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/168 "2021-01-31T16:39:43Z")
Hello Dor The prefix is the destination network and is denoted using the network address. In the context of MPLS, but also when referring to routing protocols and routing tables, the word prefix is almost always used to describe the destination network. You can find prefixes in the routing table, the BGP table, the MPLS forwarding table, and you can also find them in the routing updates sent by dynamic routing protocols. For example, in the lesson, 192.168.2.0/24 is a prefix that is shared among routers on the network using MPLS. I hope this has been helpful! Laz ---
**Author:** ![luis.fel.ortiz](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/l/f07891/32.png) [@luis.fel.ortiz](https://forum.networklessons.com/u/luis.fel.ortiz)\ **Post date:** [February 2, 2021, 2:24am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/169 "2021-02-02T02:24:42Z")
Hello Rene, First of all thanks for the content. Not really sure, but ins’t an error on the example 2.2 RT (Route Target) CE advertise prefix PE1 tag the route with the rt I will tent to say this is the export isn’t it ? Then PE2 receives the prefix then import into the vrf and advertise to CE2 instead of exporting, could you please clarify? Thanks ---
**Author:** ![dorsinai1004](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/d/f17d59/32.png) [@dorsinai1004](https://forum.networklessons.com/u/dorsinai1004)\ **Post date:** [February 2, 2021, 6:46am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/170 "2021-02-02T06:46:51Z")
Hey Laz, Thank you for the quick respone. Following your answer, reffering to MPLS, for example - 192.168.10.0/24 (prefix), then how is the prefix 32 bit long if only the ip address (excluding the CIDR) is already 32 bits long? ![image](https://cdn-forum.networklessons.com/uploads/default/original/2X/5/541cf04dfa7c00c84d531d0613adb2845d6b2963.png) ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [February 5, 2021, 6:51am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/171 "2021-02-05T06:51:55Z")
Hello Luis The terms import and export have to do with the specific commands placed within the VRF used for the particular customer connected to that PE router. The `route-target export` command is used to **export routes from the CE** into the PE router and the MPLS domain. The `route-target import` command is used to import routes into the CE from the PE. Now because often the same RT is used for both import and export, this is hard to see. Take a look at the following lesson: > **[MPLS VPN VRF Import Map](https://networklessons.com/mpls/mpls-vpn-vrf-import-map)** > > The import map allows you to selectively import VPN routes into a VRF for MPLS VPN PE-CE topologies. In it, different RTs are used for import and export. You will notice that PE1 uses the 1:1 route target to export prefixes from CE1, and when PE2 receives these, they are indeed appended to RT 1:1 (and not to 2:2 which is the RT for the `import` command). I hope this has been helpful! Laz ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [February 5, 2021, 8:35am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/172 "2021-02-05T08:35:56Z")
Hello Dor The VPNv4 Address is something that contains the RD (64 bits) and the IPv4 Prefix (32 bits). This refers to a particular prefix from a customer. The VPNv4 addresses are advertised between PE routers. Now it is confusing how this VPNv4 address contains information about the prefix length since it is 96 bits in length, there doesn’t seem to be any room for the prefix length information. If you take a look at the BGP prefix within the NLRI in a Wireshark capture, you’ll see that the Prefix Length is one of the parameters there. For example, take a look at this NLRI information: ![image](https://cdn-forum.networklessons.com/uploads/default/original/2X/5/5e7c594e9acc20cb7dd975eeb695e47d184c7dd0.png) The prefix length includes the size of the label as well, which is 24 bits. So for the first BGP prefix, we have 5.5.5.5/32 with a prefix length of 120: - label = 24 bits - RD = 64 bits - IPv4 prefix = 32 - total = 120 For the second BGP prefix, we have 55.55.55.0/32 with a prefix length of 112: - label = 24 bits - RD = 64 bits - IPv4 prefix = 24 - total = 112 Why is the IPv4 prefix 24? Well, it’s 55.55.55.0, which means the last 8 bits are zeros, which means the prefix ends there. I hope this has been helpful! Laz ---
