Multi-Hop MP-eBGP Between Route Reflectors (Option C) is an alternative method used in Inter-Provider MPLS VPN deployments. In this approach, Route Reflectors exchange and propagate VPN routes across multiple Autonomous Systems (ASes), significantly reducing the number of required BGP sessions and simplifying large-scale environments. This section will explain the mechanism in detail and demonstrate its operation through configuration and verification examples.
Inter-Provider MPLS VPN Option C Fundamental
In Inter-Provider MPLS VPN Option C, multi-hop MP-eBGP sessions are established between Route Reflectors (RRs) in different Autonomous Systems. These MP-eBGP sessions carry VPNv4/VPNv6 routes, enabling the exchange of VPN labels and routing information between ASes.
When an RR advertises VPNv4 routes to a remote AS, it does not modify the BGP next-hop. As a result, the next-hop of each VPN route remains the destination PE in the far-end AS. This behavior is crucial because it allows an end-to-end MPLS LSP to be built from the source PE in one AS to the destination PE in another AS.
To support MP-eBGP between RRs and ensure that PEs can reach each other as BGP next-hops, the loopback interfaces of both RRs and PEs must be reachable across all participating ASes. This inter-AS reachability is achieved through the following steps:
IPv4 eBGP peering is established between ASBRs of adjacent ASes.
ASBRs advertise the loopback addresses of their local RRs and PEs over this IPv4 eBGP session.
The ASBRs then redistribute these IPv4 routes into the local IGP (OSPF in this topology).
This process ensures that RRs in different ASes can reach each other to form MP-eBGP VPNv4 sessions and that PEs across AS boundaries can reach one another to build an end-to-end LSP.
A key requirement of Option C is the establishment of a continuous MPLS LSP between PEs in different ASes. However, PE loopbacks are learned via IPv4 eBGP between ASBRs, and LDP does not assign labels to BGP-learned routes. This means that, by default, no MPLS label would exist for PE loopbacks across AS boundaries.
To overcome this limitation, the ASBRs must run BGP with “send-label” enabled. This allows each ASBR to allocate a label for the BGP next-hop and advertise it to the remote ASBR. These transport labels (BGP-LU labels) enable inter-AS label switching and form a complete MPLS LSP spanning multiple ASes.
As a result:
A fully labeled path exists from the source PE → ASBR1 → ASBR2 → destination PE.
The inner VPN label is assigned by the destination PE.
The outer transport label(s) are provided by BGP-LU between ASBRs and by the local IGP/LDP within each AS.
Loopback
Loopback
Summary
MP-eBGP VPNv4 sessions run between RRs in different ASes.
The next-hop is preserved, so the destination PE always remains the next-hop for VPN routes.
RR and PE loopbacks must be reachable across AS boundaries.
ASBRs provide inter-AS reachability via IPv4 eBGP and redistribute the routes into the local IGP.
LDP does not label BGP routes, so PE loopbacks would be unlabeled without additional mechanisms.
BGP send-label must be enabled between ASBRs to distribute labels for PE loopbacks.
These labels allow the creation of an end-to-end MPLS LSP between PEs across multiple ASes.
Inter-Provider MPLS VPN (Option C) Configuration Example
This topology illustrates an Inter-Provider MPLS VPN Option C design, where two autonomous systems (AS1 and AS2) exchange VPNv4 routes via MP-eBGP between their route reflectors (P11 in AS1 and P21 in AS2). Each AS operates its own MPLS backbone with P and PE routers: PE11 serves customers A1/B1 in AS1, and PE21 serves customers A2/B2 in AS2. Customer sites connect to their PE routers through VRF A and VRF B, carrying the prefixes 192.168.1.0/24 and 192.168.2.0/24. P11 acts as the route reflector in AS1, and P21 performs the same role in AS2. PE routers advertise customer routes to the RR in their local AS, and these routes are then propagated to the remote RR, which finally distributes them to the destination PE routers (PE11 or PE21). Because route reflectors do not modify the next-hop, VPN routes learned from the other AS maintain the next-hop of the far-end PE router.
