L3VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

L3VPN Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Verify MPLS L3VPN configuration

Updated: September 11, 2026

Want to summarize with AI?

Log in

Details steps to validate MPLS L3VPN configuration, enabling users to confirm correct deployment and identify potential issues within the VPN service.

Ensure that MPLS L3VPN is fully operational by confirming proper traffic forwarding, transport setup, and route state following core configuration.

After configuring MPLS L3VPN core and PE devices, you must verify traffic flow, underlay transport, and overlay routes to confirm successful deployment.

Before you begin

Complete the MPLS L3VPN core and PE configuration.

Procedure

  1. Use the show mpls forwarding command on each router to check MPLS forwarding.

    Confirm that traffic is forwarded correctly, labels are assigned, and interfaces show expected switched bytes.

    Example:

    Router-P# show mpls forwarding
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ------------
24119  Pop         192.0.2.17/32      Hu0/0/0/0    192.0.2.18     2170204180148

    Example:

    Router-PE2# show mpls forwarding
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ------------
24031  Aggregate   vrf1601: Per-VRF Aggr[V]   \
                                      vrf1601                      0

  2. Verify underlay transport (LDP label distribution and neighbor status).

    Confirm that LDP sessions are established with all peers, showing state "Oper".

    Example:

    Router-PE1# show mpls ldp neighbor
Peer LDP Identifier: 192.0.2.11:0
  TCP connection: 192.0.2.11:47619 - 192.0.2.10:646
  Graceful Restart: No
  Session Holdtime: 180 sec
  State: Oper; Msgs sent/rcvd: 40395/35976; Downstream-Unsolicited
  Up time: 2w2d
  LDP Discovery Sources:
    IPv4: (1)
      TenGigE0/0/0/2
    IPv6: (0)
  Addresses bound to this peer:
    IPv4: (6)
      10.64.98.32    192.0.2.13       192.0.2.14    192.0.2.15
      192.0.2.16      192.0.2.19
    IPv6: (0)

    Example:

    Router-PE1# show mpls forwarding
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ------------
24036  Pop         192.0.2.11/32      Hu0/0/0/2    192.0.2.12      293294
24037  24165       192.0.2.20/32      Hu0/0/0/2    192.0.2.12      500
24039  24167       192.0.2.17/32      Hu0/0/0/2    192.0.2.12      17872433
	      24167	      192.0.2.17/32	     Hu0/0/0/2.1  192.0.2.21	     6345
24041  Aggregate   vrf1601: Per-VRF Aggr[V]   \
                                      vrf1601                      0

    Example:

    Router-PE1# show mpls forwarding labels 24001 hardware egress

Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ------------
24039  24167       192.0.2.17/32      Hu0/0/0/2    192.0.2.12      N/A
	   24167	   192.0.2.17/32	  Hu0/0/0/2.1  192.0.2.21	   N/A

 Show-data Print at RPLC

 LEAF - HAL pd context :
 sub-type : MPLS, ecd_marked:0, has_collapsed_ldi:0
 collapse_bwalk_required:0, ecdv2_marked:0

Leaf H/W Result:

Leaf H/W Result on NP:0
Label           SwitchAction      EgressIf      Programmed
24039                      0    0x    200185    Programmed

nrLDI eng ctx:
     flags: 0x101, proto: 2, npaths: 0, nbuckets: 1
    ldi_tbl_idx: 0xc37e40, ecd_ref_cft: 0
    pbts_ldi_tbl_idx: 0x0, fastnrldi:0x0

NR-LDI H/W Result for path 0 [index: 0xc37e40 (BE),  common to all NPs]:

 ECMP Sw Idx: 12811840 HW Idx: 200185 Path Idx: 0

NR-LDI H/W Result for path 1 [index: 0xc37e41 (BE),  common to all NPs]:

 ECMP Sw Idx: 12811841 HW Idx: 200185 Path Idx: 1

SHLDI eng ctx:
    flags: 0x0, shldi_tbl_idx: 0, num_entries:0

SHLDI HW data for path 0 [index: 0 (BE)] (common to all NPs):
Unable to get HW NRLDI Element rc: 1165765120NRLDI Idx: 0
SHLDI HW data for path 1 [index: 0x1 (BE)] (common to all NPs):
Unable to get HW NRLDI Element rc: 1165765120NRLDI Idx: 1

TX H/W Result for NP:0 (index: 0x187a0 (BE)):

 Next Hop Data
 Next Hop Valid:         YES
 Next Hop Index:         100256
 Egress Next Hop IF:     100047
 Hw Next Hop Intf:       606
 HW Port:                0
 Next Hop Flags:         COMPLETE
 Next Hop MAC:           e4aa.5d9a.5f2e

NHINDEX H/W Result for NP:0 (index: 0 (BE)):
NhIndex is NOT required on this platform

NHINDEX STATS: pkts 0, bytes 0 (no stats)

