MPLS Networks and Services: A Practical Beginner's Guide

Multiprotocol Label Switching (MPLS) is a provider-network technology that forwards traffic across a shared backbone using short labels. Its value is not simply faster forwarding: MPLS provides a foundation for private Layer 2 and Layer 3 connectivity, multicast distribution, traffic engineering, quality of service (QoS), and resilient WAN services.

This guide explains the basic concepts first, then shows where each MPLS service fits—including multicast IPTV.

MPLS in one minute

In conventional IP forwarding, every router makes a forwarding decision using the destination address. In MPLS, the edge of the provider network classifies traffic and places one or more labels on it. Core routers then use those labels to send traffic along an established Label Switched Path (LSP).

Customer site A Provider MPLS network Customer site B
+-------------+ +------+ +-----+ +-----+ +------+ +-------------+
| CE router |-----| PE |-----| P |-----| P |-----| PE |-----| CE router |
+-------------+ +------+ +-----+ +-----+ +------+ +-------------+
push swap swap pop
labels labels

MPLS labels identify a forwarding treatment or path, rather than an endpoint. A packet can carry a label stack, allowing the network to combine transport, VPN, and traffic-engineering functions.

MPLS is often called a “Layer 2.5” technology because its label sits between the Layer 2 frame header and Layer 3 packet header. In practice, focus less on the layer label and more on its role: it provides a shared transport under multiple services.

Core building blocks

Term	Meaning	What it does
CE	Customer Edge	Customer router, switch, firewall, or host-facing device connected to the provider
PE	Provider Edge	Provider router that delivers customer services and adds or removes labels
P router	Provider/core router	Transit router that forwards labeled packets across the provider core
LER	Label Edge Router	Another name for an edge MPLS router; an ingress LER pushes labels and an egress LER removes them
LSR	Label Switch Router	MPLS-capable router that forwards traffic by examining labels
LSP	Label Switched Path	The path through the MPLS domain used by labeled packets
FEC	Forwarding Equivalence Class	A group of packets that receive the same MPLS forwarding treatment
LDP	Label Distribution Protocol	Common protocol used to distribute transport labels
BGP	Border Gateway Protocol	Used extensively to distribute VPN routes and VPN labels in L3VPN deployments
RSVP-TE / SR-MPLS	Traffic-engineering technologies	Methods for policy-driven paths, capacity planning, and protection

At ingress, a PE classifies traffic into a forwarding equivalence class and pushes a label or label stack. P routers typically swap the top label as the packet crosses the core. At egress, the PE pops the transport label and delivers the packet into the correct customer service.

Why providers use MPLS

MPLS lets a provider operate one backbone while separating many customers and services. Important benefits include:

• Private connectivity: Customer traffic can be isolated into virtual services over shared infrastructure.
• QoS: Voice, IPTV, critical applications, and best-effort traffic can receive different forwarding treatment.
• Resilience: Fast-reroute and engineered paths can reduce the impact of failures.
• Service flexibility: The same core can support Ethernet transport, routed VPNs, multicast VPNs, Internet access, mobile backhaul, and cloud connectivity.
• Operational scale: Core routers can forward based on labels without learning every customer route.

MPLS does not encrypt traffic by itself. If confidentiality against the provider, a compromised access link, or other intermediaries is required, add encryption such as IPsec, MACsec, or an application-layer mechanism.

The service families

The most common customer-facing MPLS services are L2VPN, L3VPN, and Multicast VPN (MVPN). Transport and value-added capabilities support those services.

