A transit authority separates agency routing tables on a single civic edge router with VRF-Lite and no provider MPLS core. How does that differ from a managed MPLS Layer 3 VPN service connecting those agencies across many sites?
Select an answer to reveal the explanation.
Short Explanation
Think of VRF-Lite as locking filing cabinets in one civic building, while MPLS L3VPN is the courier network that carries sealed cabinets between many buildings. Same idea of separate tables—totally different reach across a provider core. One chassis of VRFs is not the same as PE VRFs spanning an MPLS backbone.
Full Explanation
In a transit-authority edge design, VRF-Lite creates separate routing tables on the same civic router so agencies stay isolated without requiring a provider MPLS/MP-BGP core. That local table separation is useful when multiple departments share one chassis or campus PE-like device, but reachability remains confined to the routers you configure with matching VRF membership and PE-CE or inter-VRF policy. A managed MPLS Layer 3 VPN, by contrast, places each agency in PE VRFs and extends those VRFs across many sites using MP-BGP for VPNv4/VPNv6 signaling plus label stacks over the provider backbone. The correct answer captures that architectural split: VRF-Lite is local isolation without the labeled provider VPN fabric, while MPLS L3VPN stretches per-customer VRFs end to end across PEs.
Saying VRF-Lite requires MP-BGP and VPN labels between every civic PE while MPLS L3VPN never uses VRFs reverses the technologies. Classic VRF-Lite does not depend on a provider MP-BGP/VPN-label core; MPLS L3VPN is built around PE VRFs. Claiming MPLS L3VPN works only for IPv6 and that VRF-Lite is limited to static routes on one chassis is false on both counts: L3VPN supports IPv4 and IPv6, and VRF-Lite can use dynamic PE-CE or local routing, not only statics. Asserting that both designs force P routers to hold every customer VRF FIB misunderstands MPLS L3VPN scale: P routers forward on the transport label and normally need no customer VRF tables, and VRF-Lite may have no P core at all.
Exam caveat: do not equate “VRF present” with “full MPLS L3VPN service.” Shared VRFs on one box are not the same as provider VPN labels and RT/RD signaling across sites. Operational check for the transit authority: verify which civic routers actually host the VRF (show vrf / show ip vrf), confirm whether MP-BGP VPNv4 sessions and LDP/SR transport exist toward remote PEs, and prove agency isolation with traceroute and per-VRF RIB lookups rather than assuming a managed L3VPN exists simply because tables are named.