For this reason, a direct end-to-end LSP between the source PE in one AS and the destination PE in the other AS is required. This is achieved using the IPv4 BGP send-label mechanism between the ASBRs and LDP within each AS.
These are the key configuration elements used on the sample P, PE, and ASBR routers to implement Inter-Provider MPLS VPN Option C.
P11 (RR in AS1)
P11 reflects VPNv4 routes inside AS1 and forms the MP-eBGP VPNv4 session with the RR in AS2. With next-hop-unchanged, it preserves the far-end PE as next-hop, which is essential for Option C.
# P11 router bgp 65001 no bgp default route-target filter neighbor 10.10.1.1 remote-as 65001 neighbor 10.10.1.1 update-source Loopback0 neighbor 10.10.2.11 remote-as 65002 neighbor 10.10.2.11 ebgp-multihop 255 neighbor 10.10.2.11 update-source Loopback0 ! address-family vpnv4 neighbor 10.10.1.1 activate neighbor 10.10.1.1 send-community both neighbor 10.10.1.1 route-reflector-client neighbor 10.10.2.11 activate neighbor 10.10.2.11 send-community both neighbor 10.10.2.11 next-hop-unchanged exit-address-family
PE11 (PE in AS1)
PE11 hosts the VRFs, inserts customer routes, and advertises them to the RR with itself as next-hop.
# PE11 ip vrf A rd 1:100 route-target export 1:100 route-target import 1:100 ! ip vrf B rd 1:200 route-target export 1:200 route-target import 1:200 ! router bgp 65001 bgp log-neighbor-changes redistribute connected redistribute static neighbor 10.10.1.11 remote-as 65001 neighbor 10.10.1.11 update-source Loopback0 neighbor 10.10.1.11 route-reflector-client ! address-family vpnv4 neighbor 10.10.1.11 activate neighbor 10.10.1.11 send-community both neighbor 10.10.1.11 next-hop-self exit-address-family ! address-family ipv4 vrf A redistribute connected redistribute static exit-address-family ! address-family ipv4 vrf B redistribute connected redistribute static exit-address-family ! ip route vrf A 192.168.1.0 255.255.255.0 Ethernet0/1 172.16.11.2 ip route vrf B 192.168.1.0 255.255.255.0 Ethernet0/2 172.16.12.2
ASBR11 (AS border router)
ASBR11 first exchanges IPv4 routes with the remote AS to ensure that RR and PE loopbacks from both ASes are reachable. These external IPv4 routes are then redistributed into the IGP, allowing MP-eBGP sessions between RRs and PEs across AS boundaries to be established.
After reachability is in place, BGP send-label is used to exchange labeled IPv4 routes, which provides the end-to-end LSP between the PEs required for Option C forwarding.
# ASBR11 interface Ethernet0/1 ip address 10.12.1.1 255.255.255.0 mpls bgp forwarding ! router ospf 1 redistribute bgp 65001 subnets route-map AS2_LP0 passive-interface Ethernet0/1 network 10.0.0.0 0.255.255.255 area 0 ! router bgp 65001 bgp log-neighbor-changes network 10.10.1.1 mask 255.255.255.255 network 10.10.1.11 mask 255.255.255.255 neighbor 10.12.1.2 remote-as 65002 neighbor 10.12.1.2 send-label ! address-family vpnv4 exit-address-family ! ip prefix-list AS2_LP0 seq 5 permit 10.10.2.1/32 ip prefix-list AS2_LP0 seq 10 permit 10.10.2.11/32 ! route-map AS2_LP0 permit 10 match ip address prefix-list AS2_LP0
Verifying Inter-Provider MPLS VPN Option C Operation
To verify the operation of the Inter-Provider VPN using Multi-Hop MP-eBGP between Route Reflectors (Option C), we run several show commands to confirm that all components are behaving as expected.
