Review the router configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS. Verify that a stateless firewall filter has been applied to each VPLS routing instances. [edit] routing-instances { <name> { forwarding-options { family vpls { flood { input <filter name>; } } } } } Verify the filter defines traffic types associated with storm control (i.e., broadcast, multicast, and unknown unicast storms). firewall { family vpls { filter <filter name> { term <term name> { from { traffic-type broadcast; } then { policer <policer name>; accept; } } term <term name> { from { traffic-type multicast; } then { policer <policer name>; accept; } } term <term name> { from { traffic-type unknown-unicast; } then { policer <policer name>; accept; } } } } } Verify that the policer rate limits in accordance with local requirements. firewall { policer <policer name> { if-exceeding { bandwidth-limit <value>; burst-size-limit <value>; } then discard; } } Note: Only EX9200-series devices currently support VPLS. If storm control is not enabled for broadcast traffic, this is a finding.