EPL vs EVPL: which Layer 2 Ethernet service fits your sites

Key takeaways

• One port or many: EPL dedicates a port to a single connection, and EVPL carries several connections on one port, each mapped by VLAN.
• EPL stays transparent: Frames cross an EPL with as few changes as possible, and your team needs no VLAN agreement with the provider.
• EVPL suits hubs and branches: One hub port can reach many branches, or a cloud on-ramp, without a new physical port for each.
• Many sites point to E-LAN: When several sites need direct paths to each other, a multipoint service such as VPLS replaces a mesh of separate lines with one connection.
• Settle the details before ordering: Handoff, VLAN plan, bandwidth, cloud reach, and country coverage shape the order for each site pair.

That setting is the EPL vs EVPL difference. An Ethernet private line dedicates the whole port to one connection, and an Ethernet virtual private line carries several connections on one port, each mapped by VLAN. The choice shapes how many ports you buy and how much VLAN planning your team owns.

Quotes often list both as Layer 2 Ethernet at similar speeds, which leaves price to decide. A site pair that needed full transparency ends up sharing a port, or a hub ends up with a rack of single-purpose ports it never needed.

Network teams that pick well start with the standard definitions and their own topology, decide what each port must carry, and choose the service that fits.

What EPL and EVPL have in common

Both services come from the same standard. Mplify, the industry body that renamed itself from MEF in June 2025, publishes the standard definitions for these services. Its MEF 6.3 service definitions group Ethernet services into three types: Ethernet Line (E-Line), Ethernet LAN (E-LAN), and Ethernet Tree (E-Tree), which links one or more root sites to many leaf sites.

EPL and EVPL are both E-Line services, so each connection runs point-to-point between two user network interfaces, or UNIs. MEF 10.4 defines the UNI as the demarcation point between the provider's and the subscriber's responsibilities.

Both are Carrier Ethernet services that carry frames at Layer 2, so your routers see the far site as if it sat on the same switch, and providers usually back them with a service level agreement. The difference sits at the port.

How an Ethernet private line works

An Ethernet private line is a port-based E-Line service. MEF 6.3 says EPL services are meant to be "highly transparent," delivering frames at the far end "with as few modifications as possible." Every customer data frame that enters the port goes to the same far-end port, regardless of its VLAN tag.

That design has three practical effects.

• One service per port: EPL doesn't allow service multiplexing, so each connection needs a dedicated port at each end.
• No VLAN coordination: Your team can use any VLAN IDs across the link without agreeing them with the provider, because every frame maps to the same connection.
• Cable-like behavior: The link acts like a long patch cable between two switches, which suits storage replication and data center links that run their own VLANs end to end.

How an Ethernet virtual private line works

An Ethernet virtual private line is the VLAN-based version of E-Line. The provider reads the VLAN tag on each frame and maps it to a connection. This allows one port to carry several connections, so EVPL supports service multiplexing, which MEF 10.4 defines as more than one connection endpoint at a UNI.

In practice, a hub site can run one physical port and reach many branches over it, one VLAN per branch. MEF 6.3 notes that EVPL "is commonly used for connecting Subscriber hub and branch locations."

The same port can also carry a cloud connection. Microsoft's ExpressRoute documentation lists point-to-point Ethernet as one way to connect, and AWS Direct Connect requires 802.1Q VLAN encapsulation across the entire connection.

Both can run over an EVPL port as VLAN-mapped connections, making EVPL a practical way to add private connectivity to Azure or AWS without another physical port at the hub. ExpressRoute runs each peering over a redundant pair of links that share one VLAN ID, so plan for two connections and decide where each one lands.

Your team and the provider agree on a VLAN map at each port, and every new connection adds an entry. The connections also share the port's capacity, so their combined committed rates have to fit within it.

EPL vs EVPL side by side

The EPL vs EVPL decision comes down to eight attributes, including the point where a multipoint service takes over from both.

When three or more sites need VPLS

Point-to-point lines get harder to manage as sites multiply. A full mesh among five sites takes ten lines.

E-LAN services replace that mesh with one multipoint connection. MEF 6.3 says EP-LAN lets subscribers with multiple sites interconnect them so that "all sites appear to be on the same Local Area Network," with VLAN IDs set across sites without coordinating with the provider. EVP-LAN gives the same multipoint reach on a port that can also carry other services, with a VLAN map agreed with the provider.

Providers often deliver E-LAN as VPLS. RFC 4762 describes VPLS as an emulated LAN segment that learns and forwards on Ethernet MAC addresses, and RFC 4761 contrasts its multipoint design with the point-to-point nature of other Layer 2 VPNs.

