A method comprising: an ingress provider edge "PE" device receiving one or more egress node protection labels advertised by a plurality of egress PE devices, the plurality of egress PE devices resident on a same Ethernet segment, wherein the ingress PE device and plurality of egress PE devices are configured with an Ethernet Virtual Private Network "EVPN" instance, EVI, the EVI providing a logical L2 forwarding domain for said Ethernet segment connecting the plurality of egress PE devices to a customer edge "CE" device, the CE device being multi-homed to the plurality of egress PE devices over the Ethernet segment, wherein one of the egress PE devices of the plurality of egress PE devices that the CE device is multi-homed to is configured as a designated forwarder "DF", wherein one of the egress PE devices of the plurality of egress PE devices that the CE device is multi-homed to is configured as a backup DF, wherein each of the one or more egress node protection labels advertised by the plurality of egress PE devices identifies another egress PE device the advertising egress PE device is protecting, and wherein the one or more egress node protection labels identify each of the plurality of egress PE devices including the egress PE device configured as the DF; determining, by the ingress PE device, that the one of the egress PE devices configured as the DF has failed; and in response to determining that the DF has failed, sending, by the ingress PE device and to the plurality of egress PE devices, Broadcast, unknown Unicast and Multicast "BUM" packets including the one or more egress node protection labels that identify one or more of the plurality of egress PE devices that protect the DF. an ingress provider edge "PE" device receiving one or more egress node protection labels advertised by a plurality of egress PE devices, the plurality of egress PE devices resident on a same Ethernet segment, wherein the ingress PE device and plurality of egress PE devices are configured with an Ethernet Virtual Private Network "EVPN" instance, EVI, the EVI providing a logical L2 forwarding domain for said Ethernet segment connecting the plurality of egress PE devices to a customer edge "CE" device, the CE device being multi-homed to the plurality of egress PE devices over the Ethernet segment, wherein one of the egress PE devices of the plurality of egress PE devices that the CE device is multi-homed to is configured as a designated forwarder "DF", wherein one of the egress PE devices of the plurality of egress PE devices that the CE device is multi-homed to is configured as a backup DF, wherein each of the one or more egress node protection labels advertised by the plurality of egress PE devices identifies another egress PE device the advertising egress PE device is protecting, and wherein the one or more egress node protection labels identify each of the plurality of egress PE devices including the egress PE device configured as the DF; determining, by the ingress PE device, that the one of the egress PE devices configured as the DF has failed; and in response to determining that the DF has failed, sending, by the ingress PE device and to the plurality of egress PE devices, Broadcast, unknown Unicast and Multicast "BUM" packets including the one or more egress node protection labels that identify one or more of the plurality of egress PE devices that protect the DF.