Techniques are described that enable MAC (L2) address authentication within an L2 switching network, such as a metro transport network. Moreover, when used in an EVPN, the techniques provide fine grain policy control over the L2 switching network so as to enable carrier networks to specify and control topologies for transporting packet-based communications. Access routers of the EVPN communicate with a L2 network address authentication device of the metro transport network and only advertise MAC addresses into the EVPN that have been validated. Moreover, the L2 network address authentication device may distribute MAC-level policies to control topologies and MAC learning within the EVPN and provide services such as per-MAC traffic quota limits.