Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Multicast EPG security

Updated: April 17, 2026

Want to summarize with AI?

Log in

Multicast security policies control which endpoint groups (EPGs) can send traffic to or receive traffic from a multicast group.

Multicast EPG security determines the source and destination EPGs of multicast traffic and applies the corresponding contract rules.

  • The source EPG is determined from the source of the packet.

  • The destination EPG is derived from the multicast group binding.

  • The ingress leaf switch enforces receiver access when it processes an Internet Group Management Protocol (IGMP) Join request.

Multicast group bindings

Unlike a unicast destination, a multicast group is an abstract destination that can have multiple receivers. The fabric uses a group binding to associate the multicast destination with an EPG.

  • A static binding can associate a source-and-group entry, represented as (S,G), with an EPG.

  • A static binding can associate an any-source group entry, represented as (*,G), with an EPG.

  • The multicast group and its corresponding EPG are installed in the forwarding table for forwarding and policy enforcement.

Receiver access control

A receiver must join a multicast group before it can receive the multicast stream. The fabric processes a receiver join as follows:

  1. The receiver sends an IGMP Join request for the multicast group.

  2. The ingress leaf switch identifies the receiver's EPG from the source of the IGMP packet.

  3. The leaf switch identifies the multicast destination EPG from the group binding.

  4. The leaf switch evaluates the applicable contract rules.

  5. If the policy denies the Join request, the receiver does not receive traffic from the multicast group.

Unicast and multicast policy handling

Attribute

Unicast

Multicast

Destination EPG

Determined from the packet destination.

Determined from the multicast group binding.

Source EPG

Determined from the packet source.

Determined from the packet source.

Receiver access

Contract rules are applied to the data traffic.

Contract rules are applied to the IGMP Join request at the ingress leaf switch.
Note

In this topic, a multicast stream is the traffic sent to a multicast group.