I configured MPLS/LDP in all interfaces of my testbed network. It is ran under IS-IS Level 1.

I know and understand the benefits of MPLS (l3VPN or l2VPN).

My question is : MPLS is used in whole internal network ? For example, when I ping from one of my router localted directly in my network (with IGP configured) to another one, the packets are encapsulated in MPLS even if the target router is located in the same "internal network" ?

And if this is the case, how do I perform ECMP/load balancing if the forwarding is based on labels ?

2 Answers 2


It depends what you are advertising into LDP. If your ping is to a destination address that is advertised by LDP and there is an end-to-end LSP for that destination, then the ping will be encapsulated and MPLS switched, even if the destination is in the global table. This is how the outer (tunnel) LSP works in MPLS VPN

By default Cisco networks advertise all global networks into LDP. Therefore by default all global traffic is MPLS switched. It is best practice to filter the LDP announcements to only cover the loopback addresses of the PE routers as there is usually no need to use MPLS for any other internal networks. The command mpls ldp advertise-labels for ACL to ACL is used to control advertisement of labels for specific prefixes to LDP peers.

If you want to check whether a destination will be MPLS forwarded, try “show ip cef destination-ip detail”, if you see a label value after the next-hop then you know the IP packet will be MPLS encapsulated and label switched at least to the next-hop. You can also check the MPLS forwarding table (show mpls forwarding-table) and that will show the inbound and outbound labels as well as the prefix.

You may also get a situation where traffic is MPLS encapsulated in only one direction, so the traffic follows an LSP to the destination, but is not encapsulated on the way back. If you are only advertising loopbacks via LDP and you send a ping to a loopback destination address, but source the ping from an IP that is not advertised by LDP then the ping will follow an LSP to the destination, but the return traffic will be normally IP switched (no MPLS) back to the source.

Another thing to consider is penultimate hop popping. If the destination is only a single hop away, the other LSR will advertise a null label. In this case, instead of labelling the traffic the router will forward the raw IP packet to reduce the number of lookups required on the destination router. In this scenario your traffic is unlabelled, although technically it is following an LSP.

ECMP with MPLS works in a similar way to normal CEF load balancing. If there are two different equal cost next-hops for a destination, the MPLS traffic will also be load balanced between the two destinations, using separate LSPs. If you look at the output from “show ip cef destination-ip internal” it may show you the load balancing

  • I notice that LDP have a preference of 9 (or 8, don't remember and I have not access to my testbed actually) and IS-IS a preference of 15. If I change this, and make IS-IS with a better preference than LDP, the router will continue to encapsulate the packets ?
    – Eraseth
    Apr 6, 2018 at 17:31

For example, when I ping from one of my router localted directly in my network (with IGP configured) to another one, the packets are encapsulated in MPLS even if the target router is located in the same "internal network" ?

It depends. If the source interface is in a VRF, then the packet will be encapsulated. If it's in the global table, then no.

how [do I] perform ECMP/load balancing if the forwarding is based on labels ?

Quoting from Cisco support forum :

Destination based load balancing in MPLS L3VPNs can be categorized into two scenarios:

1) multiple pathes between two PE routers

2) multiple access links to a single CE or site

Your question as I understand it was about the first scenario. So let me first quickly review how customer traffic is forwarded between VRFs on two different PE routers.

The VRF routing table will have BGP entries for the routes learned from the remote PE usually with next hop addresses being the remote PE loopback IP used for PE-to-PE BGP peering.

The traffic will be forwarded across P routers using the label for the BGP next hop.

Thus the load balancing accross the MPLS core in a first step is decided by the IGP, which has to insert several equal cost pathes into the global routing table for the BGP next hop networks (PE loopbacks).

Side note: MPLS traffic engineering in the core would allow for unequal cost load balancing.

The decision, which labeled packet to send across which path in the core is done by CEF using a hash algorithm. To achieve the same load balancing as with unlabeled IP traffic, a Cisco MPLS enabled router will look for the bottom label - the one with bottom-of-stack bit set to 1 - and try to determine, if the transported packet behind the bottom label is IP. If so, the hash is calculated for the customer IP header like for normal IP traffic. This ensures all traffic for a certain customer destination will always go through the same path. No unwanted packet reordering will occur.

Be aware, that the customer IP packet header will only be used for CEF hash calculation, no IP lookup will be performed, as core routers in MPLS L3VPNs do not have any knowledge about customer addresses.

As a side note: if the traffic transported is not IP (e.g. Ethernet over MPLS), the bottom label will be used for the CEF load balancing (e.g. the VC label).

For the second scenario - CE load balancing with multihomed CE/sites - it is first required to have two equal cost entries in the VRF routing tables. The difference will be the two different PE BGP next hop addresses. The first load balancing decision is the performed by CEF based on the IP packet received by the CE and the VRF routing table entries. Once CEF decided, which VRF entry to use, the required BGP next hop label (and the VPN label) is applied and the packet is transported across the MPLS core. load balancing there is done as described above.

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .