Routing & SwitchingNetworking SecurityAdvanced

MPLS L3VPN PE-CE routing and route leaking: BGP, OSPF sham links, EIGRP, RIP and extranets

By Mohamed Fayas 10 min readUpdated 15 October 2026

In short: The PE and CE can exchange routes with static routes, eBGP, OSPF, EIGRP or RIP. eBGP is simplest; sites sharing an ASN need as-override or allowas-in. OSPF across the VPN uses a super-backbone, and a sham link keeps the VPN preferred over a backdoor link. Route targets, import and export maps let selected routes leak between VRFs for extranets and shared services.

Choosing a PE-CE protocol

Figure 1. A provider can exchange routes with customer routers in several ways. The choice affects how routes appear at other sites and what loop protection is needed.

The PE runs a separate routing instance per VRF towards each CE, then redistributes those routes into MP-BGP, and back out at the other sites.

Static routes: fine for single-homed sites with a few prefixes.
eBGP: the most common and most flexible choice, with no redistribution on the PE. If every site uses the same private ASN, routes from other sites are rejected as loops; the provider configures as-override or the customer configures allowas-in.
OSPF, EIGRP or RIP: useful when the customer wants to keep its existing IGP everywhere.

OSPF as the PE-CE protocol

The MPLS VPN acts as an OSPF super-backbone above area 0. When both PEs use the same OSPF domain ID, routes from one site appear at the other as inter-area (type 3) routes, as if the sites were in one OSPF network; otherwise they appear as external routes. The DN bit and a domain tag stop routes looping back into the VPN.

Backdoor links and sham links

Many customers keep a private backup link between two sites, running OSPF in the same area. OSPF always prefers intra-area routes over inter-area ones, so traffic uses the slow backup link instead of the VPN. A sham link is a logical intra-area link between the two PEs, built between /32 loopbacks inside the VRF that are advertised through BGP. Routes across the VPN then become intra-area too, and the costs decide.

interface Loopback101
 vrf forwarding CUST-A
 ip address 10.254.0.1 255.255.255.255
router ospf 101 vrf CUST-A
 area 0 sham-link 10.254.0.1 10.254.0.2 cost 10
 redistribute bgp 64500 subnets
router bgp 64500
 address-family ipv4 vrf CUST-A
  redistribute ospf 101
  network 10.254.0.1 mask 255.255.255.255

Default routes

A PE can send a default route into a customer's OSPF with default-information originate under the VRF process, for example when a central site offers internet access. A provider can also give a VRF a default route that points into the global routing table, such as ip route vrf CUST-A 0.0.0.0 0.0.0.0 203.0.113.1 global, as a simple internet service for that customer.

EIGRP and RIP

With EIGRP, the PE redistributes BGP into the VRF's EIGRP instance with a seed metric. The BGP cost community and extended communities carry the original EIGRP metric across the VPN, so routes arrive as internal EIGRP routes with sensible metrics. RIP works similarly with redistribute bgp 64500 metric 1 under the VRF address family; it is legacy but still found at small sites.

Route leaking between VRFs

Extranet: two customers, or a customer and a shared-services VRF (DNS, management or internet gateway), import each other's route targets, or just one RT used for shared services.
Export maps and import maps: route maps attached to a VRF that set extra RTs on selected routes when exporting, or accept only selected routes when importing, so that only, say, one server subnet is shared.
VRF-lite route leaking: without MPLS, static routes pointing into another VRF, or MP-BGP inside one router importing RTs between local VRFs.

route-map EXPORT-SERVERS permit 10
 match ip address prefix-list SHARED-SERVERS
 set extcommunity rt 64500:999 additive
vrf definition CUST-A
 address-family ipv4
  export map EXPORT-SERVERS

Finally, MPLS over FlexVPN runs MPLS, and therefore L3VPNs, across IPsec tunnels built with IKEv2 FlexVPN. It extends VRF separation to small sites over the internet, an approach that SD-WAN with segmentation now often replaces.

Real-world example: an engineering firm's two offices were joined by an MPLS VPN with OSPF as the PE-CE protocol, plus an old 10 Mbps backup link between them in area 0. After a router upgrade, staff noticed file transfers between offices had slowed to a crawl. Traffic was using the backup link, because OSPF preferred the intra-area path over the inter-area routes from the VPN. The provider configured a sham link between its two PEs with a low cost, and traffic returned to the 500 Mbps VPN while the backup link remained ready for failures.

Practice

Why might a customer with OSPF and a backdoor link need a sham link?

OSPF prefers intra-area routes, so the backdoor wins over the VPN's inter-area routes; a sham link makes the VPN path intra-area so costs decide.

What does an export map do?

It applies a route map when routes are exported from a VRF, for example adding an extra route target to selected prefixes so another VRF can import them.

All of a customer's sites use ASN 65010 with eBGP to the provider. What must be configured?

as-override on the PE routers, or allowas-in on the CE routers, so routes from other sites are not rejected as loops.

Key takeaways

eBGP is the most common PE-CE protocol; shared customer ASNs need as-override or allowas-in.
With OSPF, the VPN is a super-backbone and matching domain IDs give inter-area routes.
A sham link makes VPN paths intra-area so a backdoor link does not win.
EIGRP and RIP PE-CE need redistribution with metrics; the cost community preserves EIGRP metrics.
Route targets, import maps and export maps leak selected routes between VRFs.

Tracks your learning on this device only. See your progress on the learning paths.

About the author

Mohamed Fayas

Founder of FM TecHub. CCNA certified, with a BTEC HND in Network Engineering, and BEng (Hons) in Computer Networking and Cloud Security. He writes practical, plain-English guides on networking, security and cloud.

More about the author