As a first step, we examine the VPNv4 BGP table on the PE router in AS1. For the VRF-A routes learned from AS2 (for example 172.16.21.0/24 and 192.168.2.0/24), the BGP table correctly shows the next-hop as the loopback of the remote PE in AS2 (PE21, IP 10.10.2.1). Each route also carries a valid VPN label (e.g., 23 and 24), confirming that Option-C MP-eBGP and end-to-end label exchange are working properly.
PE11#show bgp vpnv4 unicast all labels Network Next Hop In label/Out label Route Distinguisher: 1:100 (A) 172.16.11.0/24 0.0.0.0 23/nolabel(A) 172.16.21.0/24 10.10.2.1 nolabel/23 192.168.1.0 172.16.11.2 24/nolabel 192.168.2.0 10.10.2.1 nolabel/24 Route Distinguisher: 1:200 (B) 172.16.12.0/24 0.0.0.0 25/nolabel(B) 172.16.22.0/24 10.10.2.1 nolabel/25 192.168.1.0 172.16.12.2 26/nolabel 192.168.2.0 10.10.2.1 nolabel/26
It is also essential to verify that an end-to-end LSP exists between the PE routers across AS1 and AS2, especially because the label exchanged between the ASBR routers is provided by BGP send-label, not by LDP.
This can be confirmed by running a trace from the PE11 loopback in AS1 to the PE21 loopback in AS2. The resulting output shows that the path is taken entirely over MPLS-labeled hops, demonstrating that a continuous end-to-end MPLS LSP is successfully established between the two PEs.
If you look at the traceroute output between the PE loopback interfaces in the two different ASes, you can see that label 21 is used on the ASBR-to-ASBR hop.
In the next step, we need to verify that this label is assigned by BGP (through the send-label mechanism) and not by LDP, since Option C requires BGP-signaled labels for the inter-AS segment.
PE11#traceroute 10.10.2.1 source lo0 Type escape sequence to abort. Tracing the route to 10.10.2.1 VRF info: (vrf in name/id, vrf out name/id) 1 10.1.1.1 [MPLS: Label 21 Exp 0] 6 msec 7 msec 6 msec 2 10.1.2.2 [MPLS: Label 22 Exp 0] 6 msec 6 msec 13 msec 3 10.12.1.2 [MPLS: Label 21 Exp 0] 7 msec 6 msec 6 msec 4 10.2.2.1 [MPLS: Label 19 Exp 0] 1 msec 0 msec 1 msec 5 10.2.1.2 6 msec 1 msec 6 msec PE11#
By checking show mpls ldp neighbor on ASBR11 in AS1, we can see that there is no LDP adjacency with the remote ASBR, and the only LDP neighbor present is the internal P router (P11). This confirms that LDP is not used for the inter-AS segment.
Next, using show ip bgp labels, we verify that label 21 is indeed learned via BGP for reaching 10.10.2.1, the loopback of the remote PE (PE21) in AS2.
This is further validated with show mpls forwarding-table, which shows that the ASBR uses the same BGP-assigned label for forwarding toward the remote AS.
ASBR11#show mpls ldp neighbor
Peer LDP Ident: 10.10.1.11:0; Local LDP Ident 10.10.1.2:0
TCP connection: 10.10.1.11.22545 - 10.10.1.2.646
State: Oper; Msgs sent/rcvd: 178/176; Downstream
Up time: 02:24:53
LDP discovery sources:
Ethernet0/0, Src IP addr: 10.1.2.1
Addresses bound to peer LDP Ident:
10.1.1.1 10.10.1.11 10.1.2.1
ASBR11#
ASBR11#show ip bgp labels Network Next Hop In label/Out label 10.10.1.1/32 10.1.2.1 21/nolabel 10.10.1.11/32 10.1.2.1 19/nolabel 10.10.2.1/32 10.12.1.2 nolabel/21 10.10.2.11/32 10.12.1.2 nolabel/19
ASBR11#show mpls forwarding-table Local Outgoing Prefix Bytes Label Outgoing Next Hop Label Label or Tunnel Id Switched interface 18 Pop Label 10.12.1.2/32 0 Et0/1 10.12.1.2 19 Pop Label 10.10.1.11/32 22757 Et0/0 10.1.2.1 20 Pop Label 10.1.1.0/24 0 Et0/0 10.1.2.1 21 19 10.10.1.1/32 14190 Et0/0 10.1.2.1 22 21 10.10.2.1/32 6762 Et0/1 10.12.1.2 23 19 10.10.2.11/32 29826 Et0/1 10.12.1.2
Finally, by running a traceroute from A1 (in AS1) to A2 (in AS2), we can verify that the correct VPN labels and BGP-assigned inter-AS labels are being used, consistent with the earlier analysis.