**Author:** ![dorsinai1004](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/d/f17d59/32.png) [@dorsinai1004](https://forum.networklessons.com/u/dorsinai1004)\ **Post date:** [February 5, 2021, 8:55am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/173 "2021-02-05T08:55:13Z")
Hey lagapides, Thank you for the detailed response. The 32 bit prefix has confused me a lot, so i hope Rene would fix it. As i see it, the RD is just to make the prefix unique whereas the RT is added to make the prefix exchangeable between the PE’s in the same VRF, Am I right? ---
**Author:** ![luis.fel.ortiz](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/l/f07891/32.png) [@luis.fel.ortiz](https://forum.networklessons.com/u/luis.fel.ortiz)\ **Post date:** [February 5, 2021, 11:48am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/174 "2021-02-05T11:48:58Z")
Hello Laz, Thanks for tour feedback, I got the points about the RT, but if we refer to image below for me is kind of fuzzy: ![image](https://cdn-forum.networklessons.com/uploads/default/original/2X/d/da690fe6be59bf54b8ac537ace88721f5d8cb22c.jpeg) The step 2 talks about exporting the rt 123:1 on PE2 into vrf CustA, isn’t PE1 already doing this and PE2 importing it, to then advertise prefixes to CE router. Thanks ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [February 7, 2021, 11:55am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/177 "2021-02-07T11:55:14Z")
Hello Dor Yes, the RD is used to keep all prefixes in the BGP table unique, and the RT is used to transfer routes between VRF’s/VPNS. I hope this has been helpful! Laz ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [February 8, 2021, 11:56am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/178 "2021-02-08T11:56:49Z")
Hello Luis Yes I understand the confusion. I will ask Rene to clarify this in the diagrams within the lesson. I hope this has been helpful! Laz ---
**Author:** ![ziyad.barqawi](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/z/90db22/32.png) [@ziyad.barqawi](https://forum.networklessons.com/u/ziyad.barqawi)\ **Post date:** [February 14, 2021, 3:53pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/179 "2021-02-14T15:53:20Z")
- In below topic of mpls a small typing mistake : [https://networklessons.com/mpls/mpls-layer-3-vpn-explained](https://networklessons.com/mpls/mpls-layer-3-vpn-explained) - In below diagram u put **import** instead of **export** : - Also in below screen shot i think u mean **NLRI** instead of **NRL** : ![NLRI](https://cdn-forum.networklessons.com/uploads/default/original/2X/6/6ac4a8cea9da7487b05d576ee4d97df393d97ef6.png) ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [February 16, 2021, 6:10am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/180 "2021-02-16T06:10:27Z")
Hello Ziad Concerning the first issue, the terms are correct. Take a look at this post: > [@MPLS Layer 3 VPN Explained](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/171): > > Hello Luis The terms import and export have to do with the specific commands placed within the VRF used for the particular customer connected to that PE router. The route-target export command is used to export routes from the CE into the PE router and the MPLS domain. The route-target import command is used to import routes into the CE from the PE. Now because often the same RT is used for both import and export, this is hard to see. Take a look at the following lesson: [https://networkles…](https://networklessons.com/mpls/mpls-vpn-vrf-import-map/) As for the second typo, yes I will let Rene know to make the change. Thanks for pointing that out!! Laz ---
**Author:** ![ziyad.barqawi](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/z/90db22/32.png) [@ziyad.barqawi](https://forum.networklessons.com/u/ziyad.barqawi)\ **Post date:** [February 18, 2021, 10:59am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/181 "2021-02-18T10:59:21Z")
thnx for the great update, now i got the point​:victory\_hand:👍 ---
**Author:** ![Networkteam](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/n/e47774/32.png) [@Networkteam](https://forum.networklessons.com/u/Networkteam)\ **Post date:** [February 27, 2021, 3:18pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/182 "2021-02-27T15:18:37Z")
Hello @lagapidis@ReneMolenaar. - I read somewhere that RD is locally significant. can you please elaborate how? - If we use different RDs for same customer on different PEs will it work? & how ? example: RD 1:1 on PE1 and RD 2:2 on PE2 for same customer. ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [March 2, 2021, 10:23am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/183 "2021-03-02T10:23:11Z")
