L3VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

L3VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

MPLS L3VPN services using Segment Routing

Updated: June 17, 2026

Want to summarize with AI?

Introduces MPLS L3VPN with Segment Routing, detailing topology operations, guided MPLS core configuration using Segment Routing, and verification procedures to ensure correct L3VPN deployment over Segment Routing.

An MPLS L3VPN service with Segment Routing is a transport approach that

uses Segment Routing instead of MPLS LDP for MPLS L3VPN transport
applies Segment Routing directly to the MPLS architecture without changing the forwarding plane, and
uses IGP or BGP for label distribution.

Additional reference information

Currently, MPLS Label Distribution Protocol (LDP) is the widely used transport for MPLS L3VPN services. You can achieve better resilience and convergence for network traffic by transporting MPLS L3VPN services using Segment Routing (SR) instead of MPLS LDP. Segment Routing can be directly applied to the MPLS architecture without changing the forwarding plane. In a segment-routing network using the MPLS data plane, LDP or other signaling protocols are not required; instead, label distribution is performed by IGP (IS-IS or OSPF) or BGP. Removing protocols from the network simplifies its operation and makes it more robust and stable by eliminating the need for protocol interaction. Segment Routing also utilizes network bandwidth more effectively than traditional MPLS networks and offers lower latency.

How MPLS L3VPN over Segment Routing works

Here is a network scenario in which an MPLS L3VPN service is transported using Segment Routing.

Summary

The key components involved in the process are:

CE routers: Devices (e.g., CE1 and CE2) at the customer premises connecting to the provider's network.
PE routers: ISP routers (example, PE1 and PE2) interfacing between customer and core networks, hosting customer VPNs.
P routers: ISP core routers forwarding labeled packets between PE routers.
OSPF protocol: Used as an Interior Gateway Protocol (IGP) to facilitate routing between CE and PE routers.
Autonomous Systems (AS): Distinct routing domains for customer (AS 65534) and ISP (AS 65000).
Virtual Routing and Forwarding (VRF): Logical instances (example, vrf1601) on PE routers to isolate customer traffic.
Route-targets: BGP attributes controlling VPN route import/export between VRFs.
Loopback interfaces: Simulated network addresses used for testing and routing stability.

Workflow

Figure 1. MPLS L3VPN over Segment Routing

These stages describe how MPLS L3VPN over Segment Routing works:

Topology setup: CE1 and CE2 are deployed as customer routers connecting to the ISP network that contains two PE routers (PE1, PE2) and a P router.
IGP configuration: OSPF is configured as the IGP between CE and PE routers, supporting label distribution through IS-IS, OSPF, or BGP (OSPF is used here).
VPN separation: The customer's autonomous system (65534) peers with the ISP's autonomous system (65000) using VRF peering, preventing route advertisement into the global IPv4 table. PE routers host customer VRF instances and import/export route targets as needed.
Loopback implementation: Loopback interfaces are designated to simulate network endpoints and ensure reliable routing.

Result

The topology is ready for configuration when the CE, PE, P, OSPF, autonomous system, VRF, route-target, and loopback roles are planned, enabling secure, isolated transport of customer VPN services using Segment Routing.

Configure Segment Routing on PE1, P, and PE2 routers

Configure Segment Routing on core routers (PE1, P, and PE2) in the MPLS network to enable traffic engineering and segment routing.

Perform these steps on each designated core router (PE1, P, and PE2) to activate Segment Routing using OSPF or IS-IS routing protocols. Ensure you use the correct values (router ID, prefix SID index, global block, and interface configurations) for each device.

Before you begin

Plan the OSPF or IS-IS core, Segment Routing global block, prefix SID indexes, and core interfaces for PE1, P, and PE2.

Follow these steps to enable Segment Routing in the MPLS core on PE1, P, and PE2 routers:

