bgp fine tuning question

Question

hii have 2 fortigates that are linked with 2 point to point lines between them.each p2p line is from another isp for redundancy. main line is 100mbps and backup line from 2nd isp is 40mbpsi've setup a bgp, i control bgp on both sides. everything is working fine. on a regular basis, the main line works, and i fail the main line, a route failover occur and it flips to the backup line. with local preference on both sides, when the main line comes back up, it fails back to it.  my problem/question is that the failover/failback is quite long.i know i'm supposed to "play" with : holdtimer, graceful restart and graceful-stalepath the holdtimer part i understand, it's explained simply and understood. it states the time to "declare" the path dead and look for another one. but i didn't quite get the last two. i'm looking for the best practice to my situation, bare in mind i'm controlling both ends, no isp bgp is involved here. thank you

Yurisk · Answer

Graceful-anything is the opposite of what you are trying to achieve. Graceful restart, once enabled, tells your Fortigate to WAIT even if it detects that its BGP peer has failed, and thus NOT to tear down peering. This is done to prevent flapping in case of occasional crash/restart of the BGP peer. In other words, it will prolong fail over.

You have few options to speed up failover:

[ol]

Play with timers - holdtimer, keep alive timer. But this will take you so far, the minimum allowed by standard would be 10 seconds before failover (if I recall correctly). Downside is the increased chance of false failovers.

Enable BFD under BGP peering. BFD (vendor independent standard and feature) tests your link constantly with UDP packets and thus allows failover in case of line failure in terms of milliseconds. BUT ... the second side of the link has to support BFD as well, which is not a given. Do you have Layer 2 or Layer 3 links from your IPSs? I mean next hop of your Fortigates is IP of your equipment or ISPs? Because Fortigates support BFD just fine, but the IPSs equipment may or may not - have to ask them.

Enable on Fortigate link-monitoring on the interface that BGP peering is formed via. You just set some ping destination and Fortigate declares the link as down once pings time out. I, from personal experience, don't like that option that much as lots of things are in flux and pinging hosts you don't control inevitably causes false positives and head ache. [/ol]

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded