What is MPLS?

Multiprotocol Label Switching (MPLS) is a WAN technology that forwards packets through a provider’s core network using short, fixed-length labels instead of per-hop IP route lookups. Carriers have sold it for decades as a private, predictable Layer 3 VPN service, and it remains one of the underlay transports SD-WAN networks – including Versa’s – build encrypted overlays across.

Key takeaways

• MPLS forwards packets using labels instead of per-hop IP route lookups.
• Routers swap labels along a pre-established path, a label-switched path.
• Carriers sell MPLS as a private, predictable Layer 3 VPN WAN service.
• Versa SD-WAN treats MPLS as one WAN underlay alongside internet and LTE.
• A Versa SD-WAN gateway can interconnect legacy MPLS L3VPN sites with SD-WAN.

On this page: Why it matters · How it works · Types · MPLS & Versa · FAQ

Why is MPLS important?

Long before SD-WAN existed, enterprises depended on MPLS to connect branch offices, data centers, and campuses over a provider’s private backbone. A carrier-managed MPLS Layer 3 VPN offered predictable latency, committed bandwidth, and traffic isolation the public internet could not guarantee – why MPLS became the default enterprise WAN transport for a generation of networks.

That installed base is why MPLS still matters in an SD-WAN world. Most enterprises added internet and LTE circuits alongside MPLS rather than replacing it, letting policy decide which transport carries which traffic. Some branches keep MPLS for latency-sensitive applications; others retain it only to reach services still hosted on the carrier’s network. Any SD-WAN architecture must interoperate with MPLS, since so much enterprise WAN traffic still crosses it.

What is MPLS?

MPLS speeds up forwarding inside a provider’s network by replacing per-hop IP route lookups with label swapping. An ingress router – a Label Edge Router (LER) – classifies each packet into a Forwarding Equivalence Class (FEC) and attaches a short label. Interior routers, or Label Switch Routers (LSRs), forward the packet by swapping that label at each hop – no IP header inspection required. The path a packet traverses is a Label-Switched Path (LSP), established in advance by a signaling protocol such as LDP or RSVP-TE.

This label-based forwarding also enables MPLS Layer 3 VPNs. Provider Edge (PE) routers use BGP to exchange customer routes and place each customer in its own VRF, forwarding traffic across the shared core using labels that keep every customer’s traffic logically separate.

Types of MPLS

MPLS Layer 3 VPN (L3VPN) is the form most enterprises buy: a carrier-managed IP VPN where BGP distributes routes between sites and labels carry traffic across the shared core, isolating each customer in its own VRF. MPLS Layer 2 VPN services – pseudowires and VPLS – extend Layer 2 connectivity instead, making sites look like they share an Ethernet link.

Traffic-engineered MPLS, signaled with RSVP-TE, pins traffic to explicit paths rather than the shortest IGP route. Segment Routing (SR-MPLS) is the modern evolution: it encodes a path as a label stack at the ingress router, removing the need for a separate signaling protocol like LDP or RSVP-TE.

MPLS & Versa

Versa’s SD-WAN reference architecture treats MPLS as one of several WAN underlays – alongside internet and LTE – that CPE devices terminate and that Director Workflows use to build encrypted overlay tunnels between branches, hubs, and Controllers. Each transport gets its own virtual router, including a dedicated MPLS-Transport-VR, and SLA monitoring tracks latency, jitter, and packet loss on MPLS paths like any other.

Because a carrier’s MPLS L3VPN is already private, VOS lets administrators run it as a clear-text tunnel instead of IPsec, saving encryption overhead. Where a legacy MPLS L3VPN still connects unmigrated sites, a VOS device can act as an SD-WAN gateway, peering with the provider over BGP to exchange legacy and SD-WAN routes.

Frequently asked questions

What is the difference between MPLS and SD-WAN?

MPLS is a WAN transport: a carrier’s label-switched network that moves traffic between sites. SD-WAN is an overlay architecture that builds encrypted tunnels across available underlays – MPLS, internet, LTE – and steers traffic between them by policy. Most deployments use MPLS as one underlay, not a replacement.

How does MPLS label switching work?

An ingress router classifies each packet into a forwarding class and attaches a short label. Interior routers forward it by swapping that label at each hop instead of a full IP route lookup, following a pre-established label-switched path to the egress router, which removes the label.

What is an MPLS Layer 3 VPN?

An MPLS L3VPN is a carrier-managed private WAN service: provider edge routers use BGP to exchange customer routes and keep each customer in its own VRF, forwarding traffic across the shared core using labels. It is the most common form of MPLS enterprises buy.

Is MPLS traffic encrypted?

Not by default. MPLS forwards traffic across a provider’s private core, which many organizations treat as inherently secure and leave unencrypted to save overhead. Versa VOS devices support this with a clear-text tunnel option on MPLS underlays, though administrators can still apply IPsec if the transport isn’t fully trusted.

Can MPLS and SD-WAN coexist in the same network?

Yes – most enterprise SD-WAN deployments run MPLS alongside internet and LTE rather than instead of it. Versa CPE devices terminate MPLS and other transports simultaneously, and a VOS device can act as a gateway so legacy MPLS L3VPN sites can reach SD-WAN-enabled sites during or after migration.

More on MPLS

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about MPLS, these are worth looking at next.