A multipoint service fits when three conditions line up:

• Sites talk to each other: Traffic flows directly between many pairs of sites, beyond a simple hub and branch pattern.
• One Layer 2 domain makes sense: Applications need the sites on one broadcast domain.
• The site count stays moderate: Every broadcast reaches every site in a shared Layer 2 domain, so very large networks usually route between regions instead.

How Layer 2 Ethernet compares with MPLS

In any VPLS vs MPLS comparison, start with how closely the two relate. VPLS usually runs over an MPLS core, and RFC 4664 describes Layer 2 VPNs carried over "MPLS and/or IP backbones." For a WAN decision, compare Layer 2 services with an MPLS IP VPN, which works at Layer 3. RFC 4364 describes that model, where customer edge routers send their routes to the provider's edge routers and the provider routes traffic between sites.

That difference decides who runs routing. With an MPLS IP VPN, the provider holds your routes. With Layer 2 Ethernet, your routers peer with each other directly, and your team sets routing policy, failover, and segmentation.

A common design for networks moving off IP VPN pairs Layer 2 links in the core with SD-WAN at the branch edge. SD-WAN as an MPLS alternative covers branches well, and Layer 2 lines carry the heavy, private routes between data centers and hubs. A plan for moving a multi-site network off MPLS weighs each option route by route.

What to settle before you order

Five details shape the order for each site pair, and each one belongs in it before it reaches the provider.

• Handoff and port speed: Confirm the physical handoff, the optic type, and the port speed at each end, and count one port for every EPL connection.
• VLAN plan: For EVPL, write the VLAN map for every port, with room for future sites and cloud connections.
• Bandwidth per connection: Size each connection for its peak traffic, and check that the connections sharing an EVPL port fit within it.
• Cloud reach: List the cloud platforms each hub needs and reserve VLANs for each cloud connection. AWS Direct Connect gives each virtual interface its own 802.1Q VLAN tag, and an ExpressRoute peering uses one VLAN ID across its two links.
• Sites in other countries: For international links, confirm how the provider hands off at each end, which local partners carry the circuit, and who owns the service from end to end.

Routes that need more capacity than a provider's Ethernet service tiers offer often move to lit fiber services such as dedicated wavelengths.

Connect your sites at Layer 2 with one team

The EPL vs EVPL choice depends on whether a port carries one connection or many. A wrong pick shows up later as extra ports or a tangled VLAN plan.

Momentum delivers Layer 2 Ethernet between your sites, including point-to-point Ethernet and VPLS, as part of global connectivity and managed networks. Our engineers design the port and VLAN plan with your team, source local access from the best of 750+ carriers and service providers, and back each service with an SLA. When a hub needs a cloud connection, the same team adds AWS Direct Connect, Azure ExpressRoute, or Cloud Exchange from any data center, and one named project manager stays with you through turn-up at every site.

List each site pair with the traffic it carries and whether it connects to a hub, another site, or a cloud. Then book a meeting, and we'll match every pair on your list to EPL, EVPL, or VPLS.

FAQs

What is service multiplexing in EVPL?

Service multiplexing means one port carries more than one service. MEF 10.4 defines it as more than one connection endpoint at a user network interface. With EVPL, the provider maps each VLAN tag to a separate connection, so a hub can reach several branches or a cloud on-ramp over one physical port.

Does EPL isolate traffic better than EVPL?

Both keep your traffic on a private Layer 2 service, separate from other customers. The difference is at the port. An EPL port carries one connection, so nothing else shares it. An EVPL port can carry several of your connections, separated by VLAN. Teams that want one connection per physical port, for policy or simplicity, choose EPL.

Can EPL connect more than two sites?

Each EPL connects exactly two sites, because it is a point-to-point E-Line service. Three sites need three EPLs for a full mesh, and the count grows quickly from there. Networks with several sites that all need to reach each other usually move to an E-LAN service such as VPLS, which links every site in one multipoint connection.

Can EVPL connect to cloud providers?

Yes. AWS Direct Connect uses 802.1Q VLAN tags, which fit EVPL's VLAN-based design, and Azure ExpressRoute supports point-to-point Ethernet connections. Each cloud connection gets its own VLAN on the port. Adding cloud reach can then mean new VLANs on an existing hub port, as long as the port has capacity for them.

What is the difference between EVPL and VPLS?

EVPL is point-to-point, with each VLAN on the port mapped to one connection between two sites. VPLS is multipoint. It creates one emulated LAN that learns MAC addresses across all connected sites, so any site can reach any other directly. EVPL suits hub and branch designs, and VPLS suits groups of sites that need direct paths to each other on one Layer 2 domain.