What is L3VPN?

An L3VPN (Layer 3 VPN) is a provider service that carries many customers' IP routes over one shared network, keeping each customer's routing separate.

The best-known form is BGP/MPLS IP VPN, defined in RFC 4364. Customer edge (CE) routers connect to provider edge (PE) routers, and each PE puts each customer's interfaces into its own VRF, a private routing table. PEs then exchange the customers' routes with each other over multiprotocol BGP. Because two customers may both use 10.0.0.0/8, each route is prefixed with a route distinguisher, which makes otherwise identical prefixes unique inside BGP. Route targets, carried as extended communities, decide which VRFs import which routes, so the same machinery can build simple per-customer VPNs, hub-and-spoke designs or shared-services access. In the data plane, packets usually carry two MPLS labels: an outer transport label that takes them to the right egress PE, and an inner label that tells that PE which VRF or customer the packet belongs to. Core (P) routers only look at the outer label and never need customer routes.

Network engineers meet L3VPNs as the classic enterprise "MPLS WAN" bought from a carrier, and inside data centres and service providers for separating tenants, management traffic or internet and private services. Don't confuse an L3VPN with an encrypted VPN such as WireGuard or IPsec: an L3VPN provides separation, not encryption, and relies on trust in the provider's network. It also differs from layer 2 services, which bridge Ethernet frames rather than routing IP. EVPN can provide the same layer 3 separation over VXLAN instead of MPLS, which the EVPN and VXLAN lesson touches on.