FG 500 - Extreme Switch - bfd_read_ipv4: BFD packet processing failed.

[Michael]

Hello,

we have a problem with our OSPF connection to a location. This is a 250Mbit "Ethernet Connect" connection and a 10MBit backup. On one side is an FG 500 FW: 6.0.11 and on the other side is an Extreme Switch with two BFD ports. Unfortunately the connection swings around every now and then although there is no real connection failure. The ISP monitors this connection. It goes to the backup connection and then only comes back to the primary connection when I restart the Extreme Switch. Does somebody has any idea?

This is the error:

bfd_write:Session[**IP**->**IP**,i_ospf_2,1D6]: Sending BFD packet bfd_packet_process: Can't find session with discr 0x00000215 bfd_read_ipv4: BFD packet processing failed.

bfd_session_change_state: Session[**IP**->**IP**,49***,i_ospf_1,]: state DOWN -> INIT local_diag=0x00 bfd_session_send_packet_now: Session[**IP**->**IP**,49***,i_ospf_1]: bfd_session_send_packet_now

# get router info bfd neighbor

--> The line is Down then UP

Config:

Timer intervals configured, Hello 10.000, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:06

Thanks!

[Benoit_Rech_FTNT]

Hello, is there any reason you run 6.0 ? It's a quite old version. From the output you provided, it seems you have BFD issue, and that the Extreme switch uses another bfd session (-> another discriminant). First, remove/disable BFD setup, and ensure that you have a stable OSPF network. Benoit 

[Michael]

Hello,

tanks for the fast answer!

I found something in the configuration of the Extreme Switch that I do not understand.

The OSPF ports are only flagged as unicast / multicast with FIB "U ------ um - f-" but not as OSPF.

Ok, it's not a Fortinet issue.

On the FG the  LDesc / RDesc log was 18/0 primary and 214/2 backup during the fault. Currently this is 27/1 primary and 34/2 in backup.

The line is Up but BFD dont tells that.

[Michael]

And yes, 6.0.0 ist OLD. We will upgrade the FG next. 

I have to change all DLP to Webfilter first...

And I think that I have to change all NAT objects to SNAT for NGFW

[Benoit_Rech_FTNT]

Michael,

I don't know if it is supported on the Extreme switch. But on the Fortigate you can configure 'sub-second hello' on the OSPF interface. It will send OSPF hello packet every 250ms. It's for me a better solution than running BFD in your case, and it provides a convergence time around 1 second. config router ospf .. config ospf-interface    edit <name>         set hello-interval 1         set hello-multiplier 4   end end Benoit