RX H/W Result on NP:0 [Adj ptr:0x40 (BE)]:
Rx-Adj is NOT required on this platform

TX H/W Result for NP:0 (index: 0x189a8 (BE)):

 Next Hop Data
 Next Hop Valid:         YES
 Next Hop Index:         100776
 Egress Next Hop IF:     100208
 Hw Next Hop Intf:       607
 HW Port:                0
 Next Hop Flags:         COMPLETE
 Next Hop MAC:           e4aa.5d9a.5f2d

NHINDEX H/W Result for NP:0 (index: 0 (BE)):
NhIndex is NOT required on this platform

NHINDEX STATS: pkts 0, bytes 0 (no stats)

RX H/W Result on NP:0 [Adj ptr:0x40 (BE)]:
Rx-Adj is NOT required on this platform

    Verify if the LDP neighbor connection is established with the respective neighbor:

    Verify if the label update is received by the FIB:

    Verify if label is updated in the hardware:

  3. Verify overlay (L3VPN route and label state).

    Confirm that BGP neighbors are established, routes are advertised and learned, and VPN routes appear as expected.

    Example:

    Router-PE1# show bgp summary
BGP router identifier 192.0.2.10, local AS number 2001
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0000000   RD version: 18003
BGP main routing table version 18003
BGP NSR Initial initsync version 3 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

BGP is operating in STANDALONE mode.

Process       RcvTblVer   bRIB/RIB   LabelVer  ImportVer  SendTblVer  StandbyVer
Speaker           18003      18003      18003      18003       18003           0

Neighbor        Spk    AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down  St/PfxRcd
192.0.2.22        0  2001   19173    7671    18003    0    0    1d07h       4000
192.0.2.23      0  7001    4615    7773    18003    0    0 09:26:21        125

    Example:

    Router-PE1# show bgp vpnv4 unicast
BGP router identifier 192.0.2.10, local AS number 2001
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0x0   RD version: 0
BGP main routing table version 305345
BGP NSR Initial initsync version 12201 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 2001:1601 (default for vrf vrf1601)
*> 192.0.2.24/32       192.0.2.25                            0 7501 i
*> 192.0.2.26/32       192.0.2.25                            0 7501 i
*>i20.23.1.1/32       192.0.2.17                    100      0 6553700 11501 i
*>i20.23.1.2/32       192.0.2.17                    100      0 6553700 11501 i

    Example:

    Router-PE1# show bgp label table
Label   Type               VRF/RD         Context
24041   IPv4 VRF Table   vrf1601          -
24042   IPv4 VRF Table   vrf1602          -

    Example:

    Router-PE1# show cef vrf vrf1601 192.0.2.27
192.0.2.27/32, version 743, internal 0x5000001 0x0 (ptr 0x8f932174) [1], 0x0 (0x8fa99990), 0xa08 (0x8f9fba58)
 Updated Apr 20 12:33:47.840
 Prefix Len 32, traffic index 0, precedence n/a, priority 3
   via 192.0.2.17/32, 3 dependencies, recursive [flags 0x6000]
    path-idx 0 NHID 0x0 [0x8c0e3148 0x0]
    recursion-via-/32
    next hop VRF - 'default', table - 0xe0000000
    next hop 192.0.2.17/32 via 24039/0/21
    next hop 192.0.2.28/32 Hu0/0/1/1    labels imposed {24059 24031}

    Example:

    Router-PE2# show mpls lsd forwarding
In_Label, (ID), Path_Info: <Type>
24030, (IPv4, 'default':4U, 192.0.2.10/32), 5 Paths
   1/1: IPv4, 'default':4U, Hu0/0/0/19.2, nh=192.0.2.29, lbl=24155,
            flags=0x0, ext_flags=0x0
24031, (VPN-VRF, 'vrf1601':4U), 1 Paths
   1/1: PopLkup-v4, 'vrf1601':4U, ipv4
24032, (VPN-VRF, 'vrf1602':4U), 1 Paths
   1/1: PopLkup-v4, 'vrf1602':4U, ipv4

    Example:

    Router-PE2# show mpls forwarding
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ------------
24019  Pop         192.0.2.30/32      Hu0/0/0/19   192.0.2.31     11151725032
24030  24155       192.0.2.10/32      Hu0/0/0/19   192.0.2.31     3639895
24031  Aggregate   vrf1601: Per-VRF Aggr[V]   \
                                     vrf1601                       0

    Imposition Path: Verify if the BGP neighbor connection is established with the respective neighbor node.

    Verify if BGP routes are advertised and learnt.

    Verify BGP labels.

    Verify if the route is downloaded in the respective VRF.

    Disposition Path

    Verify if the imposition and disposition labels are assigned and label bindings are exchanged for L3VPN prefixes.

    Verify if the label update is received by the FIB.

MPLS L3VPN configuration is verified as successful when traffic-flow, underlay, and overlay command outputs confirm proper forwarding, label, and BGP state.