Static MPLS LSPs

The first function partitions the entire set of incoming packets into a set of Forwarding Equivalence Classes (FECs). All packets associated to a particular FEC are forwarded along the same path to the same destination. The second function maps each FEC to a next hop destination router. Each router along the path performs these actions.

In MPLS, the assignment of a packet to a particular FEC is done only one time: when the packet enters the network. The FEC is mapped to an LSP, which is established prior to packet forwarding.

An MPLS egress label, representing the FEC to which the packet is assigned, is attached to the packet (push operation) and the labeled packet is forwarded to the next hop router along that LSP path.

At subsequent hops, the packet IP header is not analyzed. Instead, the ingress label is used as an index into a table which specifies the next hop and a new egress label. The ingress label is replaced with the new egress label (swap operation), and the packet is forwarded to the specified next hop.

At the MPLS network egress, the ingress label is removed from the packet (pop operation). If this router is the destination of the packet (based on the remaining packet), the packet is handed to the receiving application, such as a MAC VRF. If this router is not the destination of the packet, the packet is sent into a new MPLS tunnel or forwarded by conventional IP forwarding toward the Layer 3 destination.

The ILER receives unlabeled packets from outside the MPLS domain, applies MPLS egress labels to the packets, and forwards the labeled packets into the MPLS domain.

The ELER receives labeled packets from the MPLS domain, removes the ingress labels, and forwards unlabeled packets outside the MPLS domain.

A Label Switching Router (LSR) is a device internal to an MPLS network, with all interfaces inside the MPLS domain. These devices switch labeled packets inside the MPLS domain. In the core of the network, LSRs ignore the packet's IP header and simply forward the packet using the MPLS label swapping mechanism. The last LSR before the ELER can be configured with an implicit null label. This informs that LSR to send MPLS packets without an outer egress label. This is known as Penultimate Hop Popping (PHP).

The LSP must be established before any packets can be forwarded. To set up an LSP, labels need to be distributed for the path. For static LSPs, the label distribution is done manually by the network administrator. Although a high control level of the labels in use is achieved, static LSPs cannot enjoy the resilience and recovery functionality that the dynamic label signaling protocols can offer.

MPLS example topology shows the example topology consisting of six SR Linux nodes located in a single autonomous system.

Verify the operation of the static LSPs with ping or traceroute from PE-1 to PE-6.

On PE-1, configure a static route to PE-6 that makes use of the LSP, as follows:

# on PE-1:
enter candidate
    network-instance default static-routes {
            admin-state enable
            route 192.0.2.6/32 {
                admin-state enable
                next-hop-group g-from-1-to-2
            }

On PE-6, configure a static route to PE-1 that makes use of a return LSP that is needed for the return traffic (not shown).

The IPv4 unicast route table on PE-1 has an additional entry (type static) for prefix 192.0.2.6/32 to PE-6, indicating that traffic to this prefix is sent with MPLS encapsulation to next hop 192.168.12.2 via subinterface ethernet-1/31.1 on PE-1. The IPv4 unicast route table on PE-6 has a similar additional entry for prefix 192.0.2.1 to PE-1.

--{ running }--[  ]--
A:admin@PE-1# show / network-instance default ipv4-unicast prefix
---------------------------------------------------------------------------------------------------------------------------------------------------------
IPv4 unicast route table of network instance default
---------------------------------------------------------------------------------------------------------------------------------------------------------
+-----------------+------+-----------+--------------------+---------+---------+--------+-----------+-----------+-----------+-----------+-----------+
|     Prefix      |  ID  |   Route   |    Route Owner     | Active  | Origin  | Metric |   Pref    | Next-hop  | Next-hop  |  Backup   |  Backup   |
|                 |      |   Type    |                    |         | Network |        |           |  (Type)   | Interface | Next-hop  | Next-hop  |
|                 |      |           |                    |         | Instanc |        |           |           |           |  (Type)   | Interface |
|                 |      |           |                    |         |    e    |        |           |           |           |           |           |
+=================+======+===========+====================+=========+=========+========+===========+===========+===========+===========+===========+
| 192.0.2.1/32    | 18   | host      | net_inst_mgr       | True    | default | 0      | 0         | None      | None      |           |           |
| 192.0.2.6/32    | 0    | static    | static_route_mgr   | True    | default | 1      | 5         | 192.168.1 | ethernet- |           |           |
|                 |      |           |                    |         |         |        |           | 2.2       | 1/31.1    |           |           |
|                 |      |           |                    |         |         |        |           | (mpls)    |           |           |           |
| ---snip---                                                                                                                                       |
+-----------------+------+-----------+--------------------+---------+---------+--------+-----------+-----------+-----------+-----------+-----------+

The ping from PE-1 to PE-6 succeeds:

# on PE-1:
enter running
    ping 192.0.2.6 network-instance default -c 7 -I 192.0.2.1 -4

Using network instance default
PING 192.0.2.6 (192.0.2.6) from 192.0.2.1 : 56(84) bytes of data.
64 bytes from 192.0.2.6: icmp_seq=1 ttl=64 time=3.64 ms
64 bytes from 192.0.2.6: icmp_seq=2 ttl=64 time=3.19 ms
64 bytes from 192.0.2.6: icmp_seq=3 ttl=64 time=4.95 ms
64 bytes from 192.0.2.6: icmp_seq=4 ttl=64 time=4.95 ms
64 bytes from 192.0.2.6: icmp_seq=5 ttl=64 time=3.18 ms
64 bytes from 192.0.2.6: icmp_seq=6 ttl=64 time=4.07 ms
64 bytes from 192.0.2.6: icmp_seq=7 ttl=64 time=3.20 ms

--- 192.0.2.6 ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 6008ms
rtt min/avg/max/mdev = 3.180/3.882/4.953/0.738 ms

The output of the traceroute from PE-1 to PE-6 indicates that the traffic reaches the destination via three hops. The intermediate hops are not identified, because they do not have a route to PE-1.

