L3VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

L3VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Inter-AS L3VPN

Updated: June 17, 2026

Want to summarize with AI?

Log in

Explains Inter-AS L3VPN capabilities, including how VPN connectivity is extended across multiple autonomous systems and service provider backbones, the foundational concepts, supported options, and use cases for seamless multi-provider L3VPN deployments.

Inter-AS L3VPN is a cross-provider VPN capability that

  • extends VPN connectivity across multiple autonomous systems

  • supports VPNs in different geographic areas or service provider networks, and

  • keeps VPN connectivity independent of the complexity and location of the sites.

An autonomous system (AS) is a single network or group of networks that is controlled by a common system administration group and uses a single, clearly defined routing protocol.

Feature history

The feature history table lists release support for this feature.

Table 1. Feature History Table

Feature Name

Release

Description

Inter-AS Support for L3VPN

 Release 25.4.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100])(select variants only*)

*This feature is supported on:

  • 8711-48Z-M

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

Inter-AS Support for L3VPN

Release 25.1.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on Cisco 8011-4G24Y4H-I routers.

Inter-AS Support for L3VPN

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: K100])(select variants only*); Modular Systems (8800 [LC ASIC: Q100, P100])(select variants only*)

You can now enhance cross-provider VPN connectivity with Inter-AS Option - A and C, enabling seamless Layer 3 VPN communication between different autonomous systems. This feature facilitates the exchange of VPN routing information and forwarding data across provider boundaries, enhancing flexibility and scalability in network designs. Inter-AS Option - A utilizes static routing for simple setups, while Option - C provides comprehensive MPLS label-swapping capabilities for more complex configurations. These options support effective management of multi-provider network.

*Previously this feature was supported on Q200 and Q100. It is now extended:

  • 8712-MOD-M

  • 8212-48FH-M

  • 8711-32FH-M

  • 88-LC1-52Y8H-EM

  • 88-LC1-12TH24FH-E

  • 88-LC1-36EH

Additional reference information

As VPNs grow, their requirements expand. In some cases, VPNs need to reside on different autonomous systems in different geographic areas. In addition, some VPNs need to extend across multiple service providers (overlapping VPNs). Regardless of the complexity and location of the VPNs, Inter-AS L3VPN provides a seamless connection between autonomous systems.

Benefits of Inter-AS L3VPN

An MPLS VPN Inter-AS provides these benefits:

  • Enables a VPN to cross more than one service provider backbone, allowing service providers operating separate autonomous systems to jointly offer MPLS VPN services to the same customer. A VPN can begin at one customer site and traverse different service provider backbones before reaching another site for the same customer. Previously, MPLS VPN could traverse only a single BGP autonomous system backbone. Inter-AS L3VPN enables multiple autonomous systems to form a continuous, seamless network between customer sites.

  • Allows a VPN to exist in different geographic areas. By directing all VPN traffic through a single point between areas, the service provider can better control network traffic rates between locations.

Autonomous system boundary routers

An autonomous system boundary router is an inter-AS border router that

  • uses eBGP to exchange VPN reachability with ASBR peers

  • connects autonomous systems that use IGP internally, and

  • supports route exchange across service provider boundaries.

Additional reference information

Separate autonomous systems from different service providers can communicate by exchanging IPv4 NLRI and IPv6 in the form of VPN-IPv4/IPv6 addresses. The ASBRs use eBGP to exchange that information. Then an Interior Gateway Protocol (IGP) distributes the network layer information for VPN-IPv4/IPv6 prefixes throughout each VPN and each autonomous system. The following protocols are used for sharing routing information:

  • Within an autonomous system, routing information is shared using an IGP.

  • Between autonomous systems, routing information is shared using eBGP. eBGP allows service providers to set up an interdomain routing system that guarantees loop-free exchange of routing information between separate autonomous systems. The primary function of eBGP is to exchange network reachability information between autonomous systems, including information about the list of autonomous system routes. The autonomous systems use eBGP border edge routers to distribute the routes, which include label switching information. Each border edge router rewrites the next-hop and MPLS labels.

  • Inter-AS configurations supported in an MPLS VPN can include:

    • Interprovider VPN—MPLS VPNs that include two or more autonomous systems, connected by separate border edge routers. The autonomous systems exchange routes using eBGP. No IGP or routing information is exchanged between the autonomous systems.

How MPLS VPN Inter-AS BGP label distribution works

In large-scale service provider networks, connecting multiple autonomous systems (ASes) while supporting VPN services presents operational challenges. Traditional methods may require ASBRs to store and forward all VPN-IPv4 routes, leading to scalability and configuration complexity. MPLS VPN Inter-AS BGP label distribution addresses these challenges by allowing route reflectors to manage and disseminate VPN-IPv4 routes, while ASBRs focus solely on exchanging labeled IPv4 routes. This approach improves scalability, simplifies configuration at network boundaries, and supports the seamless transport of VPN traffic—even across non-MPLS core networks or through third-party providers—without introducing additional label distribution protocols.

Summary

The key components involved in the process are:

  • Autonomous System Boundary Routers (ASBRs): Exchange IPv4 routes with MPLS labels between different provider networks.

  • Route reflectors (RRs): Store and forward VPN-IPv4 routes to provider edge routers using multihop, multiprotocol eBGP.

  • Provider edge (PE) routers: Connect customer sites to the provider network and receive labeled routes for forwarding VPN traffic.

MPLS VPN Inter-AS BGP label distribution enables efficient exchange of IPv4 and VPN-IPv4 routing information between different autonomous systems, supporting network scalability and simplified configuration.

