IGMP Snooping

About Cisco APIC and IGMP Snooping

IGMP snooping implementation in the ACI fabric

IGMP snooping implementation in the ACI fabric is a software feature that

  • examines IP multicast traffic within a bridge domain to discover the ports where interested receivers reside

  • reduces bandwidth consumption in a multi-access bridge domain environment to avoid flooding the entire bridge domain, and

  • operates upon IGMPv1, IGMPv2, and IGMPv3 control plane packets where Layer 3 control plane packets are intercepted and influence the Layer 2 forwarding behavior.

Implementation details

By default, IGMP snooping is enabled on the bridge domain.


Note

We recommend that you do not disable IGMP snooping on bridge domains. If you disable IGMP snooping, you may see reduced multicast performance because of excessive false flooding within the bridge domain.

The IGMP routing functions and IGMP snooping functions are both contained on an ACI leaf switch with connectivity to a host. The IGMP snooping feature snoops the IGMP membership reports, and leaves messages and forwards them only when necessary to the IGMP router function.

Figure 1. IGMP snooping function
The diagram illustrates the IGMP snooping implementation within the ACI fabric, highlighting the interaction between the IGMP routing functions and the ACI leaf switch connected to a host. It emphasizes the importance of maintaining IGMP snooping to prevent multicast performance issues.

IGMP snooping has the following proprietary features:

  • Source filtering that allows forwarding of multicast packets based on destination and source IP addresses

  • Multicast forwarding based on IP addresses rather than the MAC address

  • Multicast forwarding alternately based on the MAC address

The ACI fabric supports IGMP snooping only in proxy-reporting mode, in accordance with the guidelines provided in Section 2.1.1, "IGMP Forwarding Rules," in RFC 4541: 

      IGMP networks may also include devices that implement "proxy-
      reporting", in which reports received from downstream hosts are
      summarized and used to build internal membership states.  Such
      proxy-reporting devices may use the all-zeros IP Source-Address
      when forwarding any summarized reports upstream. For this reason,
      IGMP membership reports received by the snooping switch must not
      be rejected because the source IP address is set to 0.0.0.0.

As a result, the ACI fabric will send IGMP reports with the source IP address of 0.0.0.0.


Note

For more information about IGMP snooping, see RFC 4541.

Virtualization support

Virtualization support is a feature that enables definition of multiple virtual routing and forwarding (VRF) instances for IGMP snooping.

VRF command context

On leaf switches, you can use the show commands with a VRF argument to provide a context for the information displayed. The default VRF is used if no VRF argument is supplied.

APIC IGMP snooping function

The APIC IGMP snooping function is a multicast management mechanism that

  • supports both IGMPv1 and IGMPv2 with membership report suppression

  • enables fast leave feature configuration in IGMPv2 environments, and

  • manages multicast data forwarding based on IGMP messages.

Membership report suppression and fast leave behavior

Both IGMPv1 and IGMPv2 support membership report suppression, which means that if two hosts on the same subnet want to receive multicast data for the same group, the host that receives a member report from the other host suppresses sending its report. Membership report suppression occurs for hosts that share a port.

If no more than one host is attached to each switch port, you can configure the fast leave feature in IGMPv2. The fast leave feature does not send last member query messages to hosts. As soon as APIC receives an IGMP leave message, the software stops forwarding multicast data to that port.

IGMPv1 does not provide an explicit IGMP leave message, so the APIC IGMP snooping function must rely on the membership message timeout to indicate that no hosts remain that want to receive multicast data for a particular group.


Note

The IGMP snooping function ignores the configuration of the last member query interval when you enable the fast leave feature because it does not check for remaining hosts.

APIC IGMP snooping function and IGMPv3

The APIC IGMP snooping function is a network optimization mechanism that

  • supports full IGMPv3 snooping with constrained flooding based on (S, G) information in IGMPv3 reports

  • enables source-based filtering to constrain multicast traffic to specific ports based on the traffic source, and

  • tracks hosts on each VLAN port in the bridge domain by default.

Key features and mechanisms

The IGMP snooping function provides several advanced capabilities:

  • Explicit tracking feature: Provides a fast leave mechanism for improved performance

  • Report suppression: Limits traffic sent to other multicast-capable routers since every IGMPv3 host sends membership reports

  • Proxy reporting: When report suppression is enabled and no IGMPv1 or IGMPv2 hosts request the same group, builds group state from downstream host membership reports and generates reports in response to upstream querier queries

When the last host leaves a group, the software sends a membership query with a configurable last member query interval parameter. If no host responds before the timeout, the IGMP snooping function removes the group state.

