Course contents

Module 3: Stability and SecurityLesson 3.3 (3 of 3 in this module)9 of 11 in the Advanced BGP course

BFD and fast convergence

Detecting a failed neighbour in milliseconds instead of minutes.

Advanced · 15 min read

You'll learn to configure BFD for a BGP neighbour, calculate detection time, and explain why very short timers can cause flaps.

Waiting for a timer is slow

With default timers, R1 notices a silent neighbour only when the 180-second hold timer expires. If the link fails without the interface going down, for example through a provider switch, traffic is lost for up to three minutes. Bidirectional Forwarding Detection (BFD) is a small, fast hello protocol that detects forwarding failures in milliseconds and tells BGP.

Where BGP failure detection time goes
Where BGP failure detection time goesWithout BFD a silent failure is found only when the hold timer expires.Failurelink or path stopspassing trafficDetectionhold timer (180 s)or BFD (under 1 s)BGP reactssession closes,paths withdrawnForwardingmoves to thebackup path

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The hold timer is minutes long. BFD brings detection down to a fraction of a second.
Failure detection time: BGP timers against BFD
Failure detection time: BGP timers against BFDWith default BGP timers a dead neighbour is noticed after up to 180 seconds. BFD with 300 ms intervals and multiplier 3 notices in about 900 ms.failureBFD: ~0.9 sBGP hold timer alone: up to 180 stime

On small screens, swipe sideways or focus the diagram and use the arrow keys.

BFD is a separate, very light protocol that BGP asks for a verdict. When BFD says the path is down, BGP drops the session at once.
BFD finds a failed link before the BGP hold timer
BFD finds a failed link before the BGP hold timerR1 and R2 share a link and a BGP session. BFD sends a fast hello every 300 milliseconds, and with a multiplier of 3 it declares the neighbour down after about 900 milliseconds without a reply. BGP on its own waits for the hold timer, which is 180 seconds by default. When BFD reports the failure it tells BGP, which closes the session and starts moving traffic immediately.R1192.0.2.2R2192.0.2.1BGP session + BFD hellosWith BFDfailure found in about 900 msWithout BFDfailure found after up to 180 s (hold timer)neighbor 192.0.2.1 fall-over bfd

On small screens, swipe sideways or focus the diagram and use the arrow keys.

BFD does not replace BGP. It is a fast failure detector that BGP listens to. Without it, a link that fails silently can keep traffic going into a dead path for minutes.

Configure it

interface GigabitEthernet0/0 bfd interval 300 min_rx 300 multiplier 3 router bgp 64500 neighbor 192.0.2.1 fall-over bfd

R1. The interface sets the BFD timers. fall-over bfd tells BGP to drop the session as soon as BFD declares the neighbour down. ISP A must run BFD on its side too.

Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show bfd neighbors
NeighAddr          LD/RD     RH/RS     State   Int
192.0.2.1          1/1       Up        Up      Gi0/0
State Up on both sides means the BFD session is running. If it shows Down, check that both routers have matching timers or that a firewall is not blocking UDP port 3784.

When BFD brings the session down, BGP withdraws the routes and the best-path algorithm moves to the next path at once. Combine BFD with a tested backup path from the failover lab so there is something to fail over to.

Technical reference: RFC 5880 (BFD). Output above is illustrative.

How BFD works

BFD is a small, separate protocol. Two routers exchange short control packets at an agreed interval over UDP. Each side states how often it will send and how often it can receive, and the slower of the two settings is used. If a router stops hearing packets for the multiplier number of intervals, it declares the path down.

BGP registers with BFD as a client. When BFD declares the neighbour down, it tells BGP at once, and BGP closes the session without waiting for the hold timer.

A BFD session between two BGP neighbours
A BFD session between two BGP neighboursBGP registers as a client, BFD exchanges control packets, and on a miss BFD tells BGP to drop the session.BGPasks BFD to watchthe neighbourBFDexchanges packetsevery 300 ms3 misses900 ms of silenceBGPsession down,paths withdrawn

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Detection time is the interval multiplied by the multiplier.

Choosing the timers

Faster is not always better. A short interval detects failure sooner, but a busy router or a brief burst of loss can look like a failure and bring a healthy session down. The usual approach is to pick a conservative interval, observe the network for flaps, and tighten only where the benefit is needed.

Detection time for common settings
Detection time for common settingsDetection time equals interval times multiplier. Hardware support limits how small the interval can be.300 ms x 3900 ms: a common starting point1000 ms x 33 seconds: safe on congested or software-forwarded links50 ms x 3150 ms: only where the platform supports it in hardwareNo BFDUp to the 180 second hold time

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Pick the slowest setting that still meets the recovery target.

Check your understanding

Predict · scenario 1

BFD uses interval 300 ms and multiplier 3. What is the detection time?

Predict · scenario 2

Which BGP command links the session to BFD?

Predict · scenario 3

Why can very short BFD timers be a problem?

FAQ

How is detection time calculated?
Interval times multiplier. With 300 ms and a multiplier of 3 the detection time is 900 ms.
Does BFD replace BGP keepalives?
No. BGP still has its own timers. BFD tells BGP quickly when the forwarding path to the neighbour has failed.
Can BFD be too aggressive?
Yes. If the path or the CPU cannot keep up, short timers produce false failures and flapping sessions. Start conservative and test under load.