Understanding the Basics: L2VPN vs L3VPN
See exactly what changes when a service provider transports your Layer 2 frames instead of participating in Layer 3 routing across an MPLS network.
In This Lesson
Compare both VPN models from the customer edge to the provider core, then use routing responsibility, protocol needs and site count to choose the right service.
Quick Learning Map
Three questions expose the practical difference between the services.
Who controls routing?
Choose whether the customer or provider should control inter-site route exchange.
What must cross the core?
Decide whether the service must carry transparent Layer 2 frames or routed IP prefixes.
How many sites will connect?
Compare the logical-circuit burden with a provider-distributed routed VPN.
L2VPN and L3VPN at a Glance
An L2VPN extends a data-link service between customer sites. An L3VPN places customer routes into isolated provider VRFs and distributes those VPN routes between provider-edge routers.
How a Layer 2 VPN Works
A Layer 2 VPN (L2VPN) provides a private data-link connection between customer sites across an IP or MPLS provider network. To the customer, the service can resemble a direct Ethernet circuit or a shared Ethernet segment even though the provider core is packet switched.
The provider transports frames
The provider edge carries Layer 2 traffic across the core using a service such as VPWS for point-to-point connectivity, VPLS for multipoint Ethernet, or an EVPN-based Layer 2 service.
The customer owns Layer 3
The customer edge routers form their own routing relationships across the emulated Layer 2 service. The provider does not need the customer's IPv4 or IPv6 routing table.
Protocols remain transparent
Depending on the service, the provider can carry Ethernet and legacy Layer 2 encapsulations such as Frame Relay, ATM, HDLC or PPP. Higher-layer traffic is opaque to the core.
How a Layer 3 VPN Works
In a Layer 3 VPN (L3VPN), the customer-edge (CE) router exchanges IP routes with the provider-edge (PE) router. The attachment can use static routing or a supported dynamic routing protocol such as OSPF, EIGRP or BGP.
- Separate VRFs: the PE stores each customer's routes in an isolated virtual routing and forwarding table.
- MP-BGP distribution: provider-edge routers commonly exchange VPNv4 or VPNv6 routes across the provider core.
- Route distinguisher (RD): an RD makes otherwise overlapping customer prefixes unique in the provider's VPN address family.
- Route target (RT): RT communities control which VPN routes a VRF exports and imports.
- MPLS forwarding: labels carry traffic across the core without mixing one customer's forwarding context with another's.
Routing Control and Protocol Transparency
The central design question is not simply whether the word “MPLS” appears in the service. It is where the Layer 3 boundary sits and who is responsible for reaching every remote site.
L2VPN: no CE-PE route exchange
The PE delivers a Layer 2 attachment. Customer devices can run the desired Layer 3 protocol end to end, and the service provider remains unaware of those customer routes.
L3VPN: CE and PE exchange routes
The provider participates in routing at every site. It can use its WAN routing expertise to distribute prefixes and apply the contracted routing policy.
Non-IP requirements matter
An L2VPN may carry legacy non-IP traffic such as IPX or SNA where supported. A conventional MPLS L3VPN is an IP-routed service and is not a transparent replacement for those protocols.
L2VPN vs L3VPN Comparison
| Feature | L2VPN (Layer 2 VPN) | L3VPN (Layer 3 VPN) |
|---|---|---|
| Provider routing involvement | No customer Layer 3 routing involvement | Provider participates through CE-PE routing and MP-BGP |
| Customer routing control | Customer controls routing between sites | Customer shares routes with the provider inside a VRF |
| Provider core carries | Layer 2 service frames over the provider transport | VPN routes and labeled IP traffic |
| Protocol transparency | Can carry any supported higher-layer protocol | Designed for IPv4 and IPv6 routing |
| Common services | VPWS, VPLS and EVPN-based Layer 2 services | MPLS L3VPN using VRFs, RDs, RTs and MP-BGP |
| Best fit | Layer 2 extension, transparent connectivity or full customer routing control | Scalable routed WANs and provider-managed inter-site route distribution |
Why the Services Scale Differently
In a point-to-point L2VPN full mesh, every CE needs a separate logical circuit to every other CE. With N sites, each site needs N − 1 remote relationships and the complete mesh needs N(N − 1) / 2 circuits.
Four-site L2VPN mesh
Each CE needs three logical connections and the network needs six point-to-point circuits in total. A multipoint VPLS or EVPN design changes the attachment model, but the customer still owns the Layer 3 topology.
Ten-site L2VPN mesh
Each CE needs nine logical connections and a full point-to-point mesh needs 45 circuits. That state and configuration burden grows quickly.
Typical L3VPN model
Each site commonly uses one routed CE-to-PE attachment. The provider distributes inter-site routes in the VPN, so the CE does not require one logical circuit per remote site.
How to Choose Between L2VPN and L3VPN
- Choose L2VPN when you need transparent Layer 2 extension, non-IP protocol support, control of end-to-end routing, or a provider service that behaves like an Ethernet circuit.
- Choose L3VPN when you need a scalable routed WAN, want the provider to distribute routes, or prefer a simple routed attachment at each site.
- Check operational ownership: decide who troubleshoots routing adjacency, convergence, policy, multicast, QoS and failure domains.
- Check service specifics: confirm MTU, bandwidth, redundancy, route limits, supported CE-PE protocols, convergence targets and security controls.
The better option is the one that places routing responsibility, visibility and change control with the team best equipped to operate it.
L2VPN vs L3VPN Frequently Asked Questions
What is the main difference between L2VPN and L3VPN?
An L2VPN transports Layer 2 frames and leaves inter-site routing under customer control. An L3VPN transports customer IP routes in provider-managed VRFs, so the CE and PE exchange routing information.
Does an L2VPN require the provider to know customer routes?
No. The provider forwards the customer's Layer 2 service without learning the customer's Layer 3 routing table.
What do route distinguishers and route targets do in an MPLS L3VPN?
A route distinguisher makes overlapping customer prefixes unique in MP-BGP. Route targets control which VPN routes a VRF exports and imports.
Which service usually scales better for a large routed WAN?
L3VPN usually scales more cleanly because each site commonly needs one routed CE-to-PE attachment while the provider distributes inter-site routes. The exact design still depends on redundancy and service requirements.
Can L2VPN carry non-IP traffic?
Yes. Because the provider service transports Layer 2 frames, an L2VPN can carry protocols other than IP when the selected service and encapsulation support them.