L2VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Multisegment pseudowires

Updated: June 15, 2026

Want to summarize with AI?

Log in

Outlines multisegment pseudowire architecture, describing component functions, connectivity solutions, operational benefits, core workflows, and configuration procedures to enable scalable end-to-end L2VPN services through segmented pseudowires.

A multisegment pseudowire is a type of pseudowire that

  • connects two or more pseudowire segments across multiple provider edge devices

  • extends Layer 2 VPN services across multiple network segments, cores, or autonomous systems, and

  • uses switching provider edge devices to connect pseudowire segments between endpoint provider edge devices.

Multisegment pseudowire details

The feature history table lists release support for this feature.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Multisegment pseudowires

 Release 25.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Modular Systems (8800 [LC ASIC: P100])

Multisegment pseudowires improve network scalability and flexibility by extending Layer 2 services across multiple network segments.

End-to-end stitching of pseudowires lets data flow across multiple provider networks as a single virtual connection.

This capability simplifies service deployment and broadens network reach.

Main components and functions of multisegment pseudowires

Multisegment pseudowires (MS-PWs) are constructed from several core components, each with specific roles and characteristics:

  • Pseudowire (PW):

    • Establishes a tunnel between two PE routers.

    • Carries Layer 2 payload encapsulated as MPLS data.

    • PE routers at each end are called terminating PE routers (T-PEs).

  • Multisegment pseudowire (MS-PW):

    • Consists of two or more PW segments joined together.

    • Behaves as a single point-to-point pseudowire.

    • Uses switching PE routers (S-PEs) to connect segments.

  • Pseudowire stitching:

    • Configuration technique that connects independent pseudowires.

    • Achieved by cross-connects on S-PE routers.

    • Enables end-to-end service continuity as a single PW.

Overcoming connectivity barriers with multisegment pseudowire

Multisegment pseudowire addresses connectivity challenges in networks where end-to-end pseudowires span multiple regions, such as distinct IGP areas or BGP autonomous systems. Key facts include:

  • Terminating PE (T-PE) devices cannot always directly communicate across regions due to lack of mutual IP visibility.

  • Multisegment pseudowire divides the path into multiple segments, each connecting a pair of PE nodes within the same region.

  • The architecture introduces two classes of PE nodes:

    • Terminating PE (T-PE): Ends the pseudowire connection.

    • Switching PE (S-PE): Interconnects segments between regions.

  • Concatenating pseudowire segments enables end-to-end connectivity, even across diverse network domains.

  • This approach overcomes limitations of targeted LDP session establishment between distant PE nodes.

Benefits of multisegment pseudowire

Multisegment pseudowires (MS-PWs) enable network operators to achieve greater flexibility and scalability through these benefits:

  • Allow splitting large networks into smaller segments—such as core and metro—while still providing seamless end-to-end connectivity.

  • Support scalability by enabling up to 254 pseudowire segments in a single MS-PW, accommodating complex network architectures.

  • Facilitate interconnection across multiple cores or autonomous systems, including integration between different carrier networks.

How multisegment pseudowires work

MS-PWs are used when a single pseudowire cannot span the entire distance between two customer sites due to limitations like multiple provider domains or different underlying transport technologies. They provide flexibility and scalability in delivering Layer 2 VPN services.

Summary

The key components involved in the process are:

  • PE router: Initiates or terminates the pseudowire, providing connectivity between customer edge devices and the provider’s network.

  • Pseudowire switching (S-PE) point: Acts as an intermediary that connects two or more pseudowire segments, facilitating continuity across multiple segments.

  • Pseudowire signaling protocol: Handles setup, maintenance, and teardown of the pseudowire segments across the network.

  • CE device: Connects to the PE router and sends/receives Layer 2 traffic transported over the MS-PW.

MS-PWs enable the extension of Layer 2 VPN services across multiple provider domains or segments by connecting two or more pseudowire segments through one or more switching points. This allows service providers to deliver end-to-end Layer 2 connectivity over a network that spans different administrative or technology domains.

Workflow

These stages describe how multisegment pseudowires work.

  1. Establishment of pseudowire segments—each PE router establishes a pseudowire segment with the adjacent switching point or PE router using a signaling protocol such as LDP.
  2. Pseudowire switching point configuration—the switching point is configured to connect the incoming and outgoing pseudowire segments, forming a continuous path.
  3. Signaling and label exchange—PE routers and switching points exchange signaling messages to communicate pseudowire parameters and labels, ensuring correct packet forwarding across segments.
  4. Data transmission—once established, user data from the CE device is encapsulated and transmitted over the MS-PW, traversing each segment and switching point until it reaches the remote CE device.
  5. Maintenance and teardown—the signaling protocol monitors the status of the MS-PW and manages any required maintenance or teardown operations if connectivity changes or failures occur.

Result

The MS-PW process delivers seamless end-to-end Layer 2 VPN connectivity across multiple network segments and domains, enabling service providers to offer flexible and scalable Ethernet and other Layer 2 services.

