County courts staff suspect a departmental VPN is down. What should they verify before blaming PE-CE routing?
Select an answer to reveal the explanation.
Short Explanation
If the LSP across the core is broken, the VPN never had a chance. Check the label-switched path end-to-end before you dig into PE-CE neighbors. Underlay first, overlay argument second.
Full Explanation
MPLS VPN traffic for county courts depends on a working transport LSP between PE routers. Before blaming PE-CE routing for a departmental VPN outage, operators should verify end-to-end LSP continuity across the MPLS core so they know whether the underlay label-switched path is intact. A broken LSP means overlay VPN symptoms appear even when CE neighbor configs look perfect.
Checking only the CE default-gateway ARP entry on a user VLAN can miss core label failures entirely. Wireless controller certificates unrelated to the WAN core do not validate MPLS LSP health. Expecting every P router to hold full Internet BGP tables is neither required for VPN LSPs nor a useful first check.
Exam caveat: control-plane VPNv4 presence does not prove data-plane labels work—validate the LSP as a foundation check.
Operational check: run MPLS ping/traceroute between PE loopbacks for the affected FEC, confirm label stack behavior, then proceed to VRF and PE-CE checks only after LSP continuity passes for the courts VPN path. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.