A new type of Provider Edge (PE) device is used to support BGP-based IP-VPNs. Each VRF instance in a PE device is associated with a dedicated IP address (Service IP address). Each service IP address is dedicated to a VRF in a PE device. The service IP address is distributed by BGP for VPN route association. Customer/VRF IP packets can be sent to a VRF instance in the egress PE device using service IP header encapsulation (with IP Destination Address=Service IP address of egress PE's VRF & IP Source Address=Service IP address of ingress PE's VRF). This obviates the need for explicit tunnels in the core.