To improve the convergence times of a routing protocol, BFD can be used. This feature monitors the adjacencies using some kind of ping packets. It detects link failures much faster than the routing protocol’s built-in keepalive timeouts.
The interesting part: You must only enable BFD rather than configure it in detail. The BFD peers are derived from the routing protocol’s adjacencies, e.g. the OSPF neighbours. Let’s have a look:
For this example, I’m using a PA-440 with PAN-OS 11.2.12, ARE/LR enabled. The adjacent routers are 2x other Palos (one via 2x VPNs) and a Cisco router 2811, IOS Version 15.1(4)M12a. OSPF for legacy IP and OSPFv3 for IPv6 are used.
Enabling BFD
I’m using the default BDF profile with a 1000 ms interval and a multiplier of 3. This profile is referenced in the OSPF/OSPFv3 global settings, while the OSPF-enabled interfaces only inherit those global settings:
Verifying BFD
When new BFD peers appear, you’ll see such entries in the system log:
You can further investigate the BFD peers at the “More Runtime Stats” of the logical router:
Session details:
Just another example: These are the logs that were generated during a reboot of the Cisco router (dual-stack, hence 1x IPv4 and 1x IPv6 neighbour/peer). That is: everything went down and up again:
And by the way, this is the plus of traffic through those BFD packets, measured by Checkmk. (Before I enabled BFD, it was only the Palo’s tunnel monitor on this VPN.) [Note that the IF-MIB counters for tunnel interfaces on a Palo have a well-known feature bug, which doubles the incoming packet counters due to the tunnel inspection. 🤦 Anyway:]
Those who prefer the CLI can use the following commands: show advanced-routing bfd summary, show advanced-routing bfd details interface <interface-id>, show counter global | match bfd.
Examples:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 |
weberjoh@pa-home> show advanced-routing bfd summary SESSION ID: 8 Interface: tunnel.12 Logical Router: default (id:1) Local IP Address: 172.16.12.2 Neighbor IP Address: 172.16.12.1 Discriminator (local/remote): 0x11919912 / 0x88e9b610 State: up rState: up Up Time: 1d 20h 5m 32s 580ms Agent DP: Slot 1 - DP 0 Errors: 0 SESSION ID: 9 Interface: tunnel.11 Logical Router: default (id:1) Local IP Address: 172.16.11.2 Neighbor IP Address: 172.16.11.1 Discriminator (local/remote): 0xd52c54a3 / 0x3ab549a2 State: up rState: up Up Time: 1d 1h 13m 57s 380ms Agent DP: Slot 1 - DP 0 Errors: 0 SESSION ID: 10 Interface: ae1.3 Logical Router: default (id:1) Local IP Address: fe80::3efa:30ff:fe03:1230 Neighbor IP Address: fe80::3efa:30ff:fe04:9110 Discriminator (local/remote): 0x56ff3040 / 0x76d269fb State: up rState: up Up Time: 0d 4h 13m 39s 160ms Agent DP: Slot 1 - DP 0 Errors: 0 SESSION ID: 11 Interface: ae1.3 Logical Router: default (id:1) Local IP Address: fe80::3efa:30ff:fe03:1230 Neighbor IP Address: fe80::21e:7aff:fe79:3f10 Discriminator (local/remote): 0x16c15553 / 0x5 State: up rState: up Up Time: 0d 4h 13m 39s 410ms Agent DP: Slot 1 - DP 0 Errors: 0 SESSION ID: 12 Interface: ae1.3 Logical Router: default (id:1) Local IP Address: 192.168.3.1 Neighbor IP Address: 192.168.3.99 Discriminator (local/remote): 0xbd09e624 / 0x6 State: up rState: up Up Time: 0d 4h 13m 38s 980ms Agent DP: Slot 1 - DP 0 Errors: 1 SESSION ID: 14 Interface: ae1.3 Logical Router: default (id:1) Local IP Address: 192.168.3.1 Neighbor IP Address: 192.168.3.2 Discriminator (local/remote): 0x51cd3a0d / 0x5ec5faee State: up rState: up Up Time: 0d 4h 13m 38s 810ms Agent DP: Slot 1 - DP 0 Errors: 0 weberjoh@pa-home> weberjoh@pa-home> weberjoh@pa-home> show advanced-routing bfd details interface ae1.3 BFD Session ID: 10 Version: 1 Interface: ae1.3 Protocol: OSPFv3 Local IP Address: fe80::3efa:30ff:fe03:1230 Neighbor IP Address: fe80::3efa:30ff:fe04:9110 BFD profile: default State (local/remote): up / up Up Time: 0d 4h 16m 22s 570ms Discriminator (local/remote): 0x56ff3040 / 0x76d269fb Mode: Active Demand