While RDs make VPNv4 routes unique, they do not control route distribution. Route Targets (RTs) are the primary mechanism for defining VPN membership and isolation. Creating separate VRFs with distinct import/export RT policies ensures that the trading and retail routes are kept completely separate, fulfilling the strict isolation requirement even on shared PEs.

For a VLL (EPIPE) service to pass traffic, three main components must be up: the SAPs, the SDP (Service Distribution Path), and the binding between the service and the SDP. If the SAPs are up, the next logical step is to check the status of the SDP binding (`show service sdp `). If the binding is down, the service has no path between PEs.

In a VPRN, OSPF routes learned from a CE are stored in the VRF routing table. To advertise these routes to other PEs via BGP, they must be redistributed from the OSPF instance into MP-BGP. This is done by configuring `redistribute bgp` within the VPRN OSPF context. Without this, OSPF routes remain local to the site.

The RD is prepended to an IPv4 prefix to create a unique VPN-IPv4 (or VPNv4) address. This allows different customers (or the same customer in different VRFs) to use identical, overlapping IPv4 address spaces (like 10.0.0.0/24) without conflict within the BGP table of the provider’s P routers. The RT (Route Target) controls VPN membership and advertisement.

In a VPLS, MAC learning is data-plane based. A PE learns source MAC addresses from incoming frames on its local SAPs and SDP bindings. To facilitate learning across sites, unknown unicast, broadcast, and multicast frames are flooded to all other SAPs and SDPs in the service. Remote PEs then learn those MACs from the flooded traffic. BGP is used for autodiscovery of members, not for MAC distribution.

The ‘base’ routing instance (also known as the default or global routing table) is separate from all VRF instances. Configuring a management interface (physical or loopback) within the ‘base’ instance ensures its routes are not imported into any customer VRF, providing the required isolation. The ‘management’ router instance is a specific, secure context for the router’s own management, often accessed via the base routing instance.

P routers are the core MPLS transit routers. They do not run BGP for customer routes and do not maintain VPN states. Their role is to switch labels based on the MPLS transport tunnel (LSP). They look up the top (transport) label in their LFIB and simply swap it with the next-hop label and forward it out the appropriate interface. The inner label (e.g., the VPN label) remains untouched by P routers.

An IES interface is used to connect a customer to the public Internet or the service provider’s global IP core. It is part of the ‘base’ routing instance. A VPRN interface, however, is part of a Virtual Private Routed Network and belongs to a specific VRF, isolating its routing table from the global table and other VRFs. This is the fundamental architectural difference between an internet access service and a private IP VPN service.

RSVP-TE (Resource Reservation Protocol – Traffic Engineering) allows for the explicit establishment of label-switched paths (LSPs) with guaranteed bandwidth reservations. By using an RSVP-TE SDP for the EPIPE service, the transport tunnel itself has dedicated bandwidth, providing the strong guarantees needed for sensitive financial traffic. LDP-based SDPs do not offer bandwidth reservation.

While RDs make VPNv4 routes unique, they do not control route distribution. Route Targets (RTs) are the primary mechanism for defining VPN membership and isolation. Creating separate VRFs with distinct import/export RT policies ensures that the trading and retail routes are kept completely separate, fulfilling the strict isolation requirement even on shared PEs.0