Family	Main services	Customer view	Best fit
Layer 2 VPN	VPWS, E-Line, VLL, pseudowire, VPLS, EVPN	Provider carries Ethernet frames or another Layer 2 service	Transparent point-to-point or multipoint Ethernet connectivity
Layer 3 VPN	MPLS L3VPN, VPRN, VRF-based VPN	Provider supplies a private routed IP network	Multi-site enterprise WANs and managed routing
Multicast VPN	MVPN, mLDP, P2MP transport	Provider carries multicast state and traffic within a VPN	IPTV, video, market data, enterprise multicast
Transport	LDP LSPs, RSVP-TE, SR-MPLS, FRR	Controlled backbone forwarding	Path selection, protection, and capacity engineering
Value-added services	QoS, Internet VRF, cloud on-ramp, DCI, managed SD-WAN	Operational and application-specific services	End-to-end WAN solutions

Layer 2 VPN services

A Layer 2 VPN delivers connectivity at the Ethernet or other data-link layer. The customer retains control of IP addressing, routing protocols, and most Layer 3 design choices. The provider transports the customer’s frames across the MPLS backbone.

Service	Topology	What it emulates	Typical use
VPWS / VLL / E-Line	Point to point	A virtual Ethernet circuit between two locations	Site-to-site Ethernet, branch-to-data-center, wholesale handoff
Pseudowire	Usually point to point	Ethernet, TDM, ATM, or Frame Relay transport over MPLS	Legacy-service migration and specialized transport
VPLS / E-LAN	Multipoint to multipoint	A shared virtual Ethernet switch or LAN	Several sites in one broadcast domain
EVPN over MPLS	Multipoint, EVPN-controlled	Modern Ethernet VPN with control-plane MAC distribution	Data-center interconnect and scalable multi-site Ethernet
E-Access	Provider-to-provider access	Ethernet access toward another carrier service	Wholesale or inter-provider connectivity

When L2VPN is a good choice

Choose an L2 service when a customer needs a transparent Ethernet handoff, must run its own routing design end-to-end, or needs to transport non-IP or specialized Layer 2 traffic. A point-to-point service is usually simpler than extending a large multipoint broadcast domain.

Be cautious with a large VPLS-style design: broadcasts, unknown unicast traffic, MAC learning, and failure domains can grow with the number of connected sites. EVPN can improve control-plane scalability, but it still needs disciplined Layer 2 design.

Layer 3 VPN services

An MPLS Layer 3 VPN, often called L3VPN or VPRN, gives each customer a logically separate routing domain. The PE keeps customer routes in a Virtual Routing and Forwarding (VRF) table; the provider transports those routes and packets across the MPLS backbone.

Customer site A Customer site B
10.10.1.0/24 10.10.2.0/24
| |
CE-A --- PE-A [ VRF: CUSTOMER-A ] === MPLS core === [ VRF: CUSTOMER-A ] PE-B --- CE-B

A common L3VPN packet carries two labels:

1. Outer transport label: Takes the packet across the provider network toward the egress PE.
2. Inner VPN label: Identifies the correct customer VRF and forwarding context at that egress PE. | Capability | L3VPN behavior | | :— | :— | | Customer routing | Customer and provider exchange routes at each CE-PE connection using static routes, BGP, OSPF, EIGRP, or another supported protocol | | Customer separation | Separate VRFs and VPN route policies prevent ordinary cross-customer forwarding | | Core routing scale | P routers generally forward labeled traffic without holding customer VPN routes | | Extranet connectivity | Controlled route leaking can permit specific communication with a partner, shared service, or Internet VRF | | Internet access | Can be centralized through a firewall, secure Internet gateway, or dedicated Internet VRF | | IPv6 | IPv6 VPN services can be carried across an MPLS backbone using technologies such as 6VPE |

When L3VPN is a good choice

Choose L3VPN when sites need a private routed WAN and the provider should manage or participate in WAN routing. It is usually easier to scale than a large Layer 2 domain, contains broadcast traffic at each site, and allows strong route policy between sites.

