How are routes learned from different CEs isolated on a PE router?

On a PE router, routes from different CEs are isolated by assigning CE-facing interfaces to different Virtual Routing and Forwarding (VRF) instances. Each VRF creates a separate routing and forwarding table, effectively segmenting the routing domain for each customer. This ensures that traffic and routes from one customer are not visible to or mixed with those of another. While MP-BGP is used to exchange these VRF routes between PE routers, and MPLS labels are used for forwarding across the service provider backbone, the initial isolation on the PE itself is achieved through VRFs. VRF-Lite is a specific implementation of VRFs, but the core mechanism for isolation is the VRF assignment. Enabling multiple BGP instances without VRFs would not provide the necessary forwarding plane isolation.