Answer
To prevent spokes from talking to each other, spoke provider edge (PE) routers export different VPN routing and forwarding (VRF) targets, and import only the hub VRF targets. Using this method, spokes only exchange routes with the hub, however, the hub PE router imports all of the spoke VRF route targets.
For example, assume that an interface residing on the hub PE router needs to connect with a spoke customer provider edge (CPE) router. When this spoke interface is added to the hub routing instance, it will receive hub routes, which is not expected in a hub-and-spoke topology.
A solution is to configure a core-facing statement under the spoke interface on the hub PE router. This will prevent route advertisements from the hub PE router from going to the directly-connected spoke CPE.
Enter the following CLI configuration command to have broadcasts go only to the hub CE from the spoke CE attached to the hub PE router.
user@host# set interfaces ge-0/0/0.0 family vpls core-facing
For more information, click Layer 2 VPNs and VPLS Feature Guide.