MPLS Fundamentals · Chapter 04 of 04

Verifying and Troubleshooting an LSP End to End

MPLS breaks in layers, so verification walks layers: IGP route to the egress loopback, LDP neighbourship and bindings, LFIB programming, and finally the data plane itself with MPLS-aware ping and traceroute. The classic silent failure is an LSP that breaks mid-path and falls back to IP — invisible to normal ping, fatal to VPN traffic — which lsp ping and per-hop LFIB checks expose immediately.

Updated 31 August 2026 · RST Forum faculty

In this guideShow
  1. 01MPLS Label Switching Explained
  2. 02LDP: How Labels Are Distributed
  3. 03The MPLS Data Plane: LFIB, PHP and Label Stacking
  4. 04Verifying and Troubleshooting an LSP End to End

MPLS transport has a devious failure property: because routers treat unlabelled IP forwarding as a fallback, a broken LSP often does not drop plain pings — traffic quietly falls out of the labelled path and routes natively. Everything that only works end-to-end labelled — which is to say, every VPN — blackholes, while your ping succeeds. The discipline that catches it is fixed: verify each layer in order, and use verification tools that are themselves labelled.

The four-layer walk

  • 1. IGP — is the egress PE's loopback /32 in the routing table, via the path you expect? No route, no FEC, no LSP. (Watch for the loopback advertised with a non-/32 mask — OSPF network-type quirks summarising it — which desynchronises FECs between routers.)
  • 2. LDP — session up with every next hop along the path (show mpls ldp neighbor), and a remote binding present for the target FEC from the current next hop (show mpls ldp bindings 10.255.1.4 32)?
  • 3. LFIB — is the binding actually programmed (show mpls forwarding-table 10.255.1.4)? 'No Label' where a swap should be means this router will send the packet unlabelled — found your gap.
  • 4. Data plane — labelled probes end to end.

MPLS ping and traceroute

ping mpls ipv4 10.255.1.4/32 sends echo requests inside the LSP with an IP header engineered not to be routable (destination 127/8, Router Alert) — so if the LSP is broken, the probe dies loudly instead of sneaking through as IP. trace mpls ipv4 does it per hop, reporting each router's label operation and a return code per RFC 8029. The codes are the diagnosis: 3 means 'egress, healthy'; B means 'this router has no mapping for the FEC' — the LSP's break point, named explicitly.

PE1# trace mpls ipv4 10.255.1.4/32
0 10.1.12.1 MRU 1500 [Labels: 24007 Exp: 0]
L 1 10.1.12.2 MRU 1500 [Labels: 24012 Exp: 0] 2 ms
B 2 10.1.23.3 4 ms
! break at hop 2 — P2 has no label for the FEC

The usual suspects

  • LDP session down on one core link — mismatched transport-address reachability, an ACL on TCP/UDP 646, or LDP simply not enabled on a new link (mpls ip missing). With liberal retention elsewhere, this one link is the only gap — and the IGP happily routes over it.
  • MTU — the LSP works for small packets and dies for large ones: a core interface without label headroom. trace mpls prints MRU per hop precisely to catch this.
  • LDP-IGP sync absent — after a flap, the IGP beats LDP onto a link; seconds-long VPN blackholes that 'fix themselves' are this signature.
  • TTL propagation confusion — customer traceroutes look wrong; not a fault, but know what no mpls ip propagate-ttl looks like before an outage call debates it.
  • Label filtering too aggressive — an allocation filter that dropped a loopback FEC nobody noticed until a new PE needed it.

Bind this chapter to muscle memory in a lab: build a four-router LSP, then break it every way listed — disable LDP on a middle link, shrink an MTU, filter a binding — and watch what each symptom looks like in trace mpls versus plain traceroute. The contrast between the two tools, on the same broken network, is the single most valuable MPLS lesson a lab can teach — and it is exactly the drill our SP courses run on real IOS-XR racks.

Free chapters, real racks, CCIE faculty — that's the whole model.

Browse coursesEnroll