In the last article, we discussed the operation of LDP in detail and then went on to look at the different data structures used in MPLS, including the LIB and LFIB. In this article, we will see how packets are routed across an MPLS network using the different data structures. We will also discuss the three operations—push, swap, pop—that can be performed by LSRs on labels.

Our network diagram is shown below:

To understand how packets are routed in an MPLS network, we will take an example. We will ping from the network behind CE2 to the network behind CE1 while capturing the packets as they travel along the path.

We see that the ping was successful, but how did that happen? CE2 sent the packet (ping request) to its default gateway, which is PE2. PE2 receives that packet and sees that it is a normal IP packet based on the Ethertype value of 0x0800.

When an MPLS-enabled router receives an unlabeled packet, it makes the forwarding decision based on the FIB. Therefore, PE2 will check its CEF (FIB) table for that packet’s forwarding.

PE2 sees that it should send the packet through its Fa0/0 interface to the next-hop of and also imposes a label of 20. This is called label imposition (or push), where an LSR pushes one or more labels unto the label stack before forwarding the packet.

CCNA Training – Resources (Intense)

Let’s take a quick detour: How did PE2 arrive at imposing a label of 20 for traffic destined to PE2 checks its routing table for that destination prefix:

PE2 discovers that the route was received via BGP with a next-hop of It now has to perform a recursive lookup to find the outgoing interface to reach that next-hop address.

It sees that the next-hop is again reachable via another next-hop of It then performs another recursive lookup to find the interface to reach

Note: I could have avoided this double recursive lookup by using the BGP next-hop-self command between the BGP neighbor statements. That way, I would not have needed the network mask and network mask statements.

PE2 discovers that is known via OSPF with a next-hop of and an outgoing interface of Fa0/0. PE2 can now check its LFIB to discover the tag to impose for the next-hop of

The tag is 20, using P2 as the next-hop address. This is why the FIB imposes a tag of 20 for destination prefix

Moving on with our packet flow, PE2 adds the MPLS label of 20 and forwards the packet toward P1. The MPLS label is highlighted in red below. An MPLS label is 32 bits long, with the first 20 bits used for the label value, the next 3 bits are experimental bits used mostly in QoS, the next 1 bit is the bottom of stack (BoS) bit, indicating the bottom label in the label stack, and the remaining 8 bits represent the time-to-live (TTL) field.

P1 receives the labeled packet from PE2. It knows the packet is labeled because it has an Ethertype value of 0x8847, as highlighted in green above. Therefore, P1 will consult its LFIB for a decision on how to forward the traffic.

P1 discovers that it has to forward the packet out through its Fa0/0 towards the next-hop of (PE1). Also, P1 must “pop” the top label in the label stack before sending it to PE1. This is known as penultimate hop popping (PHP). In essence, PE1 signaled P1 to pop the top label of any packet destined to before P1 sends the packet to PE1. PE1 used the implicit-null label to signal this to P1.

Therefore, when PE1 receives the packet, the label has already been stripped and all we have is an IP packet, as shown in the capture below.

Since the packet is unlabeled, PE1 uses its FIB table to decide how to forward the packet. It discovers that the next-hop is (CE1) via its Fa0/1 interface.

CE1 receives the packet and processes it, finding that the packet belongs to it. Since it is a ping request packet, CE1 will send a ping reply packet back to the source of the ping request and the forwarding is done in the reverse direction. PE1 imposes a label of 16 and forwards it to P1. P1 pops the label and sends it to PE2. which then forwards it to CE2.

At this point, I want to draw your attention to something on the core (P) routers. These routers don’t actually know about the customer networks, i.e., no customer routes are in their routing tables.

Only the edge (PE) routers know about the customer networks and share this information via BGP. Therefore, we see how the use of labels in MPLS can help reduce the burden on the core routers because they don’t need to run BGP anymore.

Label Swapping

In the packet flow above, we have seen two of the operations that can be performed on labels: push and pop. In this section, we will look at the third operation, which is swap. An LSR performs label swapping by replacing the top label in a label stack with another label before forwarding the packet out. To see this work, I will shut down the interface between P2 and PE2. That way, if PE2 wants to reach P2, it has to go through the following path: PE2à P1 à PE1 à P2. Let’s see how this works.

Before shutting down the interface, notice that PE2 will forward traffic to without imposing any tag or it will perform PHP.

Now, I will shut down interface E1/1 on P2.

If we look at the LFIB on PE2, we see that PE2 will now push the label 17 on any packet to and send the packet out through its Fa0/0 using P1 ( as a next-hop.

When P1 receives the packet with label 17, it swaps that label with label 18 and forwards the packet to PE1. This is where label swapping occurs.

On getting to PE1, PE1 will perform PHP and send the packet unlabeled to P2.

Note: PHP does not always result in an unlabeled packet; the packet could still be labeled if there is more than one label in the label stack. We see this in MPLS VPN.

We can see label swapping in action by pinging from PE2.

As we explained above, label 17 is pushed onto the packet sent from PE2, shown in the capture below:

When the packet gets to P1, it will swap the top label with label 18 before sending it to PE1.

Now that you have a basic understanding and configuration of MPLS, you can go on to applications of MPLS, such as MPLS VPN and MPLS AToM.


In this article, we have described the process by which packets are routed across an MPLS network. There are two key points to note concerning how packets are forwarded: If the packet arrives at the packet unlabeled, the FIB is used to perform forwarding decision; on the other hand, if a labeled packet is received, the LFIB is used instead. We have also seen the three operations that can be performed on labels: push, swap, and pop.

I hope you have found this article insightful and I wish you success in your further MPLS study.

References and Further Reading