FortiGate Administration Guide - FirewallShop.com

Router Dynamic
Bi-directional Forwarding Detection (BFD)
Bi-directional Forwarding Detection (BFD)
Bi-directional Forwarding Detection (BFD) protocol is designed to deal with
dynamic routing protocols' problem of not having a fine granularity for detecting
device failures on the network and re-routing around those failures. BFD can
detect these failures on a millisecond timer, where the routing protocols can only
detect them on a second timer taking much longer to react to failures.
Your FortiGate unit supports BFD as part of OSPF and BGP dynamic networking.
It is only configurable from the CLI.
How it works
When you enable BFD on your FortiGate unit, BFD starts trying to connect to
other routers on the network. You can limit where BFD looks for routers by only
enabling one interface, and enabling BFD for specific neighboring routers on the
network.
Once the connection has been made, BFD will continue to send periodic packets
to the router to make sure it is still operational. These small packets are sent
frequently.
If BFD never connects to the router on the network, it can't report on that router
being up or down. In this situation, BFD will continue to try and connect to the
router. Until that connection is made, the device may go down and up without
notice.
If there is no response from the neighboring router within the set period of time,
BFD on your FortiGate unit declares that router down and changes routing
accordingly. BFD continues to try and reestablish a connection.
Once that connection is reestablished, routes are reset to include the router once
again.
Configuring BFD
BFD is intended for networks that use BGP or OSPF routing protocols. This
generally excludes smaller networks.
You can enable BFD for your FortiGate unit, and turn it off for one or two
interfaces. Alternatively you can specifically enable BFD for each neighbor router,
or interface. Which method you choose will be determined by the amount of
configuring for your network.
The size of your timeout period is very important. There is no easy number, as it
varies for each network and FortiGate unit. High end FortiGate models will
respond very quickly unless loaded down with traffic. Also the size of the network
will slow down the response time - packets need to make more hops than on a
smaller network. Those two factors (CPU load and network traversal time) affect
how long the timeout you select should be. With too short a timeout period, BFD
will not connect to the network device but it will keep trying. This state generates
unnecessary network traffic, and leaves the device unmonitored. If this happens
to you, try setting a longer timeout period to allow BFD more time to discover the
device on the network.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 261