Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Layer 3 multicast on SVI L3Outs

Updated: April 17, 2026

Want to summarize with AI?

Log in

Explains Layer 3 multicast support on SVI L3Out configurations that enables PIM adjacencies between ACI border leaf switches and external multicast devices.

Layer 3 multicast on an SVI L3Out is a network feature that

  • adds support for enabling PIM on L3Out SVIs

  • allows ACI border leaf switches configured with an L3Out SVI to establish PIM adjacencies with external multicast routers or firewalls, and

  • supports LAN-like topologies where firewalls are deployed in active/standby pairs connecting to the fabric on the same VLAN and subnet.

L3Out SVI configuration details

An L3Out SVI is an interface type where a Layer 3 SVI interface is configured on every border leaf switch where the SVI is deployed. When PIM is enabled on an L3Out that is configured with an SVI, the PIM protocol will be enabled on the border leaf switch that is part of the SVI. All SVIs will then form PIM adjacencies with each other and any external PIM-enabled devices.

Beginning with release 5.2(3), support is available for Layer 3 multicast on an SVI L3Out.

L3Out to firewall topology

This example shows an L3Out to firewalls topology.

L3Out to firewall topology illustrating the configuration of Layer 3 multicast on SVI L3Outs, highlighting the PIM adjacencies formed between border leaf switches and external PIM-enabled devices.

In this example, BL1 and BL2 are the border leaf switches on the fabric. Both border leaf switches are on the same SVI L3Out that connects to the external firewalls. Each firewall is connected to one of the two border leaf switches over a port-channel (non-VPC).

This topology exhibits these characteristics:

  • Each border leaf switch will form a PIM neighbor adjacency to the active firewall.

  • BL2 in the example will peer to the active firewall over the fabric tunnel for the L3Out external bridge domain.

  • The active firewall can send PIM joins/prunes to both BL1 and BL2.

  • One of the two border leaf switches will send the PIM joins towards the firewall. The border leaf switch that sends the PIM join towards the firewall is determined by the stripe winner selection for the multicast group (group and source for SSM).

  • BL2 can be selected as the stripe winner for a multicast group. BL2 in the example topology is not directly connected to the active firewall. BL1 will notify BL2 that it is the directly connected reverse path forwarding (RPF) to the source. BL2 can send the PIM via BL1. BL2 must be able to perform a recursive lookup for the IP address of the firewall. This functionality is provided by the attached-host redistribution feature. A route-map matching the firewall subnet must be configured for attached-host redistribution on the L3Out.

Another example shows an L3Out SVI to external switches or routers.

BL2 is identified as the stripe winner for a multicast group in the topology, illustrating its connection to the active firewall and the reverse path forwarding process.

With respect to the Layer 3 multicast states and multicast data traffic, these components are affected in this manner:

  • BL1, BL2, BL3, and BL4 are the border leaf switches on the fabric. All of these border leaf switches are on the same SVI L3Out that connect to the external boxes, where the external boxes could be any external switch or router.

  • Logically, the Layer 3 link is up between the border leaf switches and the external routers. So a full mesh adjacency exists with regards to unicast routing protocol(s) or PIM across the border leaf switches and the external switches/routers on the SVI L3Out.

  • Since the SVI L3Out is a bridge domain, even if there are multiple physical connections from border leaf switches to the external switches/routers, only one link among them will be up at the Layer 2 level to each external switch/router. All of the other links will be blocked by STP.

    For example, in the figure above, only these links at the Layer 2 level are up:

    • The link between BL1 and external router 1

    • The link between BL3 and external router 2

    So for all of the other border leaf switches, this makes the IP addresses 10.1.1.10 reachable only through BL1 and 10.1.1.20 reachable only through BL3.

Guidelines and limitations

An attached-host route-map must be configured for the PIM-enabled SVI L3Out. This route-map should match all directly-connected external PIM neighbors. The 0.0.0.0/0 subnet can be used.

