DNAC 2.3.7.6 new multicast features?

[Andrii Oliinyk]

noticed DNAC preparing config like below which affecting some multicast applications in the overlay. cannot find it in any RNs. currently it looks like this only fixable via Day-N template with allowing affected subnets with ACE in ACL. Anybody can explain details on this configuration?
interface L2LISP0
ip access-group SDA-FABRIC-LISP in
ip access-group SDA-FABRIC-LISP out
exit
ip access-list extended SDA-FABRIC-LISP
10 deny ip any host 224.0.0.22 //deny IGMPv3
20 deny ip any host 224.0.0.13 //deny PIM routers
30 deny ip any host 224.0.0.1 //deny all hosts
40 permit ip any any

[Andrii Oliinyk · Accepted solution]

not new actually... CSCvx70122 : Bug Search Tool

Some of the things to note:-

• We are not automating ACL push on devices < 17.6
• Once a customer upgrades DNAC to the release where the fix goes, a banner would be shown indicating the new behavior.
• If the banner is not yet accepted:
• ◦            A customer can add devices < 17.6 to the fabric. We wont be pushing any ACLs on these devices
• ◦            For newly added devices >=17.6, we will be pushing the ACL and apply the ACL on the LISP interface
• ◦            The devices which are upgraded to 17.6 wont get the new configs till the banner is accepted.
• Once the banner is accepted:
• ◦            All the devices must be able to support the new CLI, meaning all devices must have 17.6 This triggers a push on new clis on all devices.
• For Greenfield scenarios, we will always show a banner. Devices below 17.6 can be added to the fabric as long as the banner is not accepted.
  
  
• removable with network template

[Andrii Oliinyk]

well, i understand the point to block PIM-routers but still didnt got n idea behind IGMPv3 & all-hosts-on-link...

[jedolphi]

Hi Andy, the blocked addresses came from TAC escalation team. Offhand I don't know exactly what problems lead to this, but the blocks are in response to real problems that have been seen in multiple customer networks. Regards, Jerome