Namely, they allow VLANs that are not configured on a given subinterface to pass through on the egress. Adding multiple subinterfaces with different VLANs will result in packets being sent multiple times, as many as there are subinterfaces.

The PCAP was created from the client service.

In my opinion, ACX on the egress should drop all packets that don't match the configured VLANs.

root@JTAC> show configuration routing-instances

TEST

instance-type mac-vrf;

protocols {

evpn {

encapsulation mpls;

}

}

service-type vlan-bundle;

interface et-0/0/8.4096;

interface et-0/0/24.12;

interface et-0/0/24.13;

interface et-0/0/24.123;

route-distinguisher a.b.c.d:5040;

vrf-target target:xx:yy;

vlans {

vALL {

interface et-0/0/8.4096;

interface et-0/0/24.123;

interface et-0/0/24.12;

interface et-0/0/24.13;

}

}

root@JTAC> show configuration interfaces et-0/0/24

flexible-vlan-tagging;

speed 1g;

encapsulation flexible-ethernet-services;

ether-options {

no-auto-negotiation;

}

unit 12 {

description TEST;

encapsulation vlan-bridge;

vlan-id 12;

}

unit 13 {

description TEST;

encapsulation vlan-bridge;

vlan-id 13;

}

unit 123 {

encapsulation vlan-bridge;

vlan-id 123;

}

This is an expected behaviour on EVO devices, when we configure service-type vlan-bundle, with mac-vrf instance.

By default, MAC-VRF instance has no-normalization of vlans & hence translation to vlan-id is not happening correctly.

And with vlan-bundle, we cannot add normalization knob in routing-instace configuration.

Below documents has details on vlan normalization (this is irrespective of protocols, whether vpls or evpn is in use):

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/normalization-edit-routing-instances-protocols-evpn.html

https://www.juniper.net/documentation/us/en/software/junos/evpn/topics/concept/evpn-elan-supported-services.html 

https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/vlans-and-vpls.html

The normalizing VLAN identifier is used to perform the following functions:

• Translate, or normalize, the VLAN tags of packets received into a learn VLAN identifier.
• Create multiple learning domains that each contain a learn VLAN identifier. A learning domain is a MAC address database to which MAC addresses are added based on the learn VLAN identifier.