For the Layer 3 multicast on an SVI L3Out feature, these areas are supported or unsupported:

Supported:

  • Protocol Independent Multicast (PIM) Any Source Multicast (ASM) and Source-Specific Multicast (SSM)

  • SVI with physical interfaces

  • SVI with direct port-channels (non-VPC)

  • All topology combinations:

    • Source inside receiver inside (SIRI)

    • Source inside receiver outside (SIRO)

    • Source outside receiver inside (SORI)

    • Source outside receiver outside (SORO)

Unsupported:

  • Layer 3 multicast with VPC over an SVI L3Out

  • Source or receiver hosts connected directly on the SVI subnet (source or receiver hosts must be connected behind a router on the SVI L3Out)

  • Stretched SVI L3Out between local leaf switches (ACI main data center switches) and remote leaf switches

  • Stretched SVI L3Out across sites (Cisco ACI Multi-Site)

  • SVI L3Out for PIMv6

  • Secondary IP addresses. PIM joins/prunes will not be processed if sent to the secondary IP address of the border leaf switch. Secondary IP address are typically used for configuring a shared (virtual) IP address across border leaf switches for static routing. We recommend that you use dynamic routing when configuring PIM over SVIs or create static routes to each border leaf switch primary address.

  • Floating L3Out SVIs

Configure layer 3 multicast on an SVI L3Out using the GUI

This task configures Layer 3 multicast on an SVI L3Out to enable multicast routing functionality in your network topology.

Layer 3 multicast configuration on SVI L3Outs allows for efficient multicast traffic forwarding across different network segments. This configuration is necessary when you need to establish multicast routing through a switch virtual interface.

Before you begin

Follow these steps to configure Layer 3 multicast on an SVI L3Out using the GUI:

Procedure

  1. Configure a standard L3Out using the Create L3Out wizard with SVI set as the Layer 3 interface type.

    1. In the GUI Navigation pane, under the Tenant Example, navigate to Networking > L3Outs.
    2. Right-click and choose Create L3Out.
    3. In the Create L3Out screen, in the Identity window, enter a name for the L3Out and select a VRF and L3 domain to associate with this L3Out.
    4. Click Next when you have entered the necessary information in the Identity window.

      The Nodes and Interfaces window appears.

    5. In the Nodes and Interfaces window, in the Interface Types: Layer 3 field, choose SVI as the Layer 3 interface type.
    6. Continue configuring the individual fields through the Create L3Out wizard until you have completed the L3Out configuration.

  2. Navigate to the configured L3Out:

    Tenants > tenant_name > Networking > L3Outs > L3Out_name

    The Summary page for the configured L3Out is displayed.

  3. Click on the Policy tab, then the Main subtab.

    The Properties page for the configured L3Out is displayed.

  4. In the Route Profile for Redistribution field, click + to configure a route profile for redistribution.

  5. In the Source field, choose attached-host.

  6. In the Route Map field, configure a route map that permits all.

    1. Click Create Route Maps for Route Control.

      The Create Route Maps for Route Control window is displayed.

    2. Enter a name and description for this route map, then click + in the Contexts area.

      The Create Route Control Context window is displayed.

    3. Configure the necessary parameters in the Create Route Control Context window, with the value in the Action field set to Permit.
    4. Click + in the Associated Match Rules area, then choose Create Match Rule for a Route Map to configure the match rules for this route control context.

      The Create Match Rule window is displayed.

    5. Click + in the Match Prefix area.

      The Create Match Route Destination Rule window is displayed.

    6. In the Create Match Route Destination Rule window, enter these values in these fields to configure a match rule with an aggregate route matching the subnet or 0.0.0.0/0 route and aggregate setting:

      • IP: 0.0.0.0/0

      • Aggregate: Check the box in this field. The Greater Than Mask and Less Than Mask fields appear.

      • Greater Than Mask: 0

      • Less Than Mask: 0

    7. Click Submit to configure this match route destination rule.

  7. Once you have configured a route map that permits all, configure an external EPG with an export route control subnet that does an aggregate export of the aggregate route or the 0.0.0.0/0 route.

    1. Navigate to the configured external EPG:

      Tenants > tenant_name > Networking > L3Outs > L3Out_name > External EPGs > external_EPG_name

      The Properties page for the configured L3Out is displayed. You should be in the Policy/General page by default.

    2. In the Subnets area, double-click on the 0.0.0.0/0 entry that you just configured.

      The Properties window for this configured subnet is displayed.

    3. In the Route Control area, make these selections:

      • Check the box next to the Export Route Control Subnet field.

      • In the Aggregate area, check the box next to the Aggregate Export field.

    4. Click Submit.

Layer 3 multicast is now configured on the SVI L3Out with proper route redistribution and external EPG settings for multicast routing functionality.