SD Access multicast with extranet policy

[KevinR99]

Hi

Are there any special considerations needed for SD Access multicast when you’ve deployed an extranet policy.  I’m doing some testing and previously got intra-VN multicast routing working fine.  Now I have deployed an extranet policy to use the Infra VN as the provider and my Corp VN as the subscriber.  Routing is fine.  I can exit the fabric via my infra L3 handoff from the Corp VN.  However, my initial attempt at multicast is failing.  I’ve defined my Borders as the anycast RP in both the underlay and the Corp VN and am using msdp between the borders.  As an initial test I have a client (switch with join-group) configured on an SVI outside the fabric.  I then have a sender in the Corp VN.  TBH I have only done initial setup and not done any extensive troubleshooting but I’m just wondering if this is a valid setup, client outside fabric via infra and sender in the fabric in a subscriber VN or even the other way round.  Or am I trying to setup and troubleshoot something that either needs extra config or isn’t even supported?

Thanks for any input, Kev.

[Torbjørn]

There shouldn't be any special considerations to make. As long as unicast routing works for RPF and pim/lisp is otherwise setup correctly it should work fine. There are also no notes regarding this in the documentation as far as I can see. Full disclosure: I have never actually deployed inter-VRF multicast using extranet policies specifically, but I am willing to spin it up in the lab to figure it out.

Just to clarify, you have provisioned native multicast for your fabric site using the regular multicast configuration workflow? Can you share configs for the relevant nodes(edge, border, device connected to client)?

[Preston Chilcote]

As of about 6 months ago, multicast and extranet was only supported if the source,  receiver, and Rendevous Point are in the same VN.  It is very very likely this still holds true in 2.3.7.  I will ask that this caveat be added to the doc I think it belongs in:

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/catalyst-center/2-3-7/user_guide/b_cisco_catalyst_center_user_guide_237.pdf

[KevinR99]

That could be a problem.  I’ll need to do my testing.

[KevinR99]

I’ve done some testing and I can easily get multicast working within a VN and out a L3 handoff from that VN to the outside world.  However, I cannot get it working with an extranet policy where the provider is not the multicast source, receiver, RP.  I’ll flip my provider and consumer VNs around in my extranet policy to make the multicast VN the provider and infra the consumer and test but I’m thinking that will work.  So maybe I just need to reassess my extranet provider/consumer.  I’ll feed back.

Kev.

[andy!doesnt!like!uucp]

u are trying to achieve inter-vrf multicast with lisp/vxlan extranet. i'm a bit sceptic it's supported

[Torbjørn]

It seems that it still holds true. That's a good place for it - that is the doc I checked and couldn't find any limitations.

[KevinR99]

It seems strange that extranet does not support multicast properly.  If I extend my Corp VN outside the fabric that is fully supported with any combination of RP, source and receiver locations.  That relies on the underlay to carry the multicast traffic in underlay multicast before dropping the traffic in the Corp VN at the Border L3 handoff.  Not so much different from carrying my Corp traffic in underlay multicast but handing it off to the Infra L3 handoff which just so happens to be the provider in an extranet policy.  So either I will need to do no extranet policy at all and just hand off my Infra and Corp separately.  Or I use my Corp as the provider but in this case my RP, source and receivers are all in the Corp VN or reachable via the Corp L3 hand off.  So I am not using the extranet policy to cross VNs for multicast but could potentially still have extranet for Infra non-multicast traffic.  I really hope I don’t find I can’t use extranet at all with multicast.  I really want to use it but may just have to reconsider my provider/subscriber.

Hope that description makes sense.

