Theoretical foundations and architecture
Virtual Private LAN Service (VPLS, LDP signaling RFC 4762, BGP signaling RFC 4761) joins customer sites into a single transparent Ethernet broadcast domain (multipoint-to-multipoint L2VPN). The PEs act as one distributed switch: they learn MAC addresses from frames (MAC learning), keep a forwarding database (FDB) and replicate BUM traffic (broadcast, unknown unicast, multicast) over pseudowires. To avoid loops without STP in the core, the split horizon rule applies: a frame received from a full-mesh pseudowire must never be forwarded to other full-mesh pseudowires. A full mesh needs N*(N-1)/2 pseudowires, so Hierarchical VPLS (H-VPLS) is used: U-PEs attach to N-PEs with spoke pseudowires, and the N-PEs keep the full mesh among themselves. A spoke PW is not part of the core split-horizon group: a frame from a spoke PW may go to core PWs and vice versa.
VPLS as a virtual switch
VPLS (Virtual Private LAN Service) joins several ACs into one broadcast L2 domain across the MPLS core: to the customer, the provider network looks like a single Ethernet switch. If VPWS is a wire, VPLS is a switch, which means the PE maintains a MAC table. Standards: RFC 4762 (LDP signaling, FEC 128), RFC 4761 (BGP signaling, Kompella) and RFC 6074 (BGP auto-discovery with LDP signaling, FEC 129). Architecture: on each PE a VSI/VFI (Virtual Forwarding/Switching Instance) is created for the customer - a logical bridge with a MAC table. Physical ACs and virtual ports are attached to the VFI: one pseudowire to each remote PE.
Full mesh and split horizon
In basic VPLS every pair of PEs is connected by a pseudowire, so N PEs need N(N-1)/2 PWs: 3 PEs give 3 PWs, 10 PEs give 45, 50 PEs give 1225, and each PE has N-1 PWs and N-1 label sessions per VFI. There is no STP in the core; instead the split horizon rule applies: a frame received from a PW is never sent to another PW of the same VFI, only to ACs. Because every pair of PEs is directly connected, any PE already receives the frame from the source in one hop, and no loops arise. If the rule is violated (for example by configuring two PWs of one VFI in different split-horizon groups), a broadcast frame circulates endlessly between three PEs, loading the core.
MAC learning and forwarding
For each VFI the PE maintains a MAC table: addresses learned on an AC are bound to the port, addresses from a PW are bound to a specific PW (peer + label). When a frame arrives from an AC, the PE looks up the DA in the table. Known unicast goes to the single PW or AC. Broadcast, multicast and unknown unicast (BUM) are replicated into every PW (ingress replication, N-1 copies) and into the remaining ACs, so BUM in VPLS is expensive: the link to the core must carry N-1 copies. The default aging timer is 300 s (Cisco, Junos and Huawei are close); after a topology change or a PW failure, stale MACs on other PEs disappear only by timer unless MAC withdraw is used. Per RFC 4762 the PE sends an LDP Address Withdraw with a MAC List TLV (an empty list = delete all MACs of this VFI) so that remote PEs quickly flush the table and fall back to flooding. Resource protection: limit the number of MACs (mac limit) per VFI/AC, otherwise a customer can overflow the PE table by sending frames with different sources.
Signaling: LDP or BGP
LDP-VPLS (FEC 128): the list of peers is configured by hand on each PE, there is one VPLS ID (also known as the VC ID) per VFI, and for each peer a targeted LDP session and label exchange are created, as in VPWS. Adding a PE requires editing the configuration on all other PEs: it scales poorly but is simple. BGP-VPLS (RFC 4761): the VE ID and label block are carried in the BGP address family l2vpn (AFI 25, SAFI 65) together with the Route Target; the receiver automatically computes the label for the PW to the source, a new PE needs to be advertised only once, and the RR passes the NLRI to everyone. On Juniper this is a routing-instance of type vpls with vrf-target and site; on Cisco - autodiscovery bgp signaling bgp. BGP-AD with LDP signaling (RFC 6074) uses BGP only for discovery (RT/RD, VPLS-ID), while the PWs themselves are built by LDP using FEC 129 (AGI = VPLS-ID, SAII/TAII). EVPN (the next lesson) replaces both.
Hierarchical VPLS (H-VPLS)
Full mesh scales poorly: N(N-1)/2 PWs and replication. H-VPLS splits the network into two levels. The core keeps a full mesh between the N-PEs (hub), to which U-PE/MTU (spoke) devices connect via a spoke PW or via a QinQ attachment (802.1ad). A spoke PW attaches to the VFI of the N-PE like an ordinary AC, so split horizon does not apply to it: a frame from a spoke may be sent to all hub PWs, and a frame from a hub PW to the spoke. A spoke never participates in the core mesh; it needs only one PW (or two for redundancy). Redundancy: the spoke brings up a primary PW to one N-PE and a backup (standby) PW to another; if the primary fails, the backup is activated, and MAC withdraw cleans the tables. Danger: if a spoke is connected to two N-PEs without standby (both active), a loop arises that split horizon does not catch.
