Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Multicast filtering

Updated: April 17, 2026

Want to summarize with AI?

Explains how ACI supports control and data plane configurations to filter multicast traffic from sources and receivers.

Multicast filtering is a data plane control feature that

constrains the sending and receiving of multicast streams at the data plane level
allows filtering of multicast traffic from two directions: source and receiver
complements existing control plane options such as IGMP report filters, PIM join or prune filters, PIM neighbor filters, and Rendezvous Point (RP) filters.

Multicast filtering functionality

ACI supports control plane configurations that can be used to control who can receive multicast feeds and from which sources. The filtering options can be IGMP report filters, PIM join or prune filters, PIM neighbor filters, and Rendezvous Point (RP) filters. These options rely on control plane protocols, namely IGMP and PIM.

In some deployments, it may be desirable to constrain the sending and/or receiving of multicast streams at the data plane level. For example, you may want to allow multicast senders in a LAN to only send to specific multicast groups or to allow receivers in a LAN to only receive specific multicast groups originated from all the possible sources or from specific sources.

Beginning with Cisco APIC Release 5.0(1), the multicast filtering feature is now available, which allows you to filter multicast traffic from two directions:

Multicast filtering functionality
Receiver filtering at last-hop router
Receiver filtering at last-hop router

For any sources that are sending traffic on a bridge domain, if you have configured a multicast source filter for that bridge domain, then the source and group will be matched against one of the entries in the source filter route map, where one of these actions will take place, depending on the action that is associated with that entry:

If the source and group is matched against an entry with a Permit action in the route map, then the bridge domain will allow traffic to be sent out from that source to that group.
If the source and group is matched against an entry with a Deny action in the route map, then the bridge domain will block traffic from being sent out from that source to that group.
If there is no match with any entries in the route map, then the bridge domain will block traffic from being sent out from that source to that group as the default option. This means that once the route map is applied, there is always an implicit "deny all" statement in effect at the end.

You can configure multiple entries in a single route map, where some entries can be configured with a Permit action and other entries can be configured with a Deny action, all within the same route map.

Note

When a source filter is applied to a bridge domain, it will filter multicast traffic at the source. The filter will prevent multicast from being received by receivers in different bridge domains, the same bridge domain, and external receivers.

Receiver filtering at last-hop router

Multicast receiver filtering is used to restrict from which sources receivers in a bridge domain can receive multicast for a particular group. This feature provides source or group data plane filtering functionality for IGMPv2 hosts, similar to what IGMPv3 provides at the control plane.

For any receivers sending joins on a bridge domain, if you have configured a multicast receiver filter for that bridge domain, then the source and group will be matched against one of the entries in the receiver filter route map, where one of these actions will take place, depending on the action that is associated with that entry:

If the source and group is matched against an entry with a Permit action in the route map, then the bridge domain will allow traffic to be received from that source for that group.
If the source and group is matched against an entry with a Deny action in the route map, then the bridge domain will block traffic from being received from that source for that group.
If there is no match with any entries in the route map, then the bridge domain will block traffic from being received from that source for that group as the default option. This means that once the route map is applied, there is always an implicit "deny all" statement in effect at the end.

You can also enable both multicast source filtering and multicast receiver filtering on the same bridge domain, where one bridge domain can perform blocking or can permit sources to filtering when sending traffic to a group range, and can also perform restricting or can allow restricting to filtering when receiving traffic from sources to a group range.

Guidelines and restrictions for multicast filtering

While you can enable either the multicast source filtering or the receiver filtering on a bridge domain, you can also have both multicast source filtering and receiver filtering enabled on the same bridge domain.

Multicast filtering is supported only for IPv4.

If you do not want to have multicast filters on a bridge domain, then do not configure a source filter or destination filter route maps on that bridge domain. By default, no route maps are associated with a bridge domain, which means that all sources and groups are allowed. If a route map with source filters or destination filters is associated with a bridge domain, only the permit entries in that route map will be allowed, and all deny entries will be blocked (including the implicit "deny-all" statement always present at the end).

If you attach an empty route map to a bridge domain, route maps assume a deny-all by default, so all sources and groups will be blocked on that bridge domain.

The multicast filtering feature is applied at the bridge domain level. ACI supports configuration of multiple EPGs in a single bridge domain. When this configuration is used with the bridge domain filtering features, the filter will be applied across all EPGs in the bridge domain as it is a bridge domain level setting.

SSM range configuration restrictions

The multicast filtering feature is intended to be used for Any-Source Multicast (ASM) ranges only. If, however, you have support for Source-Specific Multicast (SSM) ranges, then we recommend that sources and joins be filtered in the SSM join itself using IGMPv3.

Bridge domain source filtering with SSM: Source filtering is not supported with SSM.
Bridge domain receiver filtering with SSM: Receiver filtering can be used with SSM group ranges. One of the main use cases for receiver filtering is to filter multicast streams from specific sources. In most cases, receiver filtering is not needed with SSM as this functionality is already provided by the SSM protocol.