Mode: Disabled Poll Bit: Disabled Multihop: Disabled Multihop TTL: 255 Local Diag Code: 0 (No Diagnostic) Last Received Remote Diag Code: 0 (No Diagnostic) Transmit Hold Time: 0ms Desired Min Tx Interval: 1000ms Required Min Rx Interval: 1000ms Received Min Rx Interval: 1000ms Negotiated Transmit Interval: 1000ms Detect Multiplier: 3 Received Multiplier: 3 Detect time (exceeded): 3000ms (0) Tx Control Packets (last): 17576 (44ms ago) Rx Control Packets (last): 17587 (843ms ago) Agent DP: Slot 1 - DP 0 Errors: 0 Last Recieved Packet: Version: 1 My Discriminator: 0x76d269fb Your Discriminator: 0x56ff3040 Diag Code: 0 (No Diagnostic) Length: 24 Demand bit: 0 Poll bit: 0 Final bit: 0 Multipoint: 0 Control Plane Independent: 1 Authentication Present: 0 Desired Min Tx Interval: 1000ms Required Min Rx Interval: 1000ms Detect Multiplier: 3 Required Min Echo Rx Interval: 0ms [...] weberjoh@pa-home> weberjoh@pa-home> weberjoh@pa-home> show counter global | match bfd flow_bfd_accept 2005679 6 info flow bfd BFD packet acceptted flow_bfd_error 20 0 drop flow bfd BFD packet enqueue error flow_bfd_rx 2005699 6 info flow bfd BFD packet received flow_bfd_rx_err 10 0 drop flow bfd BFD packet receive error flow_bfd_rx_qos_0 2005699 6 info flow bfd BFD packet received for qos 0 flow_bfd_tx 2007301 7 info flow bfd BFD packet transmitted flow_bfd_tx_err 1 0 drop flow bfd BFD packet tx error flow_bfd_tx_fail 5 0 drop flow bfd BFD packet tx failed flow_bfd_tx_l2 1 0 drop flow bfd BFD packet tx layer 2 error flow_bfd_not_found 18 0 drop flow bfd BFD packet rx not found flow_bfd_flow_session 31 0 info flow bfd BFD packet create Flow session weberjoh@pa-home> |
And for the sake of completeness, this is the view from the Cisco router:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 |
R1#show bfd neighbors NeighAddr LD/RD RH/RS State Int 10.23.0.2 3/1 Up Up Fa0/1 192.168.3.1 6/-1123424732 Up Up Fa0/0 192.168.3.2 2/-1270998408 Up Up Fa0/0 FE80::21A:6CFF:FEA1:2B98 4/2 Up Up Fa0/1 FE80::3EFA:30FF:FE03:1230 5/381769043 Up Up Fa0/0 FE80::3EFA:30FF:FE04:9110 1/316964720 Up Up Fa0/0 R1# R1# R1#show bfd neighbors details NeighAddr LD/RD RH/RS State Int 192.168.3.1 6/-1123424732 Up Up Fa0/0 Session state is UP and not using echo function. OurAddr: 192.168.3.99 Local Diag: 0, Demand mode: 0, Poll bit: 0 MinTxInt: 999000, MinRxInt: 999000, Multiplier: 3 Received MinRxInt: 1000000, Received Multiplier: 3 Holddown (hits): 2448(0), Hello (hits): 1000(18082) Rx Count: 18122, Rx Interval (ms) min/max/avg: 1/1000/873 last: 552 ms ago Tx Count: 18083, Tx Interval (ms) min/max/avg: 24/1004/879 last: 656 ms ago Elapsed time watermarks: 0 0 (last: 0) Registered protocols: OSPF Uptime: 04:24:37 Last packet: Version: 1 - Diagnostic: 0 State bit: Up - Demand bit: 0 Poll bit: 0 - Final bit: 0 Multiplier: 3 - Length: 24 My Discr.: -1123424732 - Your Discr.: 6 Min tx interval: 1000000 - Min rx interval: 1000000 Min Echo interval: 0 NeighAddr LD/RD RH/RS State Int FE80::3EFA:30FF:FE03:1230 5/381769043 Up Up Fa0/0 Session state is UP and not using echo function. OurAddr: FE80::21E:7AFF:FE79:3F10 Local Diag: 0, Demand mode: 0, Poll bit: 0 MinTxInt: 999000, MinRxInt: 999000, Multiplier: 3 Received MinRxInt: 1000000, Received Multiplier: 3 Holddown (hits): 2760(0), Hello (hits): 1000(18064) Rx Count: 18120, Rx Interval (ms) min/max/avg: 1/1000/876 last: 244 ms ago Tx Count: 18066, Tx Interval (ms) min/max/avg: 20/1008/878 last: 788 ms ago Elapsed time watermarks: 0 0 (last: 0) Registered protocols: OSPFv3 Uptime: 04:24:38 Last packet: Version: 1 - Diagnostic: 0 State bit: Up - Demand bit: 0 Poll bit: 0 - Final bit: 0 Multiplier: 3 - Length: 24 My Discr.: 381769043 - Your Discr.: 5 Min tx interval: 1000000 - Min rx interval: 1000000 Min Echo interval: 0 [...] |
Further Reading
Some Wireshark screenshots of BFD packets are here. If you want to look at them by yourself, please download and use the Ultimate PCAP.
Soli Deo Gloria!
Photo by Rosie Steggles on Unsplash.