Which device applies the VPN label to packets received from a CE before sending them into the provider core?

The PE (Provider Edge) router is responsible for applying the VPN label to packets received from a CE (Customer Edge) router. This label is used to identify the specific VPN to which the packet belongs within the MPLS (Multiprotocol Label Switching) network. The PE router acts as the entry and exit point for customer traffic in the provider's MPLS VPN cloud. The P (Provider) router is a core router that only performs label switching based on the MPLS labels and does not interact with customer routing information or apply VPN labels. The CE router is on the customer's premises and is unaware of the MPLS VPN labels. A core router is a general term and could include P routers, but specifically, the PE router performs this function.