Hello Tejas The RD for a certain VRF does not need to be the same across all of the MPLS domain. The RT will be used to import and export prefixes between VRFs on different PEs. I believe that this Cisco community thread quite clearly explains it: > **[route distinguisher question](https://community.cisco.com/t5/mpls/route-distinguisher-question/td-p/991567)** > > Hi, I need to clear some concept regarding rd, i had a topology from one of the COD in which instructor connects 2 CE sites to each other using VPN\_A but at one PE the configured RD was different and at another PE RD was different. The thing which... Specifically, it states: > MP-BGP exchanges the VPNv4 (RD:IPv4) prefixes between the PEs (P routers are not VPNv4 aware) not IPv4 routes - When a PE receives a VPNv4 route it discards the RD attached to it and attaches its local RD (according to the VRF that the route is going to be injected into according to the attached RT and the local VRFs import RT) - Since for the local router routing table database the VRF is identified via the RD prepended to the IPv4 route to construct the VPNv4 routes. I hope this has been helpful! Laz ---
**Author:** ![THEBILLIONARECLUB](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/t/7feea3/32.png) [@THEBILLIONARECLUB](https://forum.networklessons.com/u/THEBILLIONARECLUB)\ **Post date:** [April 29, 2021, 7:02pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/184 "2021-04-29T19:02:05Z")
This is not a question, but a comment. I wanted to say this before I get tied up on other things and forget. This site is such a great wealth of knowledge. I find myself coming back here more and more for my Technical questions and needs. Your way of Teaching is so concise, clear, straight forward, and easy to understand and to grasp imo. I have CBT Nuggets experience, IPTV pro, INE, Udemy, Global Knowledge, and few others in the past and present. But this site for me is my favorite. Keep up the great work Rene and others. I am learning at an accelerated rate and understanding what it is I am applying. This site is a big part of that. Thanks for being responsive as well! Thanks for the great content guys. ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [May 1, 2021, 5:17am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/185 "2021-05-01T05:17:51Z")
Hello Desmond It’s posts like this that make it all worth it. Thanks so much for your kind words, @ReneMolenaar does his best to ensure the content is useful, relevant, and easy to understand, and we do our best to respond as quickly and comprehensively as possible. We do it because we like what we do. We’ll do our utmost to maintain this QoS if you will (🕶) of the service. We’re happy that the site is a helpful tool in your certification journey, as well as in the development of your skills and knowledge… Keep learning!! Laz ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [May 3, 2021, 8:49am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/186 "2021-05-03T08:49:53Z")
Thank you @THEBILLIONARECLUB for your kind words. I appreciate this. This helps to keep going to create more content 🕶 ---
**Author:** ![hemasundar23](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/h/c89c15/32.png) [@hemasundar23](https://forum.networklessons.com/u/hemasundar23)\ **Post date:** [May 21, 2021, 3:53pm UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/187 "2021-05-21T15:53:49Z")
IF we have tunnel running between two PE routers, then why do we need iBGP, what is the purpose. ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [May 23, 2021, 9:38am UTC](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287/188 "2021-05-23T09:38:51Z")
Hello Hemalatha MPLS VPN is a technology that uses a combination of various features such as LDP, VRFs, and BGP. In the **MP-BGP (Multi Protocol BGP)** section of the following lesson, Rene goes on to explain that iBGP is used between PE routers in order for them to redistrubute and advertise each customer’s VRF routing table between PE routers. Specifically, MP-BGP is used to do so. > **[MPLS Layer 3 VPN Explained](https://networklessons.com/mpls/mpls-layer-3-vpn-explained#MP-BGP_Multi_Protocol_BGP)** > > This lesson explains how we use MP-BGP, Route Distinguishers, Route-Targets and VPN labels to build MPLS L3 VPN topologies. I hope this has been helpful! Laz [Previous page](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287.md?page=8) [Next page](https://forum.networklessons.com/t/mpls-layer-3-vpn-explained/1287.md?page=10)