Cisco APIC and the IGMP snooping querier function

An IGMP snooping querier function is a network mechanism that

  • sends membership queries to trigger IGMP report messages from hosts wanting to receive IP multicast traffic

  • establishes appropriate forwarding by listening to IGMP reports, and

  • performs querier election as described in RFC 2236 when multiple queriers exist.

IGMP snooping querier configuration in APIC

When PIM is not enabled on an interface because the multicast traffic does not need to be routed, you must configure an IGMP snooping querier function to send membership queries. In APIC, within the IGMP Snoop policy, you define the querier in a bridge domain that contains multicast sources and receivers but no other active querier.

Cisco ACI has by default, IGMP snooping enabled. Additionally, if the Bridge Domain subnet control has "querier IP" selected, then the leaf switch behaves as a querier and starts sending query packets. Querier on the ACI leaf switch must be enabled when the segments do not have an explicit multicast router (PIM is not enabled). On the Bridge Domain where the querier is configured, the IP address used must be from the same subnet where the multicast hosts are configured.


Note

The IP address for the querier should not be a broadcast IP address, multicast IP address, or 0 (0.0.0.0).

When an IGMP snooping querier is enabled, it sends out periodic IGMP queries that trigger IGMP report messages from hosts that want to receive IP multicast traffic. IGMP snooping listens to these IGMP reports to establish appropriate forwarding.

The IGMP snooping querier performs querier election as described in RFC 2236. Querier election occurs in these configurations:

  • When there are multiple switch queriers configured with the same subnet on the same VLAN on different switches.

  • When the configured switch querier is in the same subnet as with other Layer 3 SVI queriers.

Guidelines and limitations for the APIC IGMP snooping function

Consider these guidelines and limitations for APIC IGMP snooping:

  • Layer 3 IPv6 multicast routing is not supported.

  • Layer 2 IPv6 multicast packets will be flooded on the incoming bridge domain.

  • IGMPv3 snooping will forward multicast based on the group and source entry only when PIM is enabled on the bridge domain. If PIM is not enabled, forwarding will be based on the group only.

Configuring and Assigning an IGMP Snooping Policy

Configure and assign an IGMP snooping policy to a bridge domain in the advanced GUI

Configuring and assigning an IGMP snooping policy to a bridge domain in the advanced GUI is a network configuration process that implements IGMP snooping functionality by configuring an IGMP snooping policy then assigning that policy to one or more bridge domains.

Configure an IGMP snooping policy using the GUI

Create an IGMP snooping policy to apply consistent IGMP settings across multiple bridge domains within a tenant.

Create an IGMP Snooping policy whose IGMP settings can be assigned to one or multiple bridge domains.

Procedure

Step 1

Click the Tenants tab and the name of the tenant on whose bridge domain you intend to configure IGMP snooping support.

Step 2

In the Navigation pane, click Policies > Protocol > IGMP Snoop.

Step 3

Right-click IGMP Snoop and select Create IGMP Snoop Policy.

Step 4

In the Create IGMP Snoop Policy dialog, configure a policy as follows:

  1. In the Name and Description fields, enter a policy name and optional description.

  2. In the Admin State field, select Enabled or Disabled to enable or disable IGMP snooping for this particular policy.

  3. Select or unselect Fast Leave to enable or disable IGMP V2 immediate dropping of queries through this policy.

  4. Select Enable querier to enable or disable the IGMP querier activity through this policy.

    Note

     

    For this option to be effectively enabled, the Subnet Control: Querier IP setting must also be enabled in the subnets assigned to the bridge domains to which this policy is applied. The navigation path to the properties page on which this setting is located is Tenants > tenant_name > Networking > Bridge Domains > bridge_domain_name > Subnets > subnet_name.

  5. In the Querier Version field, select Version 2 or Version 3 to to choose IGMP snooping querier version for this particular policy.

  6. Specify in seconds the Last Member Query Interval value for this policy.

    IGMP uses this value when it receives an IGMPv2 Leave report. This means that at least one host wants to leave the group. After it receives the Leave report, it checks that the interface is not configured for IGMP Fast Leave and if not, it sends out an out-of-sequence query.

