@PhilipDAth I don't follow you.  If I have a voice subnet on my LAN that needs to traverse a L2L tunnel, I don't want to put an SVI for that subnet on the MX and expose L2 voice traffic to my edge device.  I would rather my core L3 device receive those packets first, apply any QoS and then route them (using default route) to the firewall.  But because the MX doesn't have an SVI on the voice subnet in this scenario, it won't like receiving packets stamped with a different VLAN. This effectively wastes the default route.    Some topology for discourse:   data VLAN 1 = 192.168.1.0/24 voice VLAN 2 = 10.10.10.0/24   L3 gw = 10.10.10.1, 192.168.1.1  [default route: 0.0.0.0/0 192.168.1.2] MX = 192.168.1.2 (assume it has route for voice sub)   phone 10.10.10.2 => L3 gw 10.10.10.1 => default route => MX 192.168.1.2 => ** VLAN mismatch**   An ASA does not have a VLAN mismatch problem when packets from other subnets are routed to it.  Routing is a function of L3, not L2, so why is the MX looking at VLAN tags on L3?   Routing happens at L3 so I don't see the value in enforcing the VLAN match.  ... View more

This was my next step anyway.  I'll lock it down to 1,99 and see if the mismatch goes away.    IMO, the MX should just be dropping broadcast traffic that doesn't match any of its VLAN interfaces instead of processing it and complaining about a mismatch.  The events don't show L2 broadcasts so why would its L3 interface even care about packets from subnets it doesn't have an interface for?  Its L2 should not even be handing those packets off to L3.       ... View more

I was looking for both and already found what I needed, but that’s for asking.  ... View more