MPLS

MPLS forwards data packets based on labels over fixed paths and was for years the standard for connecting company sites. This article explains how the technology works and its strengths, shows its limits in the cloud era, and clarifies when SD-WAN is the better choice.

For many years, MPLS was the standard answer to the question of how companies reliably connect their sites. On top of it, carriers built private wide area networks with contractually assured properties, from the bank branch to the production plant. By now, many IT managers are examining their MPLS contracts critically: applications have moved to the cloud, bandwidth demand is growing, and flexible alternatives have matured. Anyone deciding on continued operation or replacement should understand what the technology delivers and where its limits lie. Because in many cases the right answer is not a complete farewell, but rather a new distribution of roles in the wide area network.

What is MPLS?

MPLS stands for Multiprotocol Label Switching, a forwarding technique in carrier networks. Instead of re-evaluating each packet at each router based on its IP address, it receives a short label at the network entry. All subsequent routers decide solely on the basis of this label where the packet is passed on. On this basis, providers offer private enterprise networks, mostly marketed as IP-VPN. In it, a customer's sites form a shared private network, logically separated from the traffic of other customers and from the open internet. The provider contractually assures properties such as availability and prioritization. This reliability made MPLS the backbone of traditional site connectivity for over two decades, especially for applications with strict requirements for travel time and stability.

How it works

  • Label at the network entry: The provider's ingress router classifies each packet once and attaches a label to it. This assignment determines the path and treatment class for the entire way through the network.
  • Label-switched paths: Pre-established paths run through the provider network. Every router along the way reads the label, swaps it for the next one, and passes the packet on. The route is thus deterministic.
  • Traffic engineering: The operator steers paths deliberately over specific routes and reserves capacity. Travel times thereby stay predictable even under high utilization.
  • QoS classes: Traffic is divided into priority classes. In case of doubt, voice and control packets overtake large file transfers, so that real-time applications stay stable.
  • Separate customer networks: For each customer, the provider runs separate routing instances. Different customer networks stay logically separated even though they use the same physical infrastructure.
  • Operation from a single source: The provider monitors the network end to end, clears faults on lines, and guarantees response times. For the customer, the WAN is reduced to a contract with defined commitments.

Why it matters

  • Predictable travel times and low variation carry real-time applications such as telephony and video conferencing.
  • Contractually assured availability with defined fault-clearing times gives critical sites backing.
  • The logical separation from the open internet reduces the attack surface of site communication.
  • Processes and operational experience are mature after long practice, and the risk of unexpected effects is low.
  • For sites without a usable internet connection, a dedicated line sometimes remains the only option with stable quality.
  • Existing contracts shape budgets and notice periods, which is why MPLS belongs in every WAN strategy, even when the target architecture is called SD-WAN.

Typical scenarios

  • A bank connects branches with the data center and needs guaranteed response times for core banking applications.
  • A retail company connects point-of-sale systems and merchandise management to headquarters via the private network.
  • An industrial company couples plants whose production control demands deterministic travel times.
  • A corporation carries voice and video traffic between sites in prioritized classes.

The limits become apparent as soon as applications shift. In traditional MPLS designs, cloud and SaaS traffic takes the detour via the central internet gateway in the data center, which creates latency and burdens the central connection. New sites or bandwidth changes often take weeks to months, because the provider has to provision lines and adjust configurations. And the cost per megabit is significantly higher than that of ordinary internet connections, which increasingly carries weight as bandwidth demand grows.

MPLS vs. SD-WAN

SD-WAN shifts the intelligence from the provider network to the enterprise's network edge. Appliances at the sites continuously measure the quality of all available connections, from the inexpensive internet connection to the dedicated line, and steer each application over the currently best path. The traffic between sites is fully encrypted in the process, and cloud traffic leaves the network directly at the site. SD-WAN thus addresses precisely the points where MPLS reaches its limits: cost, provisioning time, and cloud connectivity. A replacement nonetheless does not mean an either-or. Many companies operate hybrid networks in which critical sites keep a dedicated line as an underlay and SD-WAN takes over the control. How this transition succeeds is described on our service page SD-WAN . For workloads in public clouds, private paths complement the architecture, more on this under Cloud Connectivity & SDN .

Working with KAEMI

KAEMI plans and operates enterprise WANs in a managed model, from taking stock of the existing MPLS network to the hybrid target architecture. We analyze contracts and application flows, design the right mix of dedicated lines and internet connections, and migrate sites step by step without interrupting ongoing operations. Where guaranteed paths are still needed, they deliberately stay part of the design. Implementation is handled by our Professional & Managed Services with planning and operation from a single source. If you would like to put your MPLS contracts to the test, reach us via our contact form .

Frequently asked questions about MPLS

Is MPLS encrypted?

No. MPLS logically separates customer networks from each other, but no encryption of the contents takes place. Confidentiality rests on the separation in the provider network. Anyone who needs protection at the data level, for example for personal or regulated data, adds an encryption layer such as IPsec on top of the MPLS network. Modern SD-WAN solutions, by contrast, encrypt the traffic between sites by default.

Is MPLS outdated?

MPLS is technically mature and continues to serve well in many networks, especially where guaranteed travel times are required. What is outdated is rather the architectural pattern of routing all traffic through a central data center. That is why many companies combine existing lines with SD-WAN or replace them step by step as contracts expire.

Why is MPLS considered expensive?

The bandwidth of an MPLS line costs a multiple of an internet connection of comparable size, because the provider reserves capacity and backs contractual commitments. Added to this are long contract terms and surcharges for changes. Whether it is worth it depends on the application profile. For many sites, a combination of internet connections with SD-WAN control is enough today.

What happens to cloud traffic in the MPLS network?

Traditional MPLS designs route all traffic to the central internet gateway in the data center. Cloud services, however, lie outside the private network, which creates a detour that increases latency and burdens the central connection. Local internet breakouts at the sites or private cloud paths, as modern WAN architectures provide for, offer a remedy.

How does the switch from MPLS to SD-WAN succeed?

A step-by-step approach has proven itself: first an inventory of the contracts and application flows, then a pilot with a few sites in parallel operation, followed by the rollout along expiring notice periods. Critical sites keep a dedicated line as an underlay where needed. A managed partner takes over migration and operation from a single source.

More terms

Multi-Factor Authentication (MFA)

Multi-factor authentication combines at least two independent proofs from knowledge, possession, and biometrics, and thereby renders stolen passwords largely worthless. This article explains methods from TOTP to passkeys, their phishing resistance, and how they differ from 2FA.

Read term →

Microsegmentation

Microsegmentation divides networks into the smallest zones and controls the data traffic between individual workloads, independently of IP addresses and VLANs. The approach stops lateral movement by attackers and is regarded as a core building block of every Zero Trust architecture.

Read term →

Mythos (Claude Mythos)

Mythos is Anthropic's most powerful AI model, with autonomous offensive security capabilities that mark a turning point: vulnerability discovery, exploit development, and attack chains run at large scale for the first time without human involvement. The term therefore stands in for a new threat landscape.

Read term →

Open questions about this in your environment? KAEMI advises you in line with your requirements and can also take over operations.