Route map evaluation order

Source and receiver filtering use an ordered list of route-map entries. Route-map entries are executed with the lowest number first until there is a match. If there is a match, even if it is not the longest match in the list, it will exit the program and will not consider the rest of the entries.

For example, assume that you have this route map for a specific source (192.0.3.1/32), with these entries:

Table 1. Route map
Order	Source IP	Action
1	192.0.0.0/16	Permit
2	192.0.3.0/24	Deny

The route map is evaluated based on the order number. Therefore, even though the second entry (192.0.3.0/24) is a longer match for the source IP, the first entry (192.0.0.0/16) will be matched because of the earlier order number.

Configure multicast filtering using the GUI

Before you begin

Create the bridge domain on which you will configure multicast filtering.
Enable PIM on the bridge domain.
Enable Layer 3 multicast at the VRF level.

Procedure

In the navigation pane, expand Tenant > tenant-name > Networking > Bridge Domains, and select bridge-domain-name.

The Summary page for the bridge domain appears.
Select the Policy tab, and then select the General subtab.
In the General window, verify that PIM is enabled in the PIM field.

If PIM is not enabled, select the check box next to PIM. The Source Filter and Destination Filter fields become available.

Note

Multicast filtering is supported only for IPv4 (PIM). IPv6 (PIM6) multicast filtering is not supported.
Determine whether to enable multicast source filtering, receiver filtering, or both.
- To enable multicast source filtering at the first-hop router, in the Source Filter field, choose one of the following options:
  - To use an existing route map policy, select the policy for multicast source filtering, and then go to 7.
  - To create a route map policy, select Create Route Map Policy for Multicast, and then go to 5.
- To enable multicast receiver filtering at the last-hop router, in the Destination Filter field, choose one of the following options:
  - To use an existing route map policy, select the policy for multicast receiver filtering, and then go to 7.
  - To create a route map policy, select Create Route Map Policy for Multicast, and then go to 6.
If you selected Create Route Map Policy for Multicast to enable multicast source filtering at the first-hop router, configure the route map policy in the window that appears.
1. In the Name field, enter a name for the route map. Optionally, enter a description in the Description field.
2. In the Route Maps area, click +.
  
  The Create Route Map Entry window appears.
3. In the Order field, select the sequence number for the access group.
  
  Lower-numbered entries are ordered before higher-numbered entries. The supported range is 0 through 65535.
4. Specify the source and group addresses for multicast source filtering.
  - To allow or deny traffic from a specific source to any group, enter the source IP address in Source IP and leave Group IP empty.
  - To allow or deny traffic from any source to a specific group, enter the multicast IP address in Group IP and leave Source IP empty.
  - To allow or deny traffic from a specific source to a specific group, enter values in both Source IP and Group IP.
  Note
  
  The RP IP field does not apply to multicast source or receiver filtering. Do not enter a value in this field.
5. In the Action field, choose Deny to deny access or Permit to allow access for the target source.
6. Click OK.
  
  The Create Route Map Policy for Multicast window appears again, and the configured entry is displayed in the Route Maps table.
7. Determine whether to create additional route map entries.
  
  You can create multiple entries with different IP addresses and actions in the same route map.
  
  To create another entry, click + in the Route Maps area, and then go to 5.c.
8. When you finish configuring the route map entries, click Submit, and then go to 7.
If you selected Create Route Map Policy for Multicast to enable multicast receiver filtering at the last-hop router, configure the route map policy in the window that appears.
1. In the Name field, enter a name for the route map. Optionally, enter a description in the Description field.
2. In the Route Maps area, click +.
  
  The Create Route Map Entry window appears.
3. In the Order field, select the sequence number for the access group.
  
  Lower-numbered entries are ordered before higher-numbered entries. The supported range is 0 through 65535.
4. Specify the source and group addresses for multicast receiver filtering.
  - To allow or deny traffic from any source to a specific group, enter the multicast IP address in Group IP and leave Source IP empty.
  - To allow or deny traffic from a specific source to any group, enter the source IP address in Source IP and leave Group IP empty.
  - To allow or deny traffic from a specific source to a specific group, enter values in both Source IP and Group IP.
  Note
  
  The RP IP field does not apply to multicast source or receiver filtering. Do not enter a value in this field.
5. In the Action field, choose Deny to deny access or Permit to allow access for the target group.
6. Click OK.
  
  The Create Route Map Policy for Multicast window appears again, and the configured entry is displayed in the Route Maps table.
7. Determine whether to create additional route map entries.
  
  You can create multiple entries with different IP addresses and actions in the same route map.
  
  To create another entry, click + in the Route Maps area, and then go to 6.c.
8. When you finish configuring the route map entries, click Submit, and then go to 7.
At the bottom-right corner of the Policy/General page, click Submit.

The Policy Usage Warning window appears.
Review the nodes and policies listed in the Policy Usage Warning window, and verify that the changes are acceptable. Click Submit Changes.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.