Workflow

These stages describe how MPLS VPN Inter-AS BGP label distribution works:

  1. Setup: ASBRs are configured to exchange IPv4 prefixes and their associated MPLS labels between autonomous systems.
  2. Route reflection: Route reflectors use multihop, multiprotocol external BGP to exchange VPN-IPv4 routes. RRs hold VPN-IPv4 routes and share them with the relevant PE routers.
  3. Label distribution: ASBRs distribute MPLS labels for IPv4 routes, eliminating the need for additional label distribution protocols between adjacent label switch routers (LSRs) that are also BGP peers.
  4. Scalability and simplification: Having RRs store the VPN-IPv4 routes improves scalability and simplifies configuration at the network border. A non-MPLS VPN transit network can also carry labeled VPN traffic.
  5. Inter-AS traffic handling: The setup enables IPv4 routes with MPLS labels to traverse non-MPLS VPN core networks or service providers and supports VPN traffic forwarding without requiring additional protocols.

Result

ASBRs exchange IPv4 routes with MPLS labels while route reflectors efficiently manage and distribute VPN-IPv4 routes, supporting scalable MPLS VPN services across multiple autonomous systems.

Exchanging IPv4 routes with MPLS labels

You can set up a VPN service provider network to exchange IPv4 routes with MPLS labels. You can configure the VPN service provider network as follows:

Summary

The key components involved in the process are:

  • Route reflector (RR): Facilitates distribution of VPN-IPv4 routes, IPv4 routes, and MPLS labels among PE routers, especially across different autonomous systems.

  • Autonomous System Boundary Router (ASBR): Exchanges routing and MPLS label information between autonomous systems, using either eBGP, IGP with LDP, or iBGP label distribution.

    Provider edge (PE) router: Maintains local and remote VPN-IPv4 routes and MPLS labels to support correct traffic forwarding within the VPN.

Workflow

Figure 1. VPNs Using eBGP and iBGP to Distribute Routes and MPLS Labels

These stages describe exchanging IPv4 routes with MPLS labels:

  1. Route distribution through eBGP: Route reflectors exchange VPN-IPv4 routes and MPLS labels between autonomous systems using multihop, multiprotocol eBGP sessions. This preserves next-hop information and VPN labels as they traverse different ASes.
  2. Synchronization of routing and label information: Each local PE router must learn the relevant route and label information for remote PE routers in the VPN.
  3. Route and label exchange between ASBRs and PEs: There are two main approaches:
    • IGP and LDP redistribution: The ASBR redistributes IPv4 routes and corresponding MPLS labels learned from eBGP into the local IGP and LDP, and vice versa.
    • iBGP IPv4 label distribution: The ASBR and PE establish direct iBGP sessions to exchange VPN-IPv4 and IPv4 routes alongside their MPLS labels.
  4. Reflection of learned routes: Route reflectors can reflect IPv4 routes and MPLS labels learned from the ASBRs to other PE routers, enabling scalable and efficient route propagation throughout the VPN.

Result

VPN-IPv4 routes and MPLS labels are efficiently exchanged across autonomous systems, while next-hop information is preserved, enabling end-to-end MPLS VPN connectivity between sites in different ASes.

BGP routing information

BGP routing information includes the following items:

  • Network number (prefix): The IP address of the destination.

  • Autonomous system (AS) path: A list of the other ASs through which a route passes on the way to the local router. The first AS in the list is closest to the local router; the last AS is farthest from the local router and usually the AS where the route began.

  • Path attributes: Additional information about the AS path, such as the next hop.

BGP messages and MPLS labels

MPLS labels are included in the update messages that a router sends to its neighbors as part of BGP operations. Routers exchange the following types of BGP messages:

  • Open messages—After a router establishes a TCP connection with a neighboring router, both routers exchange open messages. This message contains the number of the autonomous system to which the router belongs and the IP address of the router that sent the message.

  • Update messages—When a router learns about a new, changed, or broken route, it sends an update message to its neighbor. This message contains the Network Layer Reachability Information (NLRI), which lists usable IP routes, includes routes that are no longer usable, and contains path attributes and the lengths of usable and unusable paths. MPLS labels for VPN-IPv4 routes are encoded in the update message, as described in RFC 2858, and for IPv4 routes as described in RFC 3107.

  • Keepalive messages—Routers exchange keepalive messages at regular intervals to determine if a neighboring router is still available to exchange routing information. The keepalive message contains only a message header and no routing data. For Cisco routers, the default interval is 60 seconds.

  • Notification messages— If a router detects an error, it sends a notification message to its neighbor to inform them of the problem.

How BGP sends MPLS labels with routes

In MPLS-enabled networks, BGP distributes both route information and the associated MPLS labels so routers can properly forward packets using label-switching. This process ensures efficient setup and operation of label-switched paths.

Summary

The key components involved in the process are:

  • BGP routers (eBGP and iBGP peers): Exchange routing and MPLS label mapping information.

  • MPLS labels: Identify the path for packet forwarding in the MPLS network.

  • BGP update messages: Carry routing and label mapping information between peers.

BGP distributes MPLS label mapping information along with routing updates, allowing for efficient label-switched path setup in MPLS-enabled networks.

Workflow

These stages describe wow BGP sends MPLS labels with routes:

  1. Both BGP routers negotiate their capability to send and receive MPLS label information by advertising label capability to each other.
  2. Once label capability is negotiated, each router includes MPLS label mapping information in its BGP update messages that advertise routes.
  3. The receiving router processes the BGP update, associates the MPLS label with the advertised route, and uses this information for MPLS forwarding.
  4. If the next-hop is unchanged in the routing update, the associated MPLS label remains unchanged.
  5. Throughout the session, both routers ensure that all outgoing route updates include appropriate MPLS label mappings as long as label capability is established.

Result

When both BGP peers advertise and recognize label capability, BGP includes MPLS label mapping information in routing updates, enabling MPLS forwarding along advertised paths.