  7. Specify in seconds the Query Interval value for this policy.

    This value is used to define the amount of time the IGMP function will store a particular IGMP state if it does not hear any reports on the group.

  8. Specify in seconds Query Response Interval value for this policy.

    When a host receives the query packet, it starts counting to a random value, less that the maximum response time. When this timer expires, host replies with a report.

  9. Specify the Start query Count value for this policy.

    Number of queries sent at startup that are separated by the startup query interval. Values range from 1 to 10. The default is 2.

  10. Specify in seconds a Start Query Interval for this policy.

    By default, this interval is shorter than the query interval so that the software can establish the group state as quickly as possible. Values range from 1 to 18,000 seconds. The default is 31 seconds.

Step 5

Click Submit.

The new IGMP Snoop policy is listed in the Protocol Policies - IGMP Snoop summary page.

What to do next

To put this policy into effect, assign it to any bridge domain.

Assign an IGMP snooping policy to a bridge domain using the GUI

Assigning an IGMP Snooping policy to a bridge domain configures that bridge domain to use the IGMP Snooping properties specified in that policy.

This procedure allows you to apply IGMP Snooping configuration to a specific bridge domain within a tenant environment.

Before you begin

  • Configure a bridge domain for a tenant.

  • Configure the IGMP Snooping policy that will be attached to the bridge domain.


Note

For the Enable Querier option on the assigned policy to be effectively enabled, the Subnet Control: Querier IP setting must also be enabled in the subnets assigned to the bridge domains to which this policy is applied. The navigation path to the properties page on which this setting is located is Tenants > tenant_name > Networking > Bridge Domains > bridge_domain_name > Subnets > subnet_name.

Procedure

Step 1

Click the APIC Tenants tab and select the name of the tenant whose bridge domains you intend to configure with an IGMP Snoop policy.

Step 2

In the APIC navigation pane, click Networking > Bridge Domains, then select the bridge domain to which you intend to apply your policy-specified IGMP Snoop configuration.

Step 3

On the main Policy tab, scroll down to the IGMP Snoop Policy field and select the appropriate IGMP policy from the drop-down menu.

Step 4

Click Submit.

The target bridge domain is now associated with the specified IGMP Snooping policy.

Enabling IGMP Snooping Static Port Groups

IGMP snooping static port groups

IGMP snooping static port groups are a network configuration feature that

  • pre-provisions ports that were previously statically-assigned to an application EPG

  • enables switch ports to receive and process IGMP multicast traffic, and

  • prevents join latency that normally occurs when the IGMP snooping stack learns ports dynamically.

Configuration requirements and options

Static group membership configuration has these requirements and options:

  • Can be pre-provisioned only on static ports assigned to an application EPG

  • Can be configured through the APIC GUI, CLI, and REST API interfaces

Requirement: deploy EPGs to static ports

Enabling IGMP snoop processing on ports requires as a prerequisite that the target ports be statically-assigned to associated EPGs.

Static deployment of ports can be configured through the APIC GUI, CLI, or REST API interfaces. For information, see these topics in the Cisco APIC Layer 2 Networking Configuration Guide:

  • Deploying an EPG on a Specific Node or Port Using the GUI

  • Deploying an EPG on a Specific Port with APIC Using the NX-OS Style CLI

  • Deploying an EPG on a Specific Port with APIC Using the REST API

Enable IGMP snooping and multicast on static ports using the GUI

This task enables IGMP snooping and multicast functionality on statically assigned ports to allow processing of IGMP protocol traffic sent to associated multicast IP addresses.

You can enable IGMP snooping and multicast on ports that have been statically assigned to an EPG. Afterwards you can create and assign access groups of users that are permitted or denied access to the IGMP snooping and multicast traffic enabled on those ports.

Before you begin

Before you begin to enable IGMP snooping and multicast for an EPG, complete the following tasks:

  • Identify the interfaces to enable this function and statically assign them to that EPG


    Note
    For details on static port assignment, see Deploying an EPG on a Specific Node or Port Using the GUI in the Cisco APIC Layer 2 Networking Configuration Guide.

  • Identify the IP addresses that you want to be recipients of IGMP snooping and multicast traffic.