# on PE-1:
enter running
    traceroute 192.0.2.6 network-instance default -s 192.0.2.1 -n

Using network instance default
traceroute to 192.0.2.6 (192.0.2.6), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  192.0.2.6  3.336 ms  4.311 ms  4.297 ms

When static routes are also defined on the LSRs for return traffic to PE-1, the intermediate hops are identified as PE-2 and PE-4.

# on PE-1:
enter running
    traceroute 192.0.2.6 network-instance default -s 192.0.2.1 -n

Using network instance default
traceroute to 192.0.2.6 (192.0.2.6), 30 hops max, 60 byte packets
 1  192.168.12.2  2.687 ms  2.661 ms  2.649 ms
 2  192.168.24.2  2.635 ms  2.621 ms  2.609 ms
 3  192.0.2.6  3.531 ms  3.522 ms  3.509 ms

Penultimate Hop Popping (PHP) can be used with static LSPs. This is achieved by configuring the last LSR (PE-4) before the ELER (PE-6) to swap the ingress label to IMPLICIT_NULL instead of a specific egress label value.

# on PE-4:
enter candidate
    network-instance default next-hop-groups {
            group g-from-4-to-6 {
                nexthop 0 {
                    pushed-mpls-label-stack [ IMPLICIT_NULL ]
                }
            }

The previous configuration causes PE-4 to pop the top label from the incoming labeled frame received from PE-2 and send it to PE-6 without adding another outer label. The IMPLICIT_NULL egress label is not actually pushed onto a frame.

Prior to the configuration of PHP, the egress label on PE-4 is 406.

--{ running }--[  ]--
A:admin@PE-4# show / network-instance route-table mpls
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+
| Label   | Operation | Type        | Next Net-Inst   | Next-hop IP (Type)     | Next-hop             | Next-hop MPLS    |
|         |           |             |                 |                        | Subinterface         | labels           |
+=========+===========+=============+=================+========================+======================+==================+
| 204     | SWAP      | static-mpls | N/A             | 192.168.46.2 (mpls)    | ethernet-1/6.1       | 406              |
| ---snip---                                                                                                             |
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+

When PHP is configured on PE-4, the egress label on PE-4 is IMPLICIT_NULL.

--{ running }--[  ]--
A:admin@PE-4# show / network-instance route-table mpls
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+
| Label   | Operation | Type        | Next Net-Inst   | Next-hop IP (Type)     | Next-hop             | Next-hop MPLS    |
|         |           |             |                 |                        | Subinterface         | labels           |
+=========+===========+=============+=================+========================+======================+==================+
| 204     | SWAP      | static-mpls | N/A             | 192.168.46.2 (mpls)    | ethernet-1/6.1       | IMPLICIT_NULL    |
| ---snip---                                                                                                             |
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+

If the traffic arriving at PE-4 was IP with a single label, then it would arrive at PE-6 as unlabeled IP traffic.

If the static LSP spans a single hop, for example from PE-1 to PE-2, the ILER PE-1 pushes the IMPLICIT_NULL instead of a label. The configuration on PE-1 is as follows:

# on PE-1:
enter candidate
    network-instance default {
        next-hop-groups {
            group g-from-1-to-2-php {
                admin-state enable
                nexthop 0 {
                    ip-address 192.168.12.2
                    admin-state enable
                    resolve false
                    pushed-mpls-label-stack [ IMPLICIT_NULL ]
                }
            }
        }
        static-routes {
            admin-state enable
            route 192.0.2.2/32 {
                admin-state enable
                next-hop-group g-from-1-to-2-php
            }
        }

--{ + running }--[  ]--
A:admin@PE-1# show / network-instance default route-table ipv4-unicast prefix 192.0.2.2/32 detail
--------------------------------------------------------------------------------------------------------
IPv4 unicast route table of network instance default
--------------------------------------------------------------------------------------------------------
Destination            : 192.0.2.2/32
ID                     : 0
Route Type             : static
Route Owner            : static_route_mgr
Origin Network Instance: default
Metric                 : 1
Preference             : 5
Active                 : true
Last change            : 2026-03-04T07:46:30.527Z
Resilient hash         : false
--------------------------------------------------------------------------------------------------------
Next hops: 1 entries
192.168.12.2 (mpls) via [ethernet-1/2.1]
    pushed MPLS labels : [IMPLICIT_NULL]
Backup Next hops: 0 entries
---snip---
--------------------------------------------------------------------------------------------------------