[jedolphi]

@KevinR99 , when Extranet was released inter-VRF multicast was not supported whatsoever in C9K, not just with SDA but in general. As of this moment you can have Extranet Policy concurrently with multicast routing per SDA L3VN, but you cannot leak multicast between L3VNs with Extranet Policy. We do have some updated release notes that explain this and they should be published soon. Inter-VRF multicast via Extranet Policy is on the roadmap and if you'd like to discuss roadmap please contact your sales team. Thanks, Jerome

[andy!doesnt!like!uucp]

Hi Jerom
quick search in feature navigator shows legacy mVPN Extranet support is available on CAT9000 since 16.11.1[b]
can you confirm? 
br andy

[jedolphi]

Hi Andy, I am not a C9K platform SME, but here's the answer I got from the experts: "Multicast extranet support on the C9K is in the context of mVPN only.  Anything outside the scope of this documentation is not supported".

[KevinR99]

I've changed my setup so that I am no longer using extranet but I hand my Corp VN off on its own L3 transit. When I do multicast with the Borders defined as RP's it's all ok. I follow the workflow, select fabric RP then select my 2 Borders from a drop down as primary and secondary RP. This all works well and DNAC pushes out relevant msdp config. However, in a live site I am likely to have an external RP already in use and would want to re-use that. If I select extenal rp in the workflow it all gets configured pointing to my external rp. However, traffic doesn't flow. I have a source in the Corp VN and on an external switch, which also happens to be the RP, I have some igmp join commands on a relevant interface. On my Border connected to the interface with the join command I see (*,G) entries for my 2 groups. I believe these are generated by the join commands. I expect to also see (S,G) entries generated by the traffic coming from the source. However, I never see these and no traffic flows.  When I look on the Edge connected to the source I see (*,G) entries for the joins and (S,G) entries for the source.  However, the (S,G) entries have an OIL of Null as if the edge doesn't know where to send the traffic. 

In page 110 of the BRKENS-2820 presentation it shows a setup with an external RP but it also has msdp configured between the Borders and the external RP. With this config everything works but I haven't tested RP failover. For an external RP do I need msdp between my Borders and the external RP? I thought I could simply define the external RP address and for resilience use whatever method is currently used in the external network.

On another quick point BRKENS-2820 page 112 is confusing because it seems to suggest multicast VPN Extranet could be supported.

Kev.

[andy!doesnt!like!uucp]

i finally lost what u r trying to achieve. are u still looking for the inter-vrf multicast? if latter is the case u have to implement legacy (any kind of) mVPN Extranet outside of the fabric. f.e. Configure Inter-VRF Multicast without Unicast Inter-VRF Route Leaking - Cisco
full list of possibilities can be found here Configure mVPN Profiles Within Cisco IOS - Cisco.
you may simply merge target VRFs via extra router on stick. but in whatever case if your RP for arbitrary G is external to the fabric u need your network beyond the fabric to be configured to support multicast with respect to G.
UPD. inside the Fabric you only need to have RP(s) for MC in underlay to support overlay MC-delivery within fabric.
UPD2. for native delivery in underlay you even dont need RP(s) in the fabric https://community.cisco.com/t5/networking-knowledge-base/cisco-sd-access-multicast/ta-p/4068110#:~:text=%C2%A0Define%20the%20method%20of%20enabling%20multicast%20forwarding%20within%20the%20fabric%20site

[KevinR99]

No inter-vrf multicast anymore.  Simply multicast in my Corp VN with an external RP. The question is, does external RP need msdp as shown on page 110 of the BRKENS-2820 or can I just define the external RP.  I can only get it to work with msdp between the Borders and External device.  With simply the external device defined as RP it doesn't pass the traffic.

[andy!doesnt!like!uucp]

for the external RP in the same vrf u either rely on the already provisioned redundancy for that RP (especially if u dont manage that RP) or u may to reconfigure RP-hosting device along with overlay RPs on your BNs to make them together implement anycast RP (with MSDP of course). in the last case u'll likely need to modify DNAC-provided multicast/rp/msdp configuration for target VRF.

also didnt get "I can only get it to work with msdp between the Borders and External device." clearly. are u able to configure both site-local RP along with external RP? but even if it's the case for the msdp to operate between RP-hosting devices all of them has to refer each to other with corresponding MSDP config. meaning u have to configure MSDP also on the external RP-hosting device.