A service provider is designing an MPLS Layer 3 VPN backbone to offer connectivity to multiple enterprise customers. The design team needs to clarify device roles so that customer route separation, label imposition, and BGP VPNv4 exchange are handled correctly. On which device in this architecture are VRFs, MP-BGP VPNv4 peering, and the imposition of the VPN (inner) label all performed?