Procedure

	1.	Configure OSPF for Segment Routing on each router. Example: Router-PE1# configure Router-PE1(config)# router ospf dc-sr Router-PE1(config-ospf)# router-id 192.0.2.10 Router-PE1(config-ospf)# segment routing mpls Router-PE1(config-ospf)# segment routing forwarding mpls Router-PE1(config-ospf)# mpls ldp sync Router-PE1(config-ospf)# mpls ldp auto-config Router-PE1(config-ospf)# segment-routing sr-prefer Router-PE1(config-ospf)# segment-routing prefix-sid-map advertise-local Router-PE1(config-ospf)# exit Router-PE1(config-ospf)# area 1 Router-PE1(config-ospf-ar)# interface HundredGigE0/0/0/2 Router-PE1(config-ospf-ar-if)# exit Router-PE1(config-ospf-ar)# interface Loopback0 Router-PE1(config-ospf-ar-if)# prefix-sid index 1 Router-PE1(config-ospf-ar-if)# commit
	2.	Configure the Segment Routing global block on each router. Example: `Router# configure Router(config)# segment-routing Router(config-sr)# global-block 180000 200000 Router(config-sr)# commit Router(config-sr)# exit`
	3.	Configure IS-IS for Segment Routing on each router (if using IS-IS). Example: Router# configure Router(config)# router isis ring Router(config-isis)# is-type level-2-only Router(config-isis)# net 49.0001.1921.6800.1001.00 Router(config-isis)# nsr Router(config-isis)# distribute link-state Router(config-isis)# nsf cisco Router(config-isis)# address-family ipv4 unicast Router(config-isis-af)# metric-style wide Router(config-isis-af)# mpls traffic-eng level-1 Router(config-isis-af)# mpls traffic-eng router-id loopback0 Router(config-isis-af)# segment-routing mpls sr-prefer Router(config-isis-af)# exit Router(config-isis)# interface loopback0 Router(config-isis-if)# address-family ipv4 unicast Router(config-isis-af)# prefix-sid index 30101 Router(config-isis-af)# exit
	4.	Review the running configuration. Example: PE1 router ospf dc-sr router-id 192.0.2.10 segment-routing mpls segment-routing forwarding mpls mpls ldp sync mpls ldp auto-config segment-routing sr-prefer segment-routing prefix-sid-map receive segment-routing prefix-sid-map advertise-local ! area 1 interface HundredGigE0/0/0/2 ! interface Loopback0 prefix-sid index 1 ! ! ! configure segment-routing global-block 180000 200000 ! ! configure router isis ring net 49.0001.1921.6800.1001.00 nsr distribute link-state nsf cisco address-family ipv4 unicast metric-style wide mpls traffic-eng level-1 mpls traffic-eng router-id Loopback0 segment-routing mpls sr-prefer ! interface Loopback0 address-family ipv4 unicast prefix-sid index 30101 ! ! Example: P node router ospf dc-sr router-id 192.0.2.11 segment-routing mpls segment-routing forwarding mpls mpls ldp sync mpls ldp auto-config segment-routing sr-prefer segment-routing prefix-sid-map receive segment-routing prefix-sid-map advertise-local ! area 1 interface HundredGigE0/0/1/0 ! interface HundredGigE0/0/1/1 ! interface Loopback0 prefix-sid index 1 ! ! ! configure segment-routing global-block 180000 200000 ! ! configure router isis ring net 49.0001.1921.6800.1002.00 nsr distribute link-state nsf cisco address-family ipv4 unicast metric-style wide mpls traffic-eng level-1 mpls traffic-eng router-id Loopback0 segment-routing mpls sr-prefer ! interface Loopback0 address-family ipv4 unicast prefix-sid index 30102 ! ! Example: PE2 router ospf dc-sr router-id 192.0.2.17 segment-routing mpls segment-routing forwarding mpls mpls ldp sync mpls ldp auto-config segment-routing sr-prefer segment-routing prefix-sid-map receive segment-routing prefix-sid-map advertise-local ! area 0 interface HundredGigE0/0/0/19 ! interface Loopback0 prefix-sid index 1 ! ! ! configure segment-routing global-block 180000 200000 ! ! configure router isis ring net 49.0001.1921.6800.1003.00 nsr distribute link-state nsf cisco address-family ipv4 unicast metric-style wide mpls traffic-eng level-1 mpls traffic-eng router-id Loopback0 segment-routing mpls sr-prefer ! interface Loopback0 address-family ipv4 unicast prefix-sid index 30103 !

Segment Routing is configured and active in the MPLS core when the running configuration shows Segment Routing enabled and appropriate values on PE1, P, and PE2 routers.

Verify MPLS L3VPN configuration over Segment Routing

Ensure MPLS L3VPN over Segment Routing is functioning by monitoring label counter increments on core and edge routers.

This verification task confirms that transport and VPN label counters are increasing, which indicates proper operation of MPLS L3VPN over Segment Routing. You must complete the initial configuration before proceeding.

Before you begin

Complete MPLS L3VPN over Segment Routing configuration before you verify label counters.

Follow these steps to verify MPLS L3VPN label counters over Segment Routing:

Procedure

On the core router (P node), verify the statistics for the IGP transport label, and confirm that label 64003 (in this example) is increasing.

Example:

Router-P# show mpls forwarding
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ---------
64003  Pop         SR Pfx (idx 0)     Hu0/0/0/0   192.0.2.32      572842

Verify the statistics in core router and ensure that the counter for IGP transport label (64003 in this example) is increasing.

P node:

On PE1, verify the statistics for MPLS labels. Confirm that label counters such as 64001 and 60003 are increasing.

Example:

Router-PE1# show mpls forwarding
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ ------------    --------
64001  60003       SR Pfx (idx 0)     Hu0/0/0/2    192.0.2.12      532978

On PE2, verify the statistics for the VPN label, and confirm that label 24031 (in this example) is increasing.

Example:

Router-PE2# show mpls forwarding
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ---------
24031  Aggregate   vrf1601: Per-VRF Aggr[V]   \
                                      vrf1601                      0

If the IGP transport label and VPN label counters increase as expected on core and edge routers, MPLS L3VPN over Segment Routing is verified and operating correctly.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.