An ISP provides VoIP and internet services to its customers. For security reasons, these services must be transported in different MPLS Layer 3 VPNs over the ISP core network. The customer CEs do…

A secondary IP address on the PE interface assigns an additional subnet to the same interface but provides no mechanism to classify traffic by type or steer it into different VRFs.

Extending the L3 VPN toward the CE requires the CE to participate in MPLS VPN signaling or CE-based VRF segmentation, which the CE in this scenario is explicitly incapable of supporting.

NBAR can recognize and classify application traffic for QoS marking and policy enforcement, but it cannot directly assign or redirect traffic into a specific VRF on a PE.

Subinterfaces on the PE use 802.1Q VLAN tags to demultiplex traffic arriving from the CE, but the CE in this scenario has no VLAN tagging capability, so there are no tags for the PE to use for subinterface selection.

PBR uses route-maps with match conditions - such as ACLs identifying VoIP traffic by DSCP, protocol, or port number - and 'set vrf' actions to redirect matched packets into the appropriate VRF before the normal routing lookup occurs. This allows the PE to classify and separate VoIP and internet traffic received on a single untagged physical interface from a CE that cannot provide VLAN differentiation. It is the standard Cisco solution for single-interface multi-VRF designs when the CE lacks the ability to signal service type.