CloudLabBox
Try the free demo

MPLS and L3VPN practice labs

11 guided labs that take you from your first label to a provider edge built from IOS, Junos and RouterOS routers working as one network. Read labels on real routers, build L3VPNs by hand, design route targets, give a VPN Internet access, and fix planted faults in the label path and the VPN layer.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 8 of the 11 labs also run in the free demo.

Guided labs
11
Follows
MPLS and L3VPN topics of Cisco SPCOR 350-501 and ENARSI 300-410, Juniper JNCIS-SP and MikroTik MTCINE
Runs every lab
Standard
Devices
IOSv, RouterOS and vJunos-router

Who these labs are for

For enterprise and service-provider engineers who know OSPF and BGP and want to run MPLS VPNs, and anyone preparing for the MPLS and L3VPN parts of SPCOR, ENARSI, JNCIS-SP or MTCINE.

The checks read the outcome: the labels really used, the customer route learned and the customer traffic delivered, across three vendors in one network.

The 11 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

MPLS and L3VPN course 11 labs

Shared folderMPLS and L3VPN guided labs

From LDP and labels to L3VPN design across vendors, then two troubleshooting labs and a three-vendor capstone.

  1. 01LDP on IOS and RouterOS

    Switch on label switching across a core of two Cisco and two MikroTik routers. Read discovery, sessions, bindings and the forwarding table in both vendors, and find penultimate hop popping and explicit null in real output.

    2× IOSv, 2× RouterOS

    4 vCPU, 1,536 MBFits LiteRuns in the free demo

  2. 02MPLS forwarding - traceroute TTL and MTU

    Trace a label-switched path across a core that runs no BGP, by hand and then with MPLS ping and traceroute. Hide the core from customers with TTL settings, find out why big transfers fail while small pings work, and fix the MTU on both vendors.

    5× IOSv, 1× RouterOS

    6 vCPU, 2,816 MBFits LiteRuns in the free demo

  3. 03From VRF-lite to L3VPN

    Two customers with overlapping addresses run over VRF-lite and a sub-interface per customer. Replace that with a real L3VPN: RDs, route targets, a VPNv4 session between PE loopbacks and a two-label stack through an MPLS core that knows nothing about either customer.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  4. 04PE-CE routing - static eBGP and OSPF

    One customer, four sites, three ways of talking to the provider. Bring static, eBGP and OSPF sites into one VPN, see why OSPF routes arrive as externals and fix it with a domain ID, and find the down bit that stops routes looping back in.

    6× IOSv

    6 vCPU, 3,072 MBFits LiteRuns in the free demo

  5. 05A Junos PE with an IOS PE over an IOS P

    Bring a Juniper router into an IOS MPLS core as a PE in a customer's VPN. Build LDP, MP-BGP and the VRF on Junos, read inet.3, mpls.0 and bgp.l3vpn.0, prove the LSP with MPLS ping in both directions and find the MTU difference.

    4× IOSv, 1× vJunos-router

    8 vCPU, 7,168 MBFits Standard

  6. 06A RouterOS PE in a Cisco core

    Make a MikroTik router a full PE in an IOS core, with two customers: one on eBGP and one on OSPF. Compare how RouterOS expresses VRFs, route targets and redistribution, read per-VRF labels, and find where the two vendors differ.

    4× IOSv, 2× RouterOS

    6 vCPU, 2,560 MBFits LiteRuns in the free demo

  7. 07Route-target design - hub-and-spoke and an extranet

    A retail chain wants every shop-to-shop packet to pass through head office, and only the shops may reach a supplier's server. Build both with nothing but route targets, then fix the two loop-prevention rules that get in the way, with allowas-in and as-override.

    6× IOSv

    6 vCPU, 3,072 MBFits LiteRuns in the free demo

  8. 08Internet access from a VRF - route leaking and NAT

    Give a VPN customer Internet access through one PE. Leak a default out of the VRF and a public block back in, send the default through the VPN, then add VRF-aware NAT for offices on private addresses, including the remote one whose traffic arrives in MPLS.

    6× IOSv

    6 vCPU, 3,072 MBFits LiteRuns in the free demo

  9. 09Troubleshooting the label path

    BGP is up, every loopback pings, and the customer's VPN is dead. Walk the label path link by link across IOS and RouterOS, and find four faults left by a night of maintenance: LDP authentication, a missing LDP interface, an unreachable LSR ID and a shrunken MPLS MTU.

    5× IOSv, 1× RouterOS

    6 vCPU, 2,816 MBFits LiteRuns in the free demo

  10. 10Troubleshooting the VPN layer across three vendors

    A contractor has broken a customer's VPN on IOS, Junos and RouterOS PEs at once, while the label core stays healthy. Use a five-stage method to find four faults in sessions, route targets, extended communities and export policy, and restore all three sites.

    5× IOSv, 1× RouterOS, 1× vJunos-router

    10 vCPU, 7,936 MBFits Standard

  11. 11Capstone - a three-vendor provider edge

    Build a new region from a design brief: LDP across IOS, Junos and RouterOS, a VPNv4 route reflector, two customers with overlapping addresses on eBGP, OSPF and static, and Internet access through one PE with VRF-aware NAT.

    5× IOSv, 3× RouterOS, 1× vJunos-router

    12 vCPU, 8,448 MBFits Standard

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the MPLS and L3VPN practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB1153
MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB610
Juniper vJunos-routervjunosrouter-24.2R1-S2.54 vCPU, 5,120 MB33

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MPLS and L3VPN guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the MPLS and L3VPN labs

Are these MPLS and L3VPN labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 8 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 8 of the 11. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Capstone - a three-vendor provider edge”, needs 12 vCPU and 8,448 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from the vendors?

No. CloudLabBox wrote them to follow the topics of Cisco’s SPCOR 350-501 (v1.1) and ENARSI 300-410 (v1.1), Juniper’s JNCIS-SP (JN0-364) and MikroTik’s MTCINE, where they cover MPLS and L3VPN. They aren’t training material from the vendors, and CloudLabBox is independent of Cisco, Juniper Networks and MikroTik.

Which plan do I need?

Eight of the 11 labs fit Lite. The three with a Juniper router, labs 05, 10 and 11, need Standard.

How long do the routers take to start?

IOS and RouterOS come up in a few minutes. The vJunos router is much slower, and the pane allows 15 to 35 minutes. If its FPC stays offline, stop and start that router: we saw that happen in about 2 of 11 boots under load, and a restart cleared it.

Do I need vendor licences for these labs?

No. CloudLabBox doesn’t provide vendor licences or subscriptions, and these labs don’t need any.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 8 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Cisco, Juniper Networks and MikroTik. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.