I have found references stating that the 9ks support E-Tree / Rooted-Multipoint Ethernet VPNs, where the root sites can talk to all sites but the leaf sites can only talk to the roots. (For example, see slide 61 of BRKSPG-2202 - "Deploying Carrier Ethernet Services on ASR 9000")
However, I can't find any specifics on how to configure this topology.
How does one create a L2 VPN that prevents leaves (or is it leafs?) from talking to one another?
I think you need to use split horizon to have roots and leaves in separate split horizon groups. Split Horizon groups in XR are not the most intuitive in my opinion but it works once you get your head around it.
I dont have my config notes handy right now. let me know if you need anything else. Im pretty sure I got this to work in the lab.
Mark is correct here. On the "root" you would add "split-horizon" under all your leafs. This will put all the leafs in the same split-horizon group and prevent anything coming from a leaf to get sent to any other leaf. But the root can send to all. Or on the root router you can put all the remote leafs in the same VFI. The VFI is a split horizon group as well. Either config should get your desired results.
Here you can see the type of split-horizon groups available. But in your case you will want to use the keyword.