A method comprising: establishing an Ethernet Virtual Private Network, EVPN, with a set of routers of a metro transport network positioned between at least one Internet service provider network and a set of customer devices, wherein the metro transport network provides layer two, L2, packet switching for transporting network packets between the Internet service provider network and the customer devices, and wherein a first one of the routers is an access router coupled to the customer devices by an access link; receiving, with access router, a packet from one of the customer devices by the access link; responsive to receiving the packet, outputting an authentication request from the access router to a network address authentication device of the metro transport network, wherein the authentication request specifies a source L2 network address of the packet and requests validation of the source L2 network address; and responsive to receiving response messaging from the network authentication device indicating that the source L2 network address is a valid L2 network address associated with one of the customer devices, wherein the response message specifies a policy associated with the L2 network address, the policy specifying an attribute that controls which of the other routers are to import the L2 network address into their respective L2 network address tables associated with the EVPN, outputting, within the EVPN by the access router, an EVPN route advertisement that advertises the L2 network address as reachable through the access router, the EVPN route advertisement constructed to include the attribute specified in the policy received from the network address authentication device. establishing an Ethernet Virtual Private Network, EVPN, with a set of routers of a metro transport network positioned between at least one Internet service provider network and a set of customer devices, wherein the metro transport network provides layer two, L2, packet switching for transporting network packets between the Internet service provider network and the customer devices, and wherein a first one of the routers is an access router coupled to the customer devices by an access link; receiving, with access router, a packet from one of the customer devices by the access link; responsive to receiving the packet, outputting an authentication request from the access router to a network address authentication device of the metro transport network, wherein the authentication request specifies a source L2 network address of the packet and requests validation of the source L2 network address; and responsive to receiving response messaging from the network authentication device indicating that the source L2 network address is a valid L2 network address associated with one of the customer devices, wherein the response message specifies a policy associated with the L2 network address, the policy specifying an attribute that controls which of the other routers are to import the L2 network address into their respective L2 network address tables associated with the EVPN, outputting, within the EVPN by the access router, an EVPN route advertisement that advertises the L2 network address as reachable through the access router, the EVPN route advertisement constructed to include the attribute specified in the policy received from the network address authentication device.