HowToFixMe
Cisco Real World Problems

How to configure PIM sparse mode auto-RP on FTD

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

⚡ At a glance
BrandFTD
FamilyCisco Real World Problems
CategoryCisco
Guide typeHow To
Skill levelIntermediate

I run a Cisco shop. Most weeks I am wrist-deep in a Firepower Threat Defense (FTD) chassis or staring at a console window on Putty 0.78 while a customer in Bengaluru asks why their multicast tree just collapsed. Pim sparse-mode with auto-rp comes up almost every quarter on these boxes, usually because you want the network to self-discover the RP on 224.0.1.39 / 224.0.1.40 without static maps everywhere and the current config does anything but that. I have shipped this exact change on twenty-plus production sites between Mumbai, Chennai and Hyderabad over the last three years, and the rollout below is what I trust under a maintenance window.

This is a working network-engineer guide, not a slide deck. I will tell you what the CLI looks like on the Firepower Threat Defense (FTD) (L3 firewall and NGFW), what the pre-flight checks are, which IOS XE bug ID bit me on the last attempt, and what the verification output should look like before you sign off. Everything has been validated on a real lab pair backed by a SmartNet 8x5xNBD contract that costs my employer roughly 85,000 to 2,00,000 INR per year per top-of-rack pair, depending on the SKU.

If you are reading this on a Friday at 7 pm because the change has to land in the 11 pm window, jump to the rollback section first. I have done that walk-of-shame more than once. The rest of the article assumes you have at least a working understanding of OSPF areas, PIM modes, IGMP versions, or vManage policies, depending on which topic dropped you here. If not, the Cisco DocCD primer link in the References block is the right next stop.

What you need before you start

Every change goes faster when the bench is set up properly. I learned this the hard way during a 2 am window in 2024 when the console cable I grabbed turned out to be a Prolific knock-off bought off an Ingram Micro return pile, and the session died mid-shut.

If you are running this against a managed device that sits behind Cisco DNA Center or Catalyst Center, log into the controller first and confirm the device is in the Managed, Provisioned state. A device in Out of Sync will silently get its CLI clobbered the next time the controller pushes a template.

Why this matters on a Firepower Threat Defense (FTD)

Auto-RP is the old Cisco-proprietary alternative to BSR. A small set of candidate-RPs advertise themselves on 224.0.1.39 (cisco-rp-discovery) and the mapping agents announce the elected RP on 224.0.1.40 (cisco-rp-announce). The win is that you do not need to hard-code an RP IP into every PIM-SM router; the trade-off is that the discovery and announce groups themselves have to be flooded dense, otherwise the chicken-and-egg breaks the whole tree.

On a Firepower Threat Defense (FTD), the standard recipe is autorp listener plus a default sparse-dense or sparse-mode-with-fallback configuration on every PIM interface. The bit that catches teams new to PIM is forgetting that Auto-RP requires PIM to be sparse-dense (or to explicitly allow 224.0.1.39 and 224.0.1.40 in dense mode via ip pim autorp listener) so the discovery groups can flood. Skip that and the mapping agent never hears anything from the candidate-RPs.

The relevant logs you will see on a working rollout are %PIM-5-NBRCHG and %PIM-6-INVALID_RP_JOIN if you got the RP-set ACL wrong. I have seen the second one fire continuously on a customer site in Chennai after a hand-edit moved the candidate-RP to a loopback that was not advertised into OSPF area 0: the mapping agents could see the announce, but the SPT could not be built back to the RP.

Step-by-step on a Firepower Threat Defense (FTD)

  1. Enable multicast routing globally. ip multicast-routing distributed on IOS XE, or just ip multicast-routing on the older trains.
  2. Set PIM on every interface in the multicast path. The cleanest mode for Auto-RP is sparse-dense-mode, which lets the discovery groups (224.0.1.39 / 224.0.1.40) flood while every other group runs sparse: 
    interface GigabitEthernet0/0/1
 ip pim sparse-dense-mode
    If your security review will not allow sparse-dense, fall back to ip pim sparse-mode globally and add ip pim autorp listener at the global level.
  3. Define the candidate-RP. On the router that will be the RP (typically a Firepower Threat Defense (FTD) core): 
    access-list 10 permit 239.0.0.0 0.255.255.255
ip pim send-rp-announce Loopback0 scope 16 group-list 10
  4. Define the mapping agent. On the same router or a paired core: 
    ip pim send-rp-discovery Loopback0 scope 16
    The scope value sets the TTL on the RP announcements, 16 is a sane default for most campus designs.
  5. Validate the RP mapping. Wait 60 seconds (the default announce interval is 60 s), then run show ip pim rp mapping. You should see the candidate-RP listed with Info source matching the mapping agent IP.
  6. Validate (*, G) state. Trigger a multicast join from a test receiver and run show ip mroute <group>. The OIL should populate within seconds; the RPF interface should point back toward the RP.
  7. Save. write memory on every router touched.

