📘CCNP Enterprise – ENARSI (300-410)
1. What is BFD?
BFD (Bidirectional Forwarding Detection) is a network protocol used to quickly detect failures in the path between two routers or Layer 3 devices. It’s essentially a heartbeat mechanism that checks if a connection (or link) between two devices is working.
- Traditional routing protocols (like OSPF, EIGRP, BGP) detect failures, but they can be slow because they rely on hello timers or periodic updates.
- BFD is much faster, detecting failures in milliseconds instead of seconds.
Key idea: BFD itself does not carry routing information; it just reports whether a link is up or down. Routing protocols can use BFD to react faster when a link fails.
2. How BFD Works
BFD operates by sending small control packets between two endpoints. If a device stops receiving these packets, it considers the link down.
Two modes of operation:
- Asynchronous Mode
- Each router sends BFD packets independently.
- If one router stops receiving packets from the other, it declares the session down.
- Demand Mode
- BFD packets are sent only when requested.
- Useful for reducing traffic but still quickly detects failures.
Timers in BFD:
- Transmit interval: How often a router sends BFD packets.
- Detection multiplier: Number of missed BFD packets before declaring the link down.
Example calculation:
If the transmit interval is 50 ms and the detection multiplier is 3, the failure will be detected in:
50 ms × 3 = 150 ms
This is much faster than typical routing protocol timers, which are often in seconds.
3. Why BFD is Important
- Fast convergence:
- When a link fails, BFD informs the routing protocol immediately.
- The routing protocol can then reroute traffic quickly.
- Protocol-independent:
- Works with OSPF, EIGRP, IS-IS, BGP, and static routes.
- Low overhead:
- BFD packets are very small, so they don’t use much bandwidth.
- Scalable:
- Can monitor multiple sessions without much CPU load.
4. BFD in Action
Here’s a simplified IT example:
- You have two routers, R1 and R2, connected via a Layer 3 link.
- Both routers run OSPF. Normally, OSPF detects a failure based on hello/dead intervals (often 10–40 seconds).
- If the link fails, traffic can be dropped until OSPF reconverges.
With BFD enabled:
- R1 and R2 exchange BFD packets every 50 ms.
- If R1 stops receiving BFD packets from R2 for 3 intervals (150 ms), it immediately informs OSPF that the link is down.
- OSPF recalculates the best path much faster, reducing downtime drastically.
5. BFD Deployment Options
BFD can operate in two ways depending on the type of interface:
A. Directly on Physical Interfaces
- The routers exchange BFD packets over a single physical link.
- Fastest and simplest method.
B. Over a Multipoint or Tunnel Interface
- Can also be used with MPLS LSPs, GRE tunnels, or other virtual interfaces.
- BFD detects failures even if the physical interface is fine but the tunnel or path fails.
6. BFD Timers and Tuning
Exam-relevant details:
- Minimum interval: 50 ms
- Detection multiplier: Usually 3–5
- Example:
R1(config)# bfd interval 50 min_rx 50 multiplier 3 - Lower intervals = faster detection but slightly higher CPU use.
- Higher intervals = slower detection, less CPU impact.
Best practice: For critical links, use aggressive timers (low intervals) to minimize downtime.
7. BFD with Routing Protocols
BFD doesn’t replace routing protocols; it enhances them:
| Routing Protocol | BFD Role |
|---|---|
| OSPF | Triggers fast adjacency failure |
| EIGRP | Triggers fast neighbor failure |
| BGP | Triggers fast session down detection |
| IS-IS | Detects link failures quickly |
Important exam note: Some protocols, like OSPF over NBMA, require additional configuration to fully leverage BFD.
8. Exam Tips
- BFD accelerates failure detection, but doesn’t replace routing protocols.
- BFD uses small control packets and can work over physical or virtual interfaces.
- Key parameters to know for the exam:
- Interval (ms)
- Detection multiplier
- Modes: asynchronous vs. demand
- BFD must be enabled on both ends of a link.
- It’s often used in conjunction with OSPF, EIGRP, IS-IS, and BGP for faster convergence.
✅ Summary in Simple Terms
- BFD = heartbeat for routers.
- Detects link failures much faster than routing protocols alone.
- Works with all major routing protocols.
- Small packets, low CPU, fast reaction.
- Timers and multiplier determine how quickly failure is detected.
With BFD, network convergence happens in milliseconds, keeping IT systems highly available.
