L2VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Virtual private LAN bridging services

Updated: June 15, 2026

Want to summarize with AI?

Log in

Details VPLS architecture, outlining service characteristics, operational principles, and process flows for implementing multipoint Layer 2 VPN services over packet-switched networks.

A virtual private LAN bridging service is a multipoint Layer 2 VPN service that

  • connects two or more provider edge devices by using bridge domains

  • floods unknown, broadcast, and multicast traffic across the bridged domain, and

  • learns source MAC addresses to forward known unicast traffic to the correct customer edge device.

Table 1. Feature history table

Feature Name

Release Information

Feature Description

Virtual Private LAN Bridging Services

Release 25.1.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on Cisco 8011-4G24Y4H-I routers.

Virtual Private LAN Bridging Services

Release 24.4.1

Introduced in this release on: Fixed Systems (8700) (select variants only*)

*The Virtual Private LAN Bridging Services functionality is now extended to the Cisco 8712-MOD-M routers.

Virtual Private LAN Bridging Services

Release 24.3.1

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])(select variants only*

*The Virtual Private LAN Bridging Services functionality is now extended to:

  • 8212-48FH-M

  • 8711-32FH-M

  • 88-LC1-52Y8H-EM

  • 88-LC1-12TH24FH-E

Virtual Private LAN Bridging Services

Release 24.2.11

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]) (select variants only*)

*The Virtual Private LAN Bridging Services functionality is now extended to routers with the 88-LC1-36EH line cards.

Virtual Private LAN Bridging Services

Release 7.3.2

This feature employs PE routers connected by a mesh of tunnels, enabling you to connect multiple customer devices in a single bridged domain. Such a setup allows service providers to seamlessly offer a variety of services that they can provision rapidly.

VPLS service attributes

Key benefits

A Virtual Private LAN Service (VPLS) enables a service provider to deliver private multipoint Layer 2 VPN services to multiple customers over an MPLS network. These attributes characterize a VPLS service:

  • Customer-specific bridge domains: Each customer receives a dedicated bridge domain, ensuring complete separation and privacy. Packets from one bridge domain are never delivered to another.

  • Attachment circuits: Access to each bridge domain on provider edge (PE) routers is managed through attachment circuits, which can include physical or virtual ports.

  • MAC-based forwarding: The service provider network switches packets within the customer's bridged domain by using destination MAC addresses. Unknown, broadcast, and multicast MAC addresses are flooded to all customer edge devices, while known MAC addresses are forwarded directly.

  • Multipoint connectivity: VPLS connects multiple PE devices through bridging, enabling private multipoint LAN-like connectivity for customers.

  • Dynamic learning: Provider edge devices dynamically learn source MAC addresses as packets are flooded within the customer-specific bridge domain.

  • Traffic privacy: All traffic is isolated per customer through dedicated bridge domains and MAC-based forwarding, ensuring LAN privacy.

  • Enables private, scalable Layer 2 multipoint services.

  • Provides traffic isolation and privacy for each customer.

  • Supports flexible attachment circuits (physical and virtual ports).

How VPLS works

VPLS enables customers to extend their LAN across geographically dispersed locations by emulating an Ethernet switch across the MPLS network, eliminating the need for multiple point-to-point circuits.

Summary

The key components involved in VPLS are:

  • The PE routers: Host the bridge domains and VPLS forwarding MAC tables.

  • The bridge domains: Provide the building blocks for multipoint bridging on each PE router.

  • The attachment circuits: Connect the customer edge devices to the bridge domains.

  • The pseudowires and VFI: Interconnect the PE routers into a single multipoint service.

VPLS is a technology that enables a service provider to deliver multipoint Ethernet service over an MPLS network. By interconnecting provider edge (PE) routers through bridge domains, attachment circuits, and a mesh of pseudowires, customer devices communicate as if they are on the same LAN.

Workflow

Figure 1. VPLS architecture

VPLS involves these stages:

  1. The service provider creates a bridge domain on each PE router and connects the customer edge devices to that bridge domain through attachment circuits.
  2. The PE routers interconnect through a full mesh of pseudowires, and the VFI links that pseudowire mesh to the bridge domain to form a virtual switching instance.
  3. The PE routers switch traffic across the service by using destination MAC addresses, flood unknown, broadcast, and multicast traffic where required, and forward learned unicast traffic to the correct customer edge device.

Result

All customer edge devices in the VPLS instance appear to be on the same LAN without requiring a full mesh of point-to-point circuits at the customer edge.