Review the PE router configuration to verify that an ingress firewall filter is applied to all CE-facing interfaces. Verify that the ingress firewall filter rejects and logs packets destined to the IP core address block. For example: [edit policy-options] prefix-list ipv4-core { 192.0.2.0/24; } prefix-list ipv6-core { 2001:db8:2::/64; } [edit firewall] family inet { filter deny-core-ipv4 { term 1 { from { destination-prefix-list { ipv4-core; } } then { log; syslog; discard; } } term default { then accept; } } } family inet6 { filter deny-core-ipv6 { term 1 { from { destination-prefix-list { ipv6-core; } } then { log; syslog; discard; } } term default { then accept; } } } Verify the firewall filter is applied to CE-facing interfaces: [edit interfaces] ge-0/0/0 { unit 0 { family inet { filter { input deny-core-ipv4; } address <IPv4 address/mask>; } family inet6 { filter { input deny-core-ipv6; } address <IPv6 address/prefix>; } } } Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example: input-list [ permit_mgt permit_routing_protocols default-deny ]; If the PE router is not configured to block any traffic with a destination address assigned to the IP core infrastructure, this is a finding. Note: Internet Control Message Protocol (ICMP) echo requests and traceroutes will be allowed to the edge from external adjacent peers.