Tier 2 ingress filtering