Config Router

  • Google Sheets
  • CCNA Online training
    • CCNA
  • CISCO Lab Guides
    • CCNA Security Lab Manual With Solutions
    • CCNP Route Lab Manual with Solutions
    • CCNP Switch Lab Manual with Solutions
  • Juniper
  • Linux
  • DevOps Tutorials
  • Python Array
You are here: Home / Juniper / BFD Not Coming Up Over CGNAT Configured Interfaces

BFD Not Coming Up Over CGNAT Configured Interfaces

June 21, 2016 by Marques Brownlee

Bidirectional Forwarding Detection (BFD) fails to establish a session when the transmit/receive hello intervals are set at very low values on traffic that is evaluated by a service-set. This article explains how to configure the firewall filter to skip the BFD packets from being evaluated by the service-set.

If the BFD traffic does not have to be NAT’d, we can create a service-filter so that the BFD traffic is not evaluated by the service-set, and avoids any potential latency. In cases where BFD must be NAT’d, then the minimum-interval may need to be increased if the firewall is found to be the source of latency .

By default, when you apply a service-set on an interface which is known as interface-style service sets, all the traffic that hits that interface will be sent to the service-set to be reviewed by the NAT rule.
Sending BFD packets to be evaluated by the service-set causes a delay if the stateful firewall is busy, which can cause the BFD session from being established, since the hello timers of BFD are very sensitive.

BFD can fail to establish the session when the transmit/receive hello intervals are set at very low interval values on traffic that is evaluated by a service-set.

set protocols bgp group EBGP_TO_MAIN bfd-liveness-detection minimum-interval 50
set protocols bgp group EBGP_TO_MAIN bfd-liveness-detection multiplier 3

Configure the following firewall filter to prevent the BFD packets from being evaluated by the service-set:

[email protected]# show firewall | display set 
set firewall family inet service-filter BFD_SKIP term 1 from protocol udp
set firewall family inet service-filter BFD_SKIP term 1 from port 3784
set firewall family inet service-filter BFD_SKIP term 1 from port 4784
set firewall family inet service-filter BFD_SKIP term 1 then skip
set firewall family inet service-filter BFD_SKIP term 2 then service

[email protected]# show interfaces lt-0/0/0 | display set | grep "service-set" 
set interfaces lt-0/0/0 unit 2 family inet service input service-set PRIVATE_NAT service-filter BFD_SKIP
set interfaces lt-0/0/0 unit 2 family inet service output service-set PRIVATE_NAT service-filter BFD_SKIP

 

Related

Filed Under: Juniper Tagged With: BFD, Bidirectional Forwarding Detection, CGNAT

Recent Posts

  • How do I give user access to Jenkins?
  • What is docker volume command?
  • What is the date format in Unix?
  • What is the difference between ARG and ENV Docker?
  • What is rsync command Linux?
  • How to Add Music to Snapchat 2021 Android? | How to Search, Add, Share Songs on Snapchat Story?
  • How to Enable Snapchat Notifications for Android & iPhone? | Steps to Turn on Snapchat Bitmoji Notification
  • Easy Methods to Fix Snapchat Camera Not Working Black Screen Issue | Reasons & Troubleshooting Tips to Solve Snapchat Camera Problems
  • Detailed Procedure for How to Update Snapchat on iOS 14 for Free
  • What is Snapchat Spotlight Feature? How to Make a Spotlight on Snapchat?
  • Snapchat Hack Tutorial 2021: Can I hack a Snapchat Account without them knowing?

Copyright © 2023 · News Pro Theme on Genesis Framework · WordPress · Log in