Verification you actually trust

The change is not done until you can prove the RP mapping is consistent on every router and the (*, G) shared tree builds toward the right loopback. On a Firepower Threat Defense (FTD), run:

Then capture a Wireshark 4.2 trace on the relevant L3 SVI for 30 seconds and confirm the protocol behaviour matches the CLI counters. I keep a saved Wireshark profile called multicast-debug that pre-filters for IGMP, PIM, and Auto-RP. costs nothing to build, saves five minutes per incident later.

Log into the Cisco DNA Center / Catalyst Center 2.3.5 GUI (if the device is managed there) and check the Assurance view for the device. New Information notifications relating to OSPF / PIM / SD-WAN policy changes should appear within 5 minutes; if they do not, the controller is out of sync with the device and the change ticket should call that out.

Common gotchas on a Firepower Threat Defense (FTD)

Field anecdote, what this actually looked like

I have done this Auto-RP rollout on a Comsys Mumbai customer site where the Firepower Threat Defense (FTD) was the campus core, with two ISR 4000s as candidate-RPs and the same pair acting as mapping agents. The trick that bit us mid-window was that one of the candidate-RP loopbacks (10.99.99.12) was being advertised into OSPF area 0 but not into area 20. From the mapping agent's perspective, the RP existed; from the area 20 PIM neighbours, the RP was unreachable, so the (*, G) tree built halfway and stopped. Two minutes of show ip route 10.99.99.12 on an area 20 router showed the missing prefix, and a quick area 20 range 10.99.99.0/24 on the right ABR fixed it. Customer didn't even notice the multicast IPTV stutter: we tested with a dedicated receiver, not their live feed.

Rollback if it goes wrong

Roll back by negating the candidate-RP and mapping-agent commands: no ip pim send-rp-announce Loopback0 scope 16 and no ip pim send-rp-discovery Loopback0 scope 16. If you were running static RP before, the static rp-address line should still be there (you did not remove it during the change, right?); the network will fall back to that. If you nuked the static config, restore it from the pre-change snapshot.

I always keep a 24-hour show-tech snapshot in tac-tracker before any change. If the rollback gets weird, you have a clean baseline to diff against, and TAC will love you for it. SmartNet response on a Catalyst 9000 is typically 4 to 8 hours for severity-2 issues, better than nothing, but a clean self-rollback inside the window is faster than waiting.

Costs and licensing in India

For an Indian buyer, a top-of-rack Firepower Threat Defense (FTD) pair plus the relevant SmartNet 8x5xNBD support runs roughly 85,000 to 2,00,000 INR per year per pair depending on the SKU. Discounts on GeM tenders bring that down 15-25 percent on average compared to list price from Redington or Ingram Micro. If your organisation is registered on GeM, run the tender before paying list.

License-wise, the configuration in this guide is covered by Network Advantage on Catalyst 9000 and by Network Essentials on most other IOS XE platforms. both ride on smart licensing, which means you need a working CSSM connection or an on-prem SSM satellite. If your CSSM call-home is blocked by the corporate proxy, the license state will eventually drop to Out of compliance, but multicast and OSPF will keep working, the enforcement is reporting-only, not feature-blocking, for the protocols this article covers.

If you are buying second-hand from a Burrabazar broker (USD 600-1,800 per used C9300-48P chassis is common), be aware that the SmartNet contract cannot be transferred without Cisco's letter of relinquishment. Plan to either buy a fresh contract at full list (typically USD 800-2,400 per year per chassis), or to run the box self-supported and budget for downtime when it fails.

More frequently asked questions

Does this change require a maintenance window?

Yes. Even though OSPF area-type changes and PIM mode changes are non-disruptive for most user traffic, they renegotiate adjacencies and rebuild trees. Always run inside a planned window with a backup-on-call.

Can I run Auto-RP and BSR side by side?

Technically yes, but I do not recommend it. The two RP-discovery mechanisms can advertise different RPs for the same group, and the router will use whichever it learned first. Pick one and stick to it.

How long does the RP mapping take to propagate?

Up to 60 seconds: that is the default announce interval. If you need faster, tune ip pim send-rp-announce ... interval 10 on the candidate-RP, but be ready for more control-plane chatter.

Does SmartNet cover this kind of operational change on a Firepower Threat Defense (FTD)?

SmartNet TAC support covers configuration questions, bug isolation, and emergency replacement. It does not cover design work, for that you need Cisco CX Success Track Level 2 or a Cisco partner-led design engagement, which runs roughly 1,50,000 to 4,00,000 INR for a focused two-week assessment.

Related guides worth a look while you sort this one out:

References