L2VPN and L3VPN compared

Design question	L2VPN	L3VPN
What does the provider transport?	Customer Ethernet frames or other Layer 2 traffic	Customer IP packets within a VRF
Who owns the routing design?	Primarily the customer	Shared responsibility; provider participates at CE-PE boundaries
Is the service transparent to Layer 3?	Yes, generally	No; it is a routed service
Broadcast domain	Can span sites, especially in multipoint services	Contained locally at each routed site
Best use	Ethernet extension, special protocols, customer-controlled routing	Scalable enterprise WAN and managed IP connectivity
Common concern	Broadcast/MAC scale and operational complexity	Route-policy design and CE-PE routing coordination

A simple rule: choose L2VPN when the required deliverable is an Ethernet circuit; choose L3VPN when the required deliverable is a private routed WAN.

Multicast and IPTV

Multicast is essential for efficient live IPTV. Instead of sending a separate unicast stream to every viewer, the network carries one copy of a channel until a replication point, then forwards copies only toward access segments with interested viewers.

One stream: (S,G)
IPTV headend -------------------- Provider multicast/MPLS core
| |
| +--- Access area A ---> viewers of Channel 101
| |
| +--- Access area B ---> viewers of Channel 101
|
+-- Channel source

For example, if 10,000 viewers watch a 6 Mb/s channel, unicast delivery from the headend would require roughly 60 Gb/s before considering overhead. Multicast keeps the source-side load close to one 6 Mb/s stream and replicates traffic only where the distribution tree branches. Actual bandwidth in the access and aggregation network still depends on where viewers are located.

IPTV multicast components

Network area	Typical protocol or feature	Function
Set-top box, smart TV, or home gateway	IGMPv2/IGMPv3	Joins or leaves a TV channel multicast group
Ethernet access switch	IGMP snooping	Sends channel traffic only to ports with interested receivers
Routed access / aggregation	IGMP proxy or PIM	Aggregates joins and builds multicast forwarding state upstream
IPTV source / headend	Multicast source and encoder	Produces live channels, commonly identified by source and multicast group
PE routers	VRF multicast routing	Keeps each multicast VPN separate
MPLS core	MVPN, mLDP, RSVP-TE P2MP, or SR-MPLS P2MP	Carries the multicast distribution tree across the provider backbone
Operations	QoS, OAM, telemetry	Measures joins, loss, jitter, delay, and multicast state

ASM versus SSM

Model	Receiver request	Operational model	IPTV suitability
ASM (Any-Source Multicast)	Join group G	Receivers can accept traffic from one or more sources; commonly uses PIM-SM and an RP	Useful for legacy compatibility, but more control-plane complexity
SSM (Source-Specific Multicast)	Join source and group (S,G)	Receiver explicitly requests a known source; commonly uses IGMPv3 and PIM-SSM	Usually the preferred model for controlled IPTV channel delivery

For a modern managed IPTV network, use IGMPv3 and PIM-SSM where endpoint support permits it. The explicit source-and-group model reduces ambiguity and avoids rendezvous-point dependence for channel delivery.

MVPN in the MPLS core

Multicast VPN extends multicast routing into an MPLS L3VPN. It maintains multicast state per customer VRF and transports multicast packets across the provider backbone without exposing traffic to unrelated VPNs.

A common model includes:

• A default multicast distribution tree (MDT) for control traffic and lower-rate multicast traffic.
• A data MDT or another dedicated tree for high-bandwidth channels, so PEs with no viewers do not need to receive that channel.
• mLDP or point-to-multipoint traffic-engineering transport, depending on platform and design requirements.

For large IPTV deployments, the primary objective is to avoid carrying every channel to every provider edge. Build trees only toward PEs and access areas with active receivers.

IPTV QoS guidance

IPTV is sensitive to packet loss, jitter, and congestion. A provider design should classify video close to ingress, reserve or assure capacity where appropriate, and apply consistent QoS treatment across access, aggregation, MPLS core, and egress.

