L3VPN

L3VPN, short for Layer 3 Virtual Private Network, is a type of VPN service that provides IP-level connectivity among multiple customer sites over a shared provider network while preserving separate customer routing instances.

In MPLS-based L3VPN, the service provider uses customer edge devices, PE routers with VRFs, and MP-BGP to exchange VPN routes. Each customer has its own VRF on the PE; routes are distinguished via Route Distinguishers. The core uses MPLS labels to forward packets from one PE to another, and traffic between sites stays within the VPN's routing domain.

The common variant is the MPLS L3VPN defined in RFC 4364 (formerly RFC 2547), often called Virtual Private Routed Network (VPRN). It supports overlapping IP addressing because VPN routes are scoped to the customer VRFs. It typically provides scale advantages and allows management of QoS and traffic engineering across the provider network. Alternative L3VPN approaches exist, such as IPsec-based L3VPNs or IPv6-only L3VPNs, but MPLS remains common in carriers' core networks.

Compared with L2VPNs, L3VPN maintains customer routing control at the edge, reducing the need for the provider to emulate a single layer-2 broadcast domain, and offers easier integration with customer internal routing policies. Limitations include reliance on the provider for network reachability and performance, potential complexity of VRF management, and security considerations around shared infrastructure.

See also: MPLS, VPRN, VRF, MP-BGP, Route Distinguishers, VPN, L2VPN.