[ACX7024X] In EVPN A/A set up the host MAC address is switching between two different ports.

We are starting a ping from the source CE towards any IP in the same subnet.

17:25:33.445344 Out IP truncated-ip - 28 bytes missing! 192.168.77.1 > 192.168.77.100: ICMP echo request, id 26790, seq 2, length 64
17:25:34.452200 Out IP truncated-ip - 28 bytes missing! 192.168.77.1 > 192.168.77.100: ICMP echo request, id 26790, seq 3, length 64
17:25:35.462200 Out IP truncated-ip - 28 bytes missing! 192.168.77.1 > 192.168.77.100: ICMP echo request, id 26790, seq 4, length 64
17:25:36.472202 Out IP truncated-ip - 28 bytes missing! 192.168.77.1 > 192.168.77.100: ICMP echo request, id 26790, seq 5, length 64
17:25:37.475217 Out IP truncated-ip - 28 bytes missing! 192.168.77.1 > 192.168.77.100: ICMP echo request, id 26790, seq 6, length 64
17:25:38.477100 Out IP truncated-ip - 28 bytes missing! 192.168.77.1 > 192.168.77.100: ICMP echo request, id 26790, seq 7, length 64
17:25:39.485213 Out IP truncated-ip - 28 bytes missing! 192.168.77.1 > 192.168.77.100: ICMP echo request, id 26790, seq 8, length 64

In the next-hop device which is an ex4300-32f we can see the MAC from source device is constantly switching between ports xe-0/0/32.0 (CE facing interface - correct interface) and ae15.0 (core-facing interface - incorrect interface)

Ethernet switching table : 1 entries, 1 learned
Routing instance : default-switch
  Vlan        MAC         MAC     Age  Logical        NH    RTR 
  name        address       flags       interface       Index   ID
  TEST-VLAN 00:00:5E:00:53:01 D       -  ae15.0         0     0    
---(refreshed at 2026-02-13 17:26:30 PST)---
 
MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static, C - Control MAC
      SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC)
 
 
Ethernet switching table : 1 entries, 1 learned
Routing instance : default-switch
  Vlan        MAC         MAC     Age  Logical        NH    RTR 
  name        address       flags       interface       Index   ID
  TEST-VLAN 00:00:5E:00:53:01 D       -  xe-0/0/32.0      0     0    
---(refreshed at 2026-02-13 17:26:31 PST)---
 
MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static, C - Control MAC
      SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC)
 
 
Ethernet switching table : 1 entries, 1 learned
Routing instance : default-switch
  Vlan        MAC         MAC     Age  Logical        NH    RTR 
  name        address       flags       interface       Index   ID
  TEST-VLAN 00:00:5E:00:53:01 D       -  ae15.0         0     0    
---(refreshed at 2026-02-13 17:26:32 PST)---
 
MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static, C - Control MAC
      SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC)
 
 
Ethernet switching table : 1 entries, 1 learned
Routing instance : default-switch
  Vlan        MAC         MAC     Age  Logical        NH    RTR 
  name        address       flags       interface       Index   ID
  TEST-VLAN 00:00:5E:00:53:01 D       -  xe-0/0/32.0      0     0  
 

Note = any solution shown in this KB must be applied during a maintenance window, the changes shown below could impact traffic.

We encounter two unsupported knobs configured in the ACX7024X.

First, "mpls-inet6" is not supported in ACX7024X, we started by deleting mpls-inet6 from the configuration. Furthermore, we removed IPv6 and we configured IPv4 for the underlay so we can use encapsulation mpls for the ELAN session.

user@router# show | compare 

[edit groups TEST routing-instances TEST protocols evpn]

-  encapsulation mpls-inet6;

After making all this changes the issue is still happening.

Second, knob "family any" is not supported in EVPN interfaces.

We found a firewall which is using "family any" and then that firewall filter was applied on interfaces participating in EVPN.

We removed the policers that were applied on EVPN Interfaces that were related to "family any"

delete groups TEST interfaces ae10 unit 2077 filter input TEST-Policer-100M

delete groups TEST interfaces ae10 unit 2077 filter output TEST-Policer-100M

delete groups TEST interfaces ae10 unit 2078 filter input TEST-Policer-100M

delete groups TEST interfaces ae10 unit 2078 filter output TEST-Policer-100M

delete groups TEST interfaces ae10 unit 2079 filter input TEST-Policer-500M

delete groups TEST interfaces ae10 unit 2079 filter output TEST-Policer-500M

delete groups TEST interfaces ae10 unit 2178 filter input TEST-Policer-100M

delete groups TEST interfaces ae10 unit 2178 filter output TEST-Policer-100M

delete groups TEST interfaces ae80 unit 2377 filter input TEST-Policer-8G

delete groups TEST interfaces ae80 unit 2377 filter output TEST-Policer-8G

We deleted the firewall related to "family any"