Configure multisegment pseudowires

Establish a multisegment pseudowire (MS-PW) service between two terminating PE routers (T-PE1 and T-PE2) and a stitching PE (S-PE1), using pseudowire stitching and MPLS encapsulation.

This task is typically performed to interconnect service provider edge routers across multiple network segments. T-PE routers terminate attachment circuits and use the control word, while S-PE performs pseudowire stitching—linking the segments without attachment circuits. It is implemented using pseudowire classes and xconnect groups.

Before you begin

Confirm that the PWHE interface and related underlay are planned before you begin.

Procedure

1.

Configure S-PE1 for pseudowire stitching for MS-PW segments.

Example:

Router# configure
Router(config)# l2vpn
Router(config-l2vpn)# pw-class T-PE1
Router(config-l2vpn-pw-class)# encapsulation mpls
Router(config-l2vpn-pw-class)# exit
Router(config-l2vpn)# pw-class T-PE2
Router(config-l2vpn-pw-class)# encapsulation mpls
Router(config-l2vpn-pw-class)# exit
Router(config-l2vpn)# xconnect group MS-PW
Router(config-l2vpn-xc)# p2p xc1
Router(config-l2vpn-xc-p2p)# neighbor ipv4 192.0.2.16 pw-id 1
Router(config-l2vpn-xc-p2p-pw)# pw-class T-PE1
Router(config-l2vpn-xc-p2p-pw)# exit
Router(config-l2vpn-xc-p2p)# neighbor ipv4 192.0.2.17 pw-id 1
Router(config-l2vpn-xc-p2p-pw)# pw-class T-PE2
Router(config-l2vpn-xc-p2p-pw)# exit
Router(config-l2vpn-xc-p2p)# exit
Router(config-l2vpn-xc)# p2p xc2
Router(config-l2vpn-xc-p2p)# neighbor ipv4 192.0.2.16 pw-id 2
Router(config-l2vpn-xc-p2p-pw)# pw-class T-PE1
Router(config-l2vpn-xc-p2p-pw)# exit
Router(config-l2vpn-xc-p2p)# neighbor ipv4 192.0.2.17 pw-id 2
Router(config-l2vpn-xc-p2p-pw)# pw-class T-PE2
Router(config-l2vpn-xc-p2p-pw)# commit

Define pseudowire classes with MPLS encapsulation for T-PE1 and T-PE2, then create an xconnect group with point-to-point (p2p) cross-connects for each segment, specifying both T-PE1 and T-PE2 as neighbors, assigning unique PW IDs, and referencing the correct pseudowire class.
2.

Configure T-PE1 to terminate and originate MS-PW segments.

Example:

Router# configure
Router(config)# l2vpn
Router(config-l2vpn)# pw-class T-PE1
Router(config-l2vpn-pw-class)# encapsulation mpls
Router(config-l2vpn-pw-class)# control-word
Router(config-l2vpn-pw-class)# exit
Router(config-l2vpn)# xconnect group MS-PW
Router(config-l2vpn-xc)# p2p xc1
Router(config-l2vpn-xc-p2p)# interface Bundle-Ether111.1
Router(config-l2vpn-xc-p2p)# neighbor ipv4 192.0.2.18 pw-id 1
Router(config-l2vpn-xc-p2p-pw)# pw-class T-PE1
Router(config-l2vpn-xc-p2p-pw)# exit
Router(config-l2vpn-xc-p2p)# exit
Router(config-l2vpn-xc)# p2p xc2
Router(config-l2vpn-xc-p2p)# interface Bundle-Ether111.2
Router(config-l2vpn-xc-p2p)# neighbor ipv4 192.0.2.18 pw-id 2
Router(config-l2vpn-xc-p2p-pw)# pw-class T-PE1
Router(config-l2vpn-xc-p2p-pw)# commit

Define a pseudowire class with MPLS encapsulation and control word enabled, then create an xconnect group with two p2p cross-connects, each specifying the local interface, neighbor IP, PW ID, and referencing the pseudowire class.
3.

Configure T-PE2 to terminate and originate MS-PW segments.

Example:

Router# configure
Router(config)# l2vpn
Router(config-l2vpn)# pw-class T-PE2
Router(config-l2vpn-pw-class)# encapsulation mpls
Router(config-l2vpn-pw-class)# control-word
Router(config-l2vpn-pw-class)# exit
Router(config-l2vpn)# xconnect group MS-PW
Router(config-l2vpn-xc)# p2p xc1
Router(config-l2vpn-xc-p2p)# interface Bundle-Ether333.1
Router(config-l2vpn-xc-p2p)# neighbor ipv4 192.0.2.18 pw-id 1
Router(config-l2vpn-xc-p2p-pw)# pw-class T-PE2
Router(config-l2vpn-xc-p2p-pw)# exit
Router(config-l2vpn-xc-p2p)# exit
Router(config-l2vpn-xc)# p2p xc2
Router(config-l2vpn-xc-p2p)# interface Bundle-Ether333.2
Router(config-l2vpn-xc-p2p)# neighbor ipv4 192.0.2.18 pw-id 2
Router(config-l2vpn-xc-p2p-pw)# pw-class T-PE2
Router(config-l2vpn-xc-p2p-pw)# commit

Define a pseudowire class with MPLS encapsulation and control word, then configure an xconnect group with two p2p cross-connects, each specifying the local interface, neighbor IP, PW ID, and pseudowire class.
4.

