This article describes an issue where EVPN duplicate MAC detection alarms continued to be generated even after duplicate MAC detection thresholds were configured on the device

• Duplicate MAC detection events continued to be logged despite threshold configuration being present on the device.
• EVPN MAC mobility or duplicate MAC alarms were repeatedly observed.
• The configured threshold values appeared correct when reviewing the configuration.
• Log entries referenced a routing instance different from the one where the duplicate MAC thresholds had been configured.

After reviewing we found the duplicate MAC detection log messages and identify the routing instance referenced by the events.

EVPN_DUPLICATE_MAC: MAC address move detected for aa:bb:cc:dd:ee:ff within instance=VRF_Instance

However under the routing instance EVPN stanza we have no configuration for the duplicate detection

routing-instances {

  VRF_Instance {

    instance-type mac-vrf;

    protocols {

      evpn {

        encapsulation vxlan;

        default-gateway no-gateway-community; >>> No configuration for the mac duplicate detection under the RI, only under the general EVPN configuration

The configuration for events occurring within a routing instance must be applied under the corresponding routing instance stanza. Although the EVPN protocol configuration under the global configuration hierarchy can be misleading, it is important to clarify that it only affects the default routing instance and does not apply to other routing instances.