Theoretical foundations and architecture

A single IGP with LDP scales to a few thousand nodes, whereas an operator with tens of thousands of access nodes needs an end-to-end LSP between any two PEs. Unified (Seamless) MPLS solves this with hierarchy: each domain (access, aggregation, core) runs its own IGP with LDP, and the loopbacks of remote PEs are carried by BGP Labeled Unicast (RFC 8277, formerly RFC 3107), that is, BGP distributes prefixes together with MPLS labels. At the domain border the ABR/ASBR sets next-hop-self and swaps the label: the stack at ingress holds the transport label to the ABR, the BGP-LU label of the remote PE and the VPN service label. The IGP is not redistributed between domains, so access tables stay small, while protection and fast convergence are inherited from the earlier lessons: LFA inside a domain and PIC on the PE. The lesson explains the BGP-LU format, the label sequence across the border, loopback selection by community, table sizes and limitations. It assumes the knowledge of LDP, iBGP/RR, L3VPN and Inter-AS Option C.

The scale problem of a single domain

A flat network with one IGP and LDP requires every node to know the /32 of every PE and to hold a label for each. For networks with tens of thousands of access and aggregation nodes this means a huge LSDB, frequent SPF recomputations on any flap in a remote segment, large LFIBs on cheap access nodes and difficult convergence. A practical guide: a single IGP domain stays manageable within hundreds to a few thousand nodes, the exact value depending on the platform. Splitting into IS-IS/OSPF areas does not solve the task if LDP still needs the /32 of every PE in every area, and summarising loopbacks breaks fast PE failure detection (see the previous lesson). A way is needed to convey remote PE reachability without a common IGP.

BGP Labeled Unicast: the format

BGP-LU (RFC 8277, which replaced RFC 3107) uses MP-BGP with AFI 1 (IPv4) or 2 (IPv6) and SAFI 4 (labeled unicast). The label is carried directly in the NLRI: the Length field includes 24 bits of label per stack element plus the prefix length, followed by the label field (3 bytes: 20 bits of value, 3 bits of TC, 1 bottom-of-stack bit) and the prefix itself. RFC 8277 allows several labels for one prefix and, together with Add-Path (RFC 7911), allows several paths per prefix. In a withdrawal the label field is usually 0x800000 or 0x000000 (the value has no meaning). The label is in the NLRI, not in a separate attribute; the same mechanism is used in Inter-AS Option C for loopbacks. The session must negotiate the ability to exchange labels: send-label on Cisco, family inet labeled-unicast on Junos, label-route-capability on Huawei.

The hierarchy and the three-label stack

The network is split into domains, for example access A - core - access B. Each domain runs its own IGP and LDP. PE1 and PE2 exchange VPNv4 through the RR as usual, but their loopbacks are visible only in their own domains, so PE1 needs a path to 10.255.0.2/32: it arrives over BGP-LU through the ABR. The ABR acts as an RR for LU and sets next-hop-self (on Cisco next-hop-self all, so that the next hop is also changed for reflected iBGP routes). Allocating its own label for every prefix, the ABR programs the LFIB: the incoming BGP-LU label, the swap action to the label of PE2 (the BGP-LU label issued by PE2), and an output through the LDP label of domain B. The stack on PE1 is three labels: the LDP transport label to the ABR, the BGP-LU label of the remote PE and the VPN label. If the ABR and PE1 are not neighbours, one more hop is added between them. With PHP the outer label is removed by the penultimate node, and the packet reaches the ABR carrying the BGP-LU label.

Loopback selection and preventing bloat

BGP-LU must not push the whole table into the access. Practical methods: (1) a loopback community (for example 65000:999) is set on the PE at origination; on the ABR only prefixes with this community and a /32 mask are allowed; (2) a prefix list for /32 from the loopback block; (3) for access nodes - receive only the loopbacks of the required remote PEs (an RT-Constrain-like approach: on demand by service) or use a default-like solution only where permitted. In addition, the number of prefixes (maximum-prefix) per session is limited on the RR and ABR so that an accidentally advertised table does not fill the memory. The label is allocated per prefix, and the number of labels is limited by the 20-bit space (about one million values minus the reserved 0-15), so on the ABR estimate the number of loopbacks, multiplied by the number of sessions in more complex modes.

Convergence and protection

Inside a domain a failure is covered by LFA and the fast IGP (earlier lessons). When PE2 fails, its /32 disappears from the IGP of domain B, the ABR sends a BGP-LU withdrawal, and it propagates to PE1: convergence is affected by the next-hop tracking and MRAI delays, so PE1 uses PIC Edge with a backup path through a second ABR (ABR2) or another PE. A doubled ABR creates two paths per prefix (two BGP-LU labels and two next hops): without Add-Path or unique RD/originator the RR will pick one. PE1 sees a failure of the ABR itself as the disappearance of the next hop (through the IGP of domain A), and PIC switches to ABR2 if the path is in the FIB. Loops between ABRs are prevented by cluster-id and originator-id; with asymmetric policies, check.