--- title: One-Arm Hub-and-Spoke VPN with MPLS/VPN « ipSpace.net blog description: A deep-dive into building a one-arm hub-and-spoke VPN using MPLS/VPN, where the hub device connects to the PE router over a single link instead of the... canonical: https://daily.dev/posts/one-arm-hub-and-spoke-vpn-with-mpls-vpn-ipspace-net-blog-1nggkhrao twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: One-Arm Hub-and-Spoke VPN with MPLS/VPN « ipSpace.net blog | daily.dev og:description: A deep-dive into building a one-arm hub-and-spoke VPN using MPLS/VPN, where the hub device connects to the PE router over a single link instead of the... og:url: https://daily.dev/posts/one-arm-hub-and-spoke-vpn-with-mpls-vpn-ipspace-net-blog-1nggkhrao og:image: https://api.daily.dev/og/posts/1nGgKHrAo.png og:image:alt: One-Arm Hub-and-Spoke VPN with MPLS/VPN « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # One-Arm Hub-and-Spoke VPN with MPLS/VPN « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 9 min read · 0 upvotes · 0 comments ## Summary A deep-dive into building a one-arm hub-and-spoke VPN using MPLS/VPN, where the hub device connects to the PE router over a single link instead of the traditional two-VRF (ingress/egress) design. The trick relies on per-prefix MPLS label allocation: PE_H assigns a label to the default route advertised by the hub CE, allowing the PE to forward packets directly to the hub CE via an LFIB lookup without invoking IP forwarding. This works on Cisco IOS and FRRouting but fails on Arista EOS, which uses per-VRF labels instead of per-prefix labels, causing traffic to be routed within the VRF rather than sent to the hub CE. VXLAN/EVPN transport is also incompatible since VNIs act as per-VRF identifiers. A working netlab topology with configuration details and traceroute verification is provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does one-arm hub-and-spoke MPLS VPN not work on Arista EOS? Arista EOS assigns MPLS labels per-VRF rather than per-prefix. When PE_H receives a packet with the VRF label, its LFIB entry points to the hub VRF forwarding table rather than a specific outgoing interface and next-hop MAC. This means the packet is routed within the VRF instead of being forwarded directly to the hub CE, so traffic never reaches the hub device and the one-arm topology breaks. _Engineers choosing PE platforms for hub-and-spoke MPLS designs track per-prefix vs per-VRF label behavior on daily.dev._ ### How does per-prefix MPLS label allocation enable a one-arm hub-and-spoke VPN? With per-prefix label allocation, PE_H assigns a distinct MPLS label to the default route advertised by the hub CE. When PE_A forwards a spoke packet, it prepends that label. PE_H performs an LFIB lookup, finds the outgoing interface and layer-2 header directly from the label, and sends the packet to the hub CE without invoking IP forwarding. The packet traverses the hub CE and returns through the same PE_H VRF toward the destination spoke. _Networking engineers building MPLS VPN topologies find per-prefix label deep-dives like this on daily.dev._ ### Can I implement a one-arm hub-and-spoke VPN with VXLAN and EVPN? No. With VXLAN/EVPN transport, the VRF transit VNI acts as a per-VRF identifier on the egress router, equivalent to per-VRF MPLS label behavior. Because there is no per-prefix equivalent, the egress PE cannot forward packets directly to the hub CE over a single link, making a one-arm hub-and-spoke topology impossible with VXLAN transport. _Teams evaluating EVPN vs MPLS transport trade-offs for VPN designs stay current on daily.dev._ ## Similar posts on daily.dev - [MPLS/VPN with SR-MPLS Core « ipSpace.net blog](https://daily.dev/posts/mpls-vpn-with-sr-mpls-core-ipspace-net-blog-nw3uwiphe) · ipSpace.net Blog · 0 upvotes · 0 comments - [Multivendor SR-MPLS « ipSpace.net blog](https://daily.dev/posts/multivendor-sr-mpls-ipspace-net-blog-qekokwduk) · ipSpace.net Blog · 0 upvotes · 0 comments - [EVPN with SR-MPLS Core « ipSpace.net blog](https://daily.dev/posts/evpn-with-sr-mpls-core-ipspace-net-blog-taobtibzc) · ipSpace.net Blog · 0 upvotes · 0 comments - [BGP-Free Core with SR-MPLS « ipSpace.net blog](https://daily.dev/posts/bgp-free-core-with-sr-mpls-ipspace-net-blog-h7kronzy3) · ipSpace.net Blog · 0 upvotes · 0 comments --- Tags: [#vpn](https://daily.dev/tags/vpn), [#bgp](https://daily.dev/tags/bgp) [View this post on daily.dev](https://daily.dev/posts/one-arm-hub-and-spoke-vpn-with-mpls-vpn-ipspace-net-blog-1nggkhrao) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"One-Arm Hub-and-Spoke VPN with MPLS/VPN « ipSpace.net blog","url":"https://daily.dev/posts/one-arm-hub-and-spoke-vpn-with-mpls-vpn-ipspace-net-blog-1nggkhrao","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/one-arm-hub-and-spoke-vpn-with-mpls-vpn-ipspace-net-blog-1nggkhrao"},"datePublished":"2026-08-11T08:52:18.468Z","dateModified":"2026-08-11T08:55:52.414Z","description":"A deep-dive into building a one-arm hub-and-spoke VPN using MPLS/VPN, where the hub device connects to the PE router over a single link instead of the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/44a5e8a2da661fbf7fd6238a11a57ea0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/44a5e8a2da661fbf7fd6238a11a57ea0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/one-arm-hub-and-spoke-vpn-with-mpls-vpn-ipspace-net-blog-1nggkhrao","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"vpn,bgp","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"One-Arm Hub-and-Spoke VPN with MPLS/VPN « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/one-arm-hub-and-spoke-vpn-with-mpls-vpn-ipspace-net-blog-1nggkhrao#faq","mainEntity":[{"@type":"Question","name":"Why does one-arm hub-and-spoke MPLS VPN not work on Arista EOS?","acceptedAnswer":{"@type":"Answer","text":"Arista EOS assigns MPLS labels per-VRF rather than per-prefix. When PE_H receives a packet with the VRF label, its LFIB entry points to the hub VRF forwarding table rather than a specific outgoing interface and next-hop MAC. This means the packet is routed within the VRF instead of being forwarded directly to the hub CE, so traffic never reaches the hub device and the one-arm topology breaks. Engineers choosing PE platforms for hub-and-spoke MPLS designs track per-prefix vs per-VRF label behavior on daily.dev."}},{"@type":"Question","name":"How does per-prefix MPLS label allocation enable a one-arm hub-and-spoke VPN?","acceptedAnswer":{"@type":"Answer","text":"With per-prefix label allocation, PE_H assigns a distinct MPLS label to the default route advertised by the hub CE. When PE_A forwards a spoke packet, it prepends that label. PE_H performs an LFIB lookup, finds the outgoing interface and layer-2 header directly from the label, and sends the packet to the hub CE without invoking IP forwarding. The packet traverses the hub CE and returns through the same PE_H VRF toward the destination spoke. Networking engineers building MPLS VPN topologies find per-prefix label deep-dives like this on daily.dev."}},{"@type":"Question","name":"Can I implement a one-arm hub-and-spoke VPN with VXLAN and EVPN?","acceptedAnswer":{"@type":"Answer","text":"No. With VXLAN/EVPN transport, the VRF transit VNI acts as a per-VRF identifier on the egress router, equivalent to per-VRF MPLS label behavior. Because there is no per-prefix equivalent, the egress PE cannot forward packets directly to the hub CE over a single link, making a one-arm hub-and-spoke topology impossible with VXLAN transport. Teams evaluating EVPN vs MPLS transport trade-offs for VPN designs stay current on daily.dev."}}]} ```