This is used to enable greater security for implementations that use a per-platform VC label space; in strict mode, packets coming from the PSN are accepted only from tunnels associated to the same VC via the inbound tunnel table for MPLS, or as identified by source IP address for L2TP or IP PSN. Switching this to strict is a security hardening measure that stops the router from accepting a pseudowire's traffic through just any tunnel carrying the right VC label, instead only accepting packets arriving via the specific tunnel explicitly associated with that VC, closing off a label-spoofing style attack vector possible when a platform shares one label space across multiple tunnels. For example, leaving this at loose(1) on a platform sharing VC label space across multiple PSN tunnels would let a packet with a matching VC label be accepted regardless of which tunnel it actually arrived on, a gap that switching to strict(2) closes by verifying the tunnel origin too.