JNCIA MPLS and VPNs 1 — Questions and Answers
Question 1: What does MPLS stand for and what is its primary purpose?
- Multi-Protocol Label Switching — a technique that forwards packets using short fixed-length labels instead of IP routing lookups (Correct answer)
- Multi-Path Link Selection — a load balancing protocol
- Multiple Protocol Layer Security — a VPN encryption standard
- Multi-Point Label Service — a multicast protocol
Correct answer: Multi-Protocol Label Switching — a technique that forwards packets using short fixed-length labels instead of IP routing lookups
MPLS is a packet-forwarding technique that adds short labels to packets at the network edge. Core routers forward packets based on labels rather than performing full IP routing table lookups, enabling speed, traffic engineering, and VPN services.
MPLS (RFC 3031) adds a 32-bit label between the Layer 2 and Layer 3 headers (a 'shim' header). Ingress LSR (Label Switch Router) classifies packets into FECs (Forwarding Equivalence Classes) and pushes labels. Core LSRs (transit) swap labels and forward without IP lookup. Egress LSR pops labels and delivers to IP destination. Benefits: traffic engineering with RSVP-TE, Layer 3 VPNs (L3VPN/BGP-MPLS-VPN), Layer 2 VPNs (L2VPN, VPLS, EVPN), fast reroute (FRR), and QoS via EXP bits.
Question 2: What is an LSP (Label Switched Path) in MPLS?
- A unidirectional predetermined path through an MPLS network along which labeled packets are forwarded using swapped labels at each hop (Correct answer)
- A bidirectional encrypted tunnel
- A routing table entry for MPLS prefixes
- A dynamic load-balanced path between two endpoints
Correct answer: A unidirectional predetermined path through an MPLS network along which labeled packets are forwarded using swapped labels at each hop
An LSP is a unidirectional path from an ingress LSR to an egress LSR through one or more transit LSRs. Each LSR along the path has a label binding that maps the incoming label to an outgoing label and interface.
LSPs are established by two main signaling protocols: LDP (Label Distribution Protocol) — distributes labels based on IGP routes, creating hop-by-hop LSPs for each FEC (typically IP prefix); RSVP-TE (Resource Reservation Protocol - Traffic Engineering) — establishes explicitly routed LSPs with bandwidth reservation and constraint-based routing. In Junos, MPLS is configured under [edit protocols mpls] and interfaces are added with 'set protocols mpls interface ge-x/x/x'. 'show mpls lsp' displays established LSPs.
Question 3: What is the purpose of a BGP L3VPN (RFC 4364)?
- To provide IP VPN service over an MPLS backbone, separating customer routing with VRFs and using MP-BGP to distribute customer routes between PE routers (Correct answer)
- To encrypt BGP sessions between AS peers
- To provide Layer 2 point-to-point connectivity over MPLS
- To create a VPN for BGP route reflectors
Correct answer: To provide IP VPN service over an MPLS backbone, separating customer routing with VRFs and using MP-BGP to distribute customer routes between PE routers
BGP L3VPN (formerly RFC 2547) uses MPLS labels and MP-BGP with VPNv4 address family to create separate per-customer routing domains (VRFs) connected across an MPLS service provider network.
BGP L3VPN components: VRF (Virtual Routing and Forwarding) — per-customer routing table on PE routers; Route Distinguisher (RD) — makes customer routes globally unique in MP-BGP; Route Target (RT) — controls VRF route import/export policy; MP-BGP VPNv4 — carries customer routes between PE routers with two-level label stack (inner: VPN label for VRF, outer: transport LSP label). In Junos: [edit routing-instances customer-name instance-type vrf] with 'route-distinguisher', 'vrf-target', 'interface' definitions.
Question 4: In Junos MPLS, what is the difference between LDP and RSVP-TE?
- LDP creates hop-by-hop LSPs following IGP paths without traffic engineering; RSVP-TE creates explicitly routed, bandwidth-reserved LSPs for traffic engineering (Correct answer)
- LDP is for IPv6 only; RSVP-TE is for IPv4 only
- LDP is faster than RSVP-TE for all use cases
- RSVP-TE is deprecated in modern Junos
Correct answer: LDP creates hop-by-hop LSPs following IGP paths without traffic engineering; RSVP-TE creates explicitly routed, bandwidth-reserved LSPs for traffic engineering
LDP distributes labels based on IGP routing and creates LSPs that follow the IGP shortest path. RSVP-TE allows explicit path specification, bandwidth reservation, and constraint-based routing for traffic engineering applications.
LDP (RFC 5036): simple, follows IGP; no traffic engineering capability; good for L3VPN transport in simple networks. RSVP-TE (RFC 3209): supports ERO (Explicit Route Object) for path control; reserves bandwidth along the path; enables traffic engineering (divert traffic from congested paths); supports FRR (Fast Reroute) for sub-50ms protection. In Junos: LDP under [edit protocols ldp]; RSVP under [edit protocols rsvp] with MPLS under [edit protocols mpls label-switched-path]. Modern networks increasingly use SR-MPLS or SRv6 instead.
Question 5: What is a Route Distinguisher (RD) in the context of Junos L3VPN?
- A 64-bit value prepended to customer IPv4 prefixes to create unique VPNv4 routes in MP-BGP, allowing the same IP prefix to exist in multiple VRFs (Correct answer)
- A routing metric used to prefer one VPN path over another
- A tag that identifies the service provider's AS
- A security token for VPN authentication
Correct answer: A 64-bit value prepended to customer IPv4 prefixes to create unique VPNv4 routes in MP-BGP, allowing the same IP prefix to exist in multiple VRFs
The Route Distinguisher makes customer IPv4 routes globally unique in the BGP table. The same prefix (e.g., 10.0.0.0/8) can exist in multiple customer VRFs without conflict because each VRF has a different RD prepended.
The RD is a 64-bit value in format ASN:number (e.g., 65000:1), IP:number, or 4-byte-ASN:number. It is prepended to the 32-bit IPv4 prefix to create a 96-bit VPNv4 prefix for MP-BGP distribution. The RD is locally significant — it only guarantees uniqueness in the BGP table. Route Targets (RTs) control which VRF imports which VPNv4 routes. In Junos: 'set routing-instances VRF-NAME route-distinguisher 65000:100'. Best practice: unique RD per VRF per PE.
Question 6: What is the 'penultimate hop popping' (PHP) mechanism in Junos MPLS?
- The second-to-last LSR pops the label before the egress LSR, so the egress processes the IP packet directly without needing to look up the MPLS label (Correct answer)
- The last LSR pops the label and re-routes based on IP
- PHP is a security mechanism to prevent label spoofing
- PHP eliminates the need for an egress LSR in MPLS
Correct answer: The second-to-last LSR pops the label before the egress LSR, so the egress processes the IP packet directly without needing to look up the MPLS label
PHP allows the penultimate (second-to-last) LSR to remove the MPLS label before forwarding to the egress LSR. This saves one label lookup on the egress LSR, which only needs to do an IP lookup.
Without PHP, the egress LSR does two lookups: first looks up the incoming label (to pop it), then does an IP lookup. With PHP, the penultimate LSR pops the label using the special 'implicit-null' label (value 3). The egress LSR receives a plain IP packet and only needs one IP lookup. This is the default behavior in Junos when LDP allocates labels. 'Explicit-null' (label value 0) is used when the egress LSR needs to process the CoS EXP bits from the label stack before IP forwarding. Configurable in Junos with RSVP-TE LSP options.
JNCIA MPLS and VPNs 1
What does MPLS stand for and what is its primary purpose?