• Give real-time voice and IPTV explicit, documented forwarding classes; do not rely on default best-effort behavior.
• Police or shape at service boundaries to prevent one subscriber or service from consuming shared capacity.
• Protect control traffic such as IGMP and routing protocols from starvation.
• Monitor packet loss, join/leave latency, multicast-tree state, stream bitrate, and per-interface congestion.
• Use redundant headends, diverse paths, and fast failure detection where service availability requires it.

Transport and traffic engineering

The MPLS transport layer connects PE routers. The exact control plane depends on network evolution and vendor support.

Technology	Main purpose	Typical role
LDP	Distribute labels for IGP-reachable prefixes	Straightforward MPLS transport in established networks
RSVP-TE	Establish bandwidth-aware, explicitly routed tunnels	Classical MPLS traffic engineering and point-to-multipoint trees
Segment Routing MPLS (SR-MPLS)	Steer packets using a stack of segment identifiers	Modern policy-based traffic engineering with a simplified control-plane model
BGP	Distribute VPN routes and service information	Foundation for scalable L3VPN and EVPN control planes
Fast Reroute (FRR)	Locally protect traffic after failures	Faster service restoration
BFD	Detect failures rapidly	Works with routing and protection mechanisms

Traffic engineering should solve a specific operational problem—such as congested paths, latency targets, capacity constraints, or resilience requirements. It adds design and operational complexity, so it is not automatically necessary for every MPLS deployment.

Service selection guide

Requirement	Usually start with	Why
Connect exactly two Ethernet handoffs	VPWS / E-Line / VLL	Simple, transparent point-to-point service
Extend a VLAN or Ethernet domain across several sites	EVPN-MPLS or VPLS	Multipoint Layer 2 connectivity; EVPN generally offers a stronger control plane
Build a private routed WAN for branches	MPLS L3VPN	Scalable routing separation through VRFs
Allow selected partner or shared-service access	L3VPN with controlled route leaking	Explicit policy limits connectivity to approved prefixes
Deliver live TV channels to many subscribers	MVPN with IGMP snooping and PIM-SSM	Efficient one-to-many distribution
Carry legacy TDM or specialist Layer 2 traffic	Pseudowire / circuit emulation	Preserves service behavior during migration
Connect sites to public cloud privately	L3VPN or Ethernet service plus cloud on-ramp	Predictable private path with provider integration
Need application-aware hybrid WAN	Managed SD-WAN plus MPLS/Internet underlay	Uses MPLS where predictable performance matters and Internet where appropriate

A practical design checklist

Before choosing or deploying a service, answer these questions:

1. Connectivity model: Is the requirement point-to-point, hub-and-spoke, full mesh, or any-to-any?
2. Service layer: Does the customer need transparent Ethernet, or a routed IP service?
3. Routing ownership: Who manages WAN routes and failure behavior—the customer, provider, or both?
4. Multicast requirement: Are live IPTV, video, financial feeds, or other one-to-many applications required?
5. QoS classes: Which traffic needs priority, assurance, or latency protection?
6. Scale: How many sites, prefixes, MAC addresses, multicast groups, and simultaneous viewers are expected?
7. Resilience target: What recovery objective is required for a link, node, or path failure?
8. Security: Is traffic separation sufficient, or is encryption also required?
9. Operations: How will the team monitor latency, loss, utilization, multicast joins, and SLA compliance?
10. Migration: Must legacy Ethernet, TDM, IPv4, IPv6, or cloud environments coexist during transition?

Key takeaways

• MPLS is a shared provider transport that uses labels to carry many distinct services.
• L2VPN delivers transparent Layer 2 connectivity; L3VPN delivers private routed IP connectivity using VRFs.
• MVPN extends multicast inside an MPLS VPN and is a core building block for scalable IPTV.
• IPTV typically combines IGMP at the subscriber edge, IGMP snooping in Layer 2 access, PIM or IGMP proxy in routed access, MVPN in the provider core, and QoS across the entire path.
• MPLS provides traffic separation but not encryption by default.
• The correct service starts with the required customer handoff and traffic behavior, not with a preferred protocol.