Use the show commands to verify the MS-PW configuration.

Example:

Router# show l2vpn xconnect detail
S-PE1:
Group MS-PW, XC xc1, State: Up, Type: P2P
  PW: neighbor 192.0.2.16, pw-id 1, state: Up (pw-class T-PE1)
  PW: neighbor 192.0.2.17, pw-id 1, state: Up (pw-class T-PE2)
Group MS-PW, XC xc2, State: Up, Type: P2P
  PW: neighbor 192.0.2.16, pw-id 2, state: Up (pw-class T-PE1)
  PW: neighbor 192.0.2.17, pw-id 2, state: Up (pw-class T-PE2)
Note: No local attachment circuits configured (PW-to-PW stitching)
T-PE1:
Group MS-PW, XC xc1, State: Up, Type: P2P
  AC: Bundle-Ether111.1, state: Up
  PW: neighbor 192.0.2.18, pw-id 1, state: Up (pw-class T-PE1)
Group MS-PW, XC xc2, State: Up, Type: P2P
  AC: Bundle-Ether111.2, state: Up
  PW: neighbor 192.0.2.18, pw-id 2, state: Up (pw-class T-PE1)
T-PE2:
Group MS-PW, XC xc1, State: Up, Type: P2P
  AC: Bundle-Ether333.1, state: Up
  PW: neighbor 192.0.2.18, pw-id 1, state: Up (pw-class T-PE2)
Group MS-PW, XC xc2, State: Up, Type: P2P
  AC: Bundle-Ether333.2, state: Up
  PW: neighbor 192.0.2.18, pw-id 2, state: Up (pw-class T-PE2)

Example:

Router# show mpls ldp neighbor brief
Peer LDP Identifier    Transport Address  State       Uptime
192.0.2.16:0           192.0.2.16          OPERATIONAL  00:34:12
192.0.2.17:0           192.0.2.17          OPERATIONAL  00:34:12
192.0.2.18:0           192.0.2.18          OPERATIONAL  00:34:12

Example:

Router# show mpls forwarding
Local  Outgoing    Prefix             Bytes Label   Outgoing   Next Hop
Label  Label       or ID              Switched      Interface
16001  17001       192.0.2.16:1        100000        Te0/0/0/1  192.0.2.16
16002  17002       192.0.2.17:1        100000        Te0/0/0/2  192.0.2.17
17001  Pop Label   192.0.2.18:1        100000        BE111.1    local
17002  Pop Label   192.0.2.18:2        100000        BE111.2    local

Example:

Router# show mpls l2transport vc detail
S-PE1:
Local interface: none (PW stitching)
VC ID: 1, peer 192.0.2.16, state: UP
  Encapsulation: MPLS, pw-class: T-PE1
VC ID: 1, peer 192.0.2.17, state: UP
  Encapsulation: MPLS, pw-class: T-PE2
VC ID: 2, peer 192.0.2.16, state: UP
  Encapsulation: MPLS, pw-class: T-PE1
VC ID: 2, peer 192.0.2.17, state: UP
  Encapsulation: MPLS, pw-class: T-PE2
T-PE1:
Local interface: Bundle-Ether111.1 up, VC ID: 1
  Peer 192.0.2.18, state: UP, PW class: T-PE1, encapsulation: MPLS, control-word: enabled

Local interface: Bundle-Ether111.2 up, VC ID: 2
  Peer 192.0.2.18, state: UP, PW class: T-PE1, encapsulation: MPLS, control-word: enabled
T-PE2:
Local interface: Bundle-Ether333.1 up, VC ID: 1
  Peer 192.0.2.18, state: UP, PW class: T-PE2, encapsulation: MPLS, control-word: enabled

Local interface: Bundle-Ether333.2 up, VC ID: 2
  Peer 192.0.2.18, state: UP, PW class: T-PE2, encapsulation: MPLS, control-word: enabled

Use the show l2vpn xconnect detail command to check the state of XCs, PWs, and ACs to confirm the end-to-end operational status of the L2VPN service.

Use the show mpls ldp neighbor brief command to verify the state and uptime of LDP neighbors to ensure stable MPLS LDP peering sessions.

Each router shows its direct LDP neighbors only.

Use the show mpls forwarding command to examine label entries to confirm correct MPLS label switching and next-hop forwarding for specific traffic.

Use the show mpls l2transport vc detail command to check the state of each VC and its local interface to verify the operational status of L2 virtual circuits.

The multisegment pseudowire service is successfully established. All routers confirm operational status for the cross-connects, pseudowires, and virtual circuits. Verification outputs provide evidence of fully configured MS-PWs across segments.