IGMP Snooping Configuration on Cisco Switches (CLI Guide)

Without IGMP snooping, a Layer 2 switch floods every multicast frame out of every port in the VLAN. One IPTV stream, one PTP or one video conference test and suddenly a whole floor looks like it has a broadcast storm. IGMP snooping makes the switch listen to the membership reports between hosts and their multicast router, then forwards each group only to the ports that actually asked for it. This guide covers the global and per-VLAN commands, the querier, static mrouter ports, immediate-leave for fast channel changes, and the verification commands that prove traffic is no longer flooding.

What snooping actually does

The switch snoops IGMP reports and leaves, builds a per-VLAN group table, adds the host port when it sees a report, removes it on leave or on a timeout, and learns the multicast-router port from queries and PIM hellos. Data forwarding stays in hardware, so the cost is only in control-plane bookkeeping. Snooping is on by default on most Catalyst and Nexus platforms - the interesting work is verifying it and fixing the classic "multicast stopped entirely" failure caused by the absence of a querier.

Enable and verify snooping

Switch(config)# ip igmp snooping
Switch(config)# ip igmp snooping vlan 100
Switch# show ip igmp snooping
Switch# show ip igmp snooping groups
Switch# show ip igmp snooping groups vlan 100 detail
Switch# show ip igmp snooping mrouter vlan 100

If the membership table in show ip igmp snooping groups is empty while hosts are clearly receiving streams, snooping is either disabled on that VLAN or the router port was never learned. A missing dynamic mrouter entry is the single most common cause - check that the uplink actually carries PIM hellos or IGMP queries.

Static mrouter ports and the querier

When the router port cannot be detected (for example a firewall that blocks PIM, or a third-party router that never sends general queries), pin it manually and run a querier on the switch so the VLAN still has one:

Switch(config)# ip igmp snooping vlan 100 mrouter interface GigabitEthernet1/0/1
Switch(config)# ip igmp snooping querier
Switch(config)# ip igmp snooping vlan 100 querier
Switch(config)# ip igmp snooping querier address 10.10.100.1
Switch(config)# ip igmp snooping querier query-interval 60
Switch(config)# ip igmp snooping querier max-response-time 10
Switch# show ip igmp snooping querier
Switch# show ip igmp snooping querier detail

Only one querier may be active per subnet. When the switch-querier is enabled and it detects a real multicast router sending queries, it drops back to non-querier state automatically, so enabling it globally is usually safe. If there is no IP address available on the VLAN SVI, the querier falls back to another interface's address - configure an explicit address to keep it deterministic.

Fast leave, report suppression and limits

Switch(config)# ip igmp snooping vlan 100 immediate-leave
Switch(config)# ip igmp snooping vlan 100 last-member-query-interval 5
Switch(config)# no ip igmp snooping report-suppression
Switch(config)# ip igmp snooping vlan 100 static 239.10.10.10 interface Gi1/0/20
Switch(config-if)# ip igmp max-groups 4
Switch(config-if)# ip igmp max-groups action replace | deny

immediate-leave removes a port as soon as a leave is seen instead of sending group-specific queries - use it only where a single host sits on the port, because it can prune a port that still has live members. Report suppression is on by default and hides duplicate joins, which confuses multicast troubleshooting; disable it while you debug and re-enable it afterwards. Static group entries are the escape hatch for devices that never send reports at all.

Common failure patterns

Streams work on one VLAN and not another: snooping configured on one VLAN only, or a different STP topology suppressing the mrouter port. Multicast works until the uplink flaps: the mrouter entry was dynamic and aged out - move to a static configuration. Video stutters on channel change: the last-member-query-interval is too long, or immediate-leave is missing. Raise the group limit carefully with ip igmp max-groups; on many platforms exceeding it triggers the configured action for the whole port, killing every group on that port rather than just the new one.

Where it fits in a healthy design

Keep snooping enabled on every access VLAN, mirror the querier on two switches for redundancy, and monitor the group table size on uplinks. When multicast bugs show up, verify the L2 forwarding table first, then move to Layer 3 with the multicast routing state - our PIM sparse mode configuration guide picks up where snooping ends, and loop and broadcast-storm troubleshooting covers what happens when membership tables are bypassed by a loop, while VLAN configuration and verification is the Layer 2 baseline you should confirm before adding multicast.

原文链接：https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15_2_6_e/command_reference/b_1526_2960x_cr/igmp_snooping_and_mvr_commands.html