The output shows that VPN label 23 is used for reaching 172.16.21.2, and VPN label 24 is used for 192.168.2.1.
In both cases, the traceroute also confirms that BGP label 21 is used on the segment between ASBR11 and ASBR12, demonstrating correct Option-C behavior end-to-end.
A1#traceroute 172.16.21.2 Type escape sequence to abort. Tracing the route to 172.16.21.2 VRF info: (vrf in name/id, vrf out name/id) 1 172.16.11.1 6 msec 6 msec 5 msec 2 10.1.1.1 [MPLS: Labels 21/23 Exp 0] 6 msec 6 msec 5 msec 3 10.1.2.2 [MPLS: Labels 22/23 Exp 0] 6 msec 6 msec 2 msec 4 10.12.1.2 [MPLS: Labels 21/23 Exp 0] 1 msec 3 msec 2 msec 5 10.2.2.1 [MPLS: Labels 19/23 Exp 0] 1 msec 1 msec 5 msec 6 172.16.21.1 2 msec 2 msec 5 msec 7 172.16.21.2 3 msec 2 msec 6 msec
A1#traceroute 192.168.2.1 source 192.168.1.1 Type escape sequence to abort. Tracing the route to 192.168.2.1 VRF info: (vrf in name/id, vrf out name/id) 1 172.16.11.1 6 msec 6 msec 6 msec 2 10.1.1.1 [MPLS: Labels 21/24 Exp 0] 4 msec 3 msec 2 msec 3 10.1.2.2 [MPLS: Labels 22/24 Exp 0] 1 msec 1 msec 3 msec 4 10.12.1.2 [MPLS: Labels 21/24 Exp 0] 2 msec 1 msec 6 msec 5 10.2.2.1 [MPLS: Labels 19/24 Exp 0] 7 msec 7 msec 9 msec 6 172.16.21.1 [MPLS: Label 24 Exp 0] 5 msec 7 msec 2 msec 7 172.16.21.2 6 msec 7 msec 2 msec
It is also useful to verify the operation of the route reflectors, ensuring that all VPNv4 routes exchanged between the two ASes are indeed passing through the RRs. By inspecting the VPNv4 BGP tables on both RRs, we can confirm that routes learned from the local PE are reflected toward the remote AS, and routes received from the remote AS are reflected back to the local PE. This validates that the inter-AS MP-eBGP sessions between the RRs are functioning correctly and that all VPNv4 route exchange follows the expected Option-C control-plane path.
P11#show bgp vpnv4 unicast all
BGP table version is 41, local router ID is 10.10.1.11
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 1:100
*>i 172.16.11.0/24 10.10.1.1 0 100 0 ?
*> 172.16.21.0/24 10.10.2.1 0 65002 ?
*>i 192.168.1.0 10.10.1.1 0 100 0 ?
*> 192.168.2.0 10.10.2.1 0 65002 ?
Route Distinguisher: 1:200
*>i 172.16.12.0/24 10.10.1.1 0 100 0 ?
*> 172.16.22.0/24 10.10.2.1 0 65002 ?
*>i 192.168.1.0 10.10.1.1 0 100 0 ?