del firewall family any filter TEST-Policer-100M interface-specific

del firewall family any filter TEST-Policer-100M term 1 then policer 100M-Policer

del firewall family any filter TEST-Policer-10G interface-specific

del firewall family any filter TEST-Policer-10G term 1 then policer 10G-Policer

del firewall family any filter TEST-Policer-1G interface-specific

del firewall family any filter TEST-Policer-1G term 1 then policer 1G-Policer

del firewall family any filter TEST-Policer-200M interface-specific

del firewall family any filter TEST-Policer-200M term 1 then policer 200M-Policer

del firewall family any filter TEST-Policer-25G interface-specific

del firewall family any filter TEST-Policer-25G term 1 then policer 25G-Policer

del firewall family any filter TEST-Policer-2G interface-specific

del firewall family any filter TEST-Policer-2G term 1 then policer 2G-Policer

del firewall family any filter TEST-Policer-300M interface-specific

del firewall family any filter TEST-Policer-300M term 1 then policer 300M-Policer

del firewall family any filter TEST-Policer-500M interface-specific

del firewall family any filter TEST-Policer-500M term 1 then policer 500M-Policer

del firewall family any filter TEST-Policer-50G interface-specific

del firewall family any filter TEST-Policer-50G term 1 then policer 50G-Policer

del firewall family any filter TEST-Policer-5G interface-specific

del firewall family any filter TEST-Policer-5G term 1 then policer 5G-Policer

del firewall family any filter TEST-Policer-80G interface-specific

del firewall family any filter TEST-Policer-80G term 1 then policer 80G-Policer

del firewall family any filter TEST-Policer-8G interface-specific

del firewall family any filter TEST-Policer-8G term 1 then policer 8G-Policer

We applied the following change to the firewall to avoid using "family any".

set firewall family ccc filter TEST-Policer-100M interface-specific

set firewall family ccc filter TEST-Policer-100M term 1 then policer 100M-Policer

set firewall family ccc filter TEST-Policer-10G interface-specific

set firewall family ccc filter TEST-Policer-10G term 1 then policer 10G-Policer

set firewall family ccc filter TEST-Policer-1G interface-specific

set firewall family ccc filter TEST-Policer-1G term 1 then policer 1G-Policer

set firewall family ccc filter TEST-Policer-200M interface-specific

set firewall family ccc filter TEST-Policer-200M term 1 then policer 200M-Policer

set firewall family ccc filter TEST-Policer-25G interface-specific

set firewall family ccc filter TEST-Policer-25G term 1 then policer 25G-Policer

set firewall family ccc filter TEST-Policer-2G interface-specific

set firewall family ccc filter TEST-Policer-2G term 1 then policer 2G-Policer

set firewall family ccc filter TEST-Policer-300M interface-specific

set firewall family ccc filter TEST-Policer-300M term 1 then policer 300M-Policer

set firewall family ccc filter TEST-Policer-500M interface-specific

set firewall family ccc filter TEST-Policer-500M term 1 then policer 500M-Policer

set firewall family ccc filter TEST-Policer-50G interface-specific

set firewall family ccc filter TEST-Policer-50G term 1 then policer 50G-Policer

set firewall family ccc filter TEST-Policer-5G interface-specific

set firewall family ccc filter TEST-Policer-5G term 1 then policer 5G-Policer

set firewall family ccc filter TEST-Policer-80G interface-specific

set firewall family ccc filter TEST-Policer-80G term 1 then policer 80G-Policer

set firewall family ethernet-switching filter TEST-Policer-8G interface-specific

set firewall family ethernet-switching filter TEST-Policer-8G term 1 then policer 8G-Policer

We applied the policers to the EVPN interfaces

set groups TEST interfaces ae10 unit 2077 family ccc filter input TEST-Policer-100M

set groups TEST interfaces ae10 unit 2077 family ccc filter output TEST-Policer-100M

set groups TEST interfaces ae10 unit 2078 family ccc filter input TEST-Policer-100M

set groups TEST interfaces ae10 unit 2078 family ccc filter output TEST-Policer-100M

set groups TEST interfaces ae10 unit 2079 family ccc filter input TEST-Policer-500M

set groups TEST interfaces ae10 unit 2079 family ccc filter output TEST-Policer-500M

set groups TEST interfaces ae10 unit 2178 family ccc filter input TEST-Policer-100M

set groups TEST interfaces ae10 unit 2178 family ccc filter output TEST-Policer-100M

set groups TEST interfaces ae80 unit 2377 family ethernet-switching filter input TEST-Policer-8G

set groups TEST interfaces ae80 unit 2377 family ethernet-switching filter output TEST-Policer-8G

After the above steps, we rebooted the routers from where we made the changes.

After the routers came up everything worked as expected, no MAC duplication was seen.

Please keep in mind that when applying unsupported configurations different unwanted behaviors may appear, so it is difficult to predict how a device will behave, the best option is always to remove unsupported configuration from your device.