Troubleshooting Tip: Troubleshooting BGP sessions flapping every hour (3600 Seconds)

Description

This article describes how to troubleshoot and resolve BGP sessions that are flapping over tunnels on FortiGate devices. BGP sessions may flap due to network instability, tunnel-related issues, or configuration problems such as incorrect BGP timer settings.

Scope

FortiGate.

Solution

Troubleshooting steps:

Step 1: To establish a BGP neighborship, verify end-to-end connectivity to the peer by testing reachability to the configured neighbor IP address. The neighbor IP must be reachable for the BGP session to form. Keep in mind that ICMP responses may be disabled on the remote peer, so a failed ping does not necessarily indicate a connectivity issue. If ping results are inconclusive, perform packet captures or traffic sniffing on the remote peer to confirm whether traffic is being received and transmitted.

execute ping <neighbor_IP-address>

Step 2: Verify the neighbor adjacency state:

get router info bgp summary
get router info bgp network

Step 3: Collect BGP debug logs:

diagnose debug disable
diagnose debug reset
diagnose debug duration 300
diagnose debug console timestamp enable
diagnose ip router bgp all enable
diagnose ip router bgp level info
diagnose debug enable

Stop collecting debug logs:

diagnose debug disable
diagnose debug reset

Collect debug output for one particular BGP neighbor:

diagnose debug disable
diagnose debug reset
diagnose debug duration 300
diagnose debug console timestamp enable
diagnose ip router bgp all enable
diagnose ip router bgp level info
diagnose ip router bgp set-filter neighbor <neighbor_IP-address>
diagnose debug enable

After it completes, disable the debug processes:

diagnose debug disable
diagnose debug reset

Step 4: Capture BGP traffic:

diagnose sniffer packet any "host <BGP Peer IP> and port 179" 6 0 l

This capture helps verify whether BGP keepalive and update packets are being exchanged successfully between peers.

Verify BGP timer configuration.

Review the BGP configuration and confirm that the keepalive timer is not set to 0.

config router bgp
    set keepalive-timer 0
        config neighbor
            edit "<BGP Peer IP>"
                set keep-alive-timer 0
            next
        end
    end

Causes of the hourly flapping:

When the BGP keepalive timer is configured as 0, keepalive messages are disabled. In this scenario, BGP relies entirely on the underlying TCP session to detect failures.

Since the default TCP timeout is 3600 seconds, the BGP session may drop and re-establish at roughly one-hour intervals, resulting in periodic BGP flapping.

Configure the keepalive timer with a non-zero value in the range 0 - 65535 seconds. The default global value is 60 seconds.

Example:

Global BGP configuration:

config router bgp
    set keepalive-timer 60
end

Or configure it per-neighbor:

config router bgp
    config neighbor
        edit "<BGP Peer IP>"
            set keep-alive-timer 60
        next
    end
end

After updating the configuration, verify that the keepalive value is being updated:

get router info bgp neighbors <BGP Peer IP>

Monitor the BGP sessions to ensure they remain established and stable. Verify that periodic keepalive messages are being exchanged between peers and confirm that the hourly session resets no longer occur as a result of TCP timeout reliance.