The ingress PE attaches a VPN label and a tunnel label to each customer IP packet, and forwards each packet over the LSP. MPLS L3VPN encapsulation and transport shows the encapsulation and data transport.

Figure 1. MPLS L3VPN encapsulation and transport

When the MPLS packet arrives at the egress PE, the egress PE uses the VPN label to deliver the data as a traditional IP packet to the correct CE device. The CE uses standard IP routing procedures to forward the data to its final destination.