Follow these steps to enable IGMP snooping and multicast on static ports using the GUI:

Procedure

Step 1

Click Tenant > tenant_name > Application Profiles > application_name > Application EPGs > epg_name > Static Ports.

Navigating to this spot displays all the ports you have statically assigned to the target EPG.

Step 2

Click the port to which you intend to statically assign group members for IGMP snooping.

This action displays the Static Path page.

Step 3

On the IGMP Snoop Static Group table, click + to add an IGMP Snoop Address Group entry.

Adding an IGMP Snoop Address Group entry associates the target static port with a specified multicast IP address and enables it to process the IGMP snoop traffic received at that address.

  1. In the Group Address field, enter the multicast IP address to associate with his interface and this EPG.

  2. In the Source Address field enter the IP address of the source to the multicast stream, if applicable.

  3. Click Submit.

When configuration is complete, the target interface is enabled to process IGMP Snooping protocol traffic sent to its associated multicast IP address.

Note

 

You can repeat this step to associate additional multicast addresses with the target static port.

Step 4

Click Submit.

The target interface is now enabled to process IGMP snooping protocol traffic sent to its associated multicast IP addresses. Multiple multicast addresses can be associated with the same static port as needed.

Enabling IGMP Snoop Access Groups

IGMP snoop access groups

An IGMP snoop access group is a network access control feature that

  • controls what multicast streams can be joined behind a given port

  • can be applied on interfaces that are statically assigned to an application EPG, and

  • supports only route-map-based access groups.

Configuration interfaces

IGMP snoop access groups can be configured through these interfaces:

  • APIC GUI

  • CLI

  • REST API interfaces

Enable group access to IGMP snooping and multicast using the GUI

This task enables you to create and assign access groups of users that are permitted or denied access to IGMP snooping and multicast traffic on statically assigned EPG ports.

After you enable IGMP snooping and multicasting on ports that have been statically assigned to an EPG, you can then create and assign access groups of users that are permitted or denied access to the IGMP snooping and multicast traffic enabled on those ports.

Before you begin

Before you enable access to IGMP snooping and multicasting for an EPG, Identify the interfaces to enable this function and statically assign them to that EPG.


Note
For details on static port assignment, see Deploying an EPG on a Specific Node or Port Using the GUI in the Cisco APIC Layer 2 Networking Configuration Guide.

Follow these steps to enable group access to IGMP snooping and multicast using the GUI:

Procedure

Step 1

Click Tenant > tenant_name > Application Profiles > application_name > Application EPGs > epg_name > Static Ports.

Navigating to this spot displays all the ports you have statically assigned to the target EPG.

Step 2

Click the port to which you intend to assign multicast group access, to display the Static Port Configuration page.

Step 3

Click Actions > Create IGMP Access Group to display the IGMP Snoop Access Group table.

Step 4

Locate the IGMP Snoop Access Group table and click + to add an access group entry.

Adding an IGMP Snoop Access Group entry creates a user group with access to this port, associates it with a multicast IP address, and permits or denies that group access to the IGMP snoop traffic received at that address.

  1. Select Create Route Map Policy for Multicast to display the Create Route Map Policy for Multicast window.

  2. In the Name field assign the name of the group that you want to allow or deny multicast traffic.

  3. In the Route Maps table click + to display the route map dialog.

  4. In the Order field, if multiple access groups are being configured for this interface, select a number that reflects the order in which this access group will be permitted or denied access to the multicast traffic on this interface. Lower-numbered access groups are ordered before higher-numbered access groups.

  5. In the Group IP field enter the multicast IP address whose traffic is to be allowed or blocked for this access group.

  6. In the Source IP field, enter the IP address of the source if applicable.

  7. In the Action field, choose Deny to deny access for the target group or Permit to allow access for the target group.

  8. Click OK.

  9. Click Submit.

When the configuration is complete, the configured IGMP snoop access group is assigned a multicast IP address through the target static port and permitted or denied access to the multicast streams that are received at that address.

Note

 

  • You can repeat this step to configure and associate additional access groups with multicast IP addresses through the target static port.

  • To review the settings for the configured access groups, click to the following location: Tenant > tenant_name > Policies > Protocol > Route Maps for Multicast > route_map_access_group_name.

Step 5

Click Submit.

The IGMP snoop access groups are now configured and associated with multicast IP addresses, controlling user access to multicast traffic on the specified static ports.