*> 192.168.2.0 10.10.2.1 0 65002 ?
P11#
Inter-Provider MPLS VPN Option C – Key Device Configurations
The following configurations illustrate the essential settings required to implement an Inter-Provider MPLS VPN using the MP-eBGP Between Route Reflectors (Option C).
hostname P11 ! ip cef ! mpls label protocol ldp ! interface Loopback0 ip address 10.10.1.11 255.255.255.255 ! interface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 mpls ip ! interface Ethernet0/1 ip address 10.1.2.1 255.255.255.0 mpls ip ! router ospf 1 network 10.0.0.0 0.255.255.255 area 0 ! router bgp 65001 bgp log-neighbor-changes no bgp default route-target filter neighbor 10.10.1.1 remote-as 65001 neighbor 10.10.1.1 update-source Loopback0 neighbor 10.10.2.11 remote-as 65002 neighbor 10.10.2.11 ebgp-multihop 255 neighbor 10.10.2.11 update-source Loopback0 ! address-family vpnv4 neighbor 10.10.1.1 activate neighbor 10.10.1.1 send-community both neighbor 10.10.1.1 route-reflector-client neighbor 10.10.2.11 activate neighbor 10.10.2.11 send-community both neighbor 10.10.2.11 next-hop-unchanged exit-address-family ! mpls ldp router-id Loopback0
hostname PE11 ! ip vrf A rd 1:100 route-target export 1:100 route-target import 1:100 ! ip vrf B rd 1:200 route-target export 1:200 route-target import 1:200 ! ip cef ! mpls label protocol ldp ! interface Loopback0 ip address 10.10.1.1 255.255.255.255 ! interface Ethernet0/0 ip address 10.1.1.2 255.255.255.0 mpls ip ! interface Ethernet0/1 ip vrf forwarding A ip address 172.16.11.1 255.255.255.0 ! interface Ethernet0/2 ip vrf forwarding B ip address 172.16.12.1 255.255.255.0 ! router ospf 1 network 10.0.0.0 0.255.255.255 area 0 ! router bgp 65001 bgp log-neighbor-changes redistribute connected redistribute static neighbor 10.10.1.11 remote-as 65001 neighbor 10.10.1.11 update-source Loopback0 neighbor 10.10.1.11 route-reflector-client ! address-family vpnv4 neighbor 10.10.1.11 activate neighbor 10.10.1.11 send-community both neighbor 10.10.1.11 next-hop-self exit-address-family ! address-family ipv4 vrf A redistribute connected redistribute static exit-address-family ! address-family ipv4 vrf B redistribute connected redistribute static exit-address-family ! ip route vrf A 192.168.1.0 255.255.255.0 Ethernet0/1 172.16.11.2 ip route vrf B 192.168.1.0 255.255.255.0 Ethernet0/2 172.16.12.2 ! mpls ldp router-id Loopback0
hostname ASBR11 ! ip cef ! mpls label protocol ldp ! interface Loopback0 ip address 10.10.1.2 255.255.255.255 ! interface Ethernet0/0 ip address 10.1.2.2 255.255.255.0 mpls ip ! interface Ethernet0/1 ip address 10.12.1.1 255.255.255.0 mpls bgp forwarding ! router ospf 1 redistribute bgp 65001 subnets route-map AS2_LP0 passive-interface Ethernet0/1 network 10.0.0.0 0.255.255.255 area 0 ! router bgp 65001 bgp log-neighbor-changes network 10.10.1.1 mask 255.255.255.255 network 10.10.1.11 mask 255.255.255.255 neighbor 10.12.1.2 remote-as 65002 neighbor 10.12.1.2 send-label ! address-family vpnv4 exit-address-family ! ip prefix-list AS2_LP0 seq 5 permit 10.10.2.1/32 ip prefix-list AS2_LP0 seq 10 permit 10.10.2.11/32 ! route-map AS2_LP0 permit 10 match ip address prefix-list AS2_LP0 ! mpls ldp router-id Loopback0