Review the router configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS. Verify that a flood filter has been configured for each VPLS routing instances as shown in the example below. routing-instances { VPLS_CUST2 { instance-type vpls; interface ge-0/1/0.0; route-distinguisher 22:22; vrf-target target:22:22; forwarding-options { family vpls { flood { input VPLS_FLOOD_FILTER; } } } protocols { vpls { site-range 9; no-tunnel-services; site R8 { site-identifier 8; interface ge-0/1/0.0; } vpls-id 102; neighbor 8.8.8.8; } } } } Review the filter configured for the VPLS routing instances to verify it defines traffic types associated with storm control (i.e. broadcast, multicast, and unknown unicast storms). firewall { … … … family vpls { filter VPLS_FLOOD_FILTER { term BROADCAST_TRAFFIC { from { traffic-type broadcast; } then { policer STORM_POLICER; accept; } } term MULTICAST_TRAFFIC { from { traffic-type multicast; } then { policer STORM_POLICER; accept; } } term UNKNOWN_UNICAST_TRAFFIC { from { traffic-type unknown-unicast; } then { policer STORM_POLICER; accept; } } } } Verify that the policer rates limits storm traffic. firewall { … … … policer STORM_POLICER { if-exceeding { bandwidth-limit 10m; burst-size-limit 5m; } then discard; } If storm control is not enabled, this is a finding.