12.6 BFD Detection and VRRP Gateway Redundancy

Q: An enterprise network engineer configures BFD for OSPF on a 10GbE point-to-point link with matching peer timers, an operational negotiated interval of 100 ms, and multiplier 3. What nominal BFD detection time alerts OSPF to a loss of the monitored path?

300 milliseconds (three consecutive missed BFD intervals). BFD calculates failure detection time by multiplying the negotiated transmission interval by the loss multiplier. In this configuration, the interval is 100 milliseconds on both endpoints and the multiplier is 3. The detection time is 100ms * 3 = 300 milliseconds. If the local router misses three consecutive BFD probes (after 300ms), it declares the session down and immediately triggers OSPF route withdrawal without waiting for the standard 40-second OSPF dead timer.

Key Takeaways

BFD single-hop control uses UDP 3784, multihop control 4784, and echo 3785.
BFD detection depends on negotiated intervals and multiplier; 100 ms times three gives a nominal 300 ms.
VRRP uses a shared gateway IP/MAC and priority election; tracked failure costs can reduce priority below the backup.

Last updated: October 2026

3. Bidirectional Forwarding Detection (BFD)

The Problem: Sluggish IGP Hello Timers

Interior Gateway Protocols rely on periodic hello packets to detect neighbor failures. By default, OSPF transmits hellos every 10 seconds with a 40-second dead interval, while BGP uses 30-second keepalives with a 90-second hold time. When a transit path fails indirectly—such as across an intermediate optical transport network, DWDM system, or unmanaged Layer 2 switch—the local physical interface remains carrier UP. Waiting 40 to 90 seconds for protocol dead timers to expire causes catastrophic application timeouts.

BFD Protocol Architecture (RFC 5880)

Bidirectional Forwarding Detection (BFD) is a lightweight, ultra-fast keepalive protocol designed to provide sub-second link failure detection across any media type. BFD operates independently of any specific routing protocol, running over UDP destination port 3784 for single-hop sessions and port 4784 for multihop control sessions; UDP 3785 is the BFD echo function.

Hardware-Assisted BFD in Junos OS

BFD implementation depends on hardware, release, session type and scale. Some sessions run centrally on the Routing Engine; others use distributed or hardware-assisted processing. A configured 100-ms interval is a request, not proof of the operational negotiated interval or 100-ms detection. Inspect show bfd session extensive, including the negotiated transmit/receive timers, detection time and client. Offload does not remove every control-plane dependency.

When BFD detects a lost neighbor (after missing a configured multiplier of packets), the PFE immediately informs local routing protocol daemons, triggering route withdrawal and sub-second IGP reconvergence.

Junos BFD Configuration

BFD is configured directly under the specific routing protocol hierarchy. To enable BFD for OSPF:

[edit protocols ospf area 0.0.0.0 interface ge-0/0/0.0]
user@EX4300# show
bfd-liveness-detection {
    minimum-interval 100;
    minimum-receive-interval 100;
    multiplier 3;
}

In this configuration:

minimum-interval 100: The local router attempts to transmit BFD control packets every 100 milliseconds.
minimum-receive-interval 100: The local router instructs its peer that it can process incoming BFD packets every 100 milliseconds.
multiplier 3: If 3 consecutive BFD packets are missed, the neighbor is declared dead.
Total Detection Time: $\text{Detection Time} = \text{Interval} \times \text{Multiplier} = 100\text{ms} \times 3 = \mathbf{300\text{ milliseconds}}$ (compared to 40 seconds for standard OSPF!).

BFD can similarly be bound to BGP sessions under [edit protocols bgp group <name> neighbor <ip>].

4. Virtual Router Redundancy Protocol (VRRP)

Default Gateway Redundancy Challenges

Host endpoints (workstations, printers, IoT devices) are configured with a single default gateway IP address pointing to a local subnet router. If that router fails, hosts lose external connectivity even if redundant physical routers exist on the subnet. Virtual Router Redundancy Protocol (VRRP) provides dynamic default gateway failover by pooling two or more physical routers into a single virtual gateway.

VRRP Mechanics: VIP, VMAC & Protocol Standards

Standards: VRRPv2 (RFC 3768) supports IPv4; VRRPv3 (RFC 5798) supports both IPv4 and IPv6.
Virtual IP (VIP): A shared IP address configured on the LAN interfaces of all participating routers that serves as the default gateway for client hosts.
Virtual MAC (VMAC): To prevent client ARP tables from needing updates during failover, the active router answers ARP requests using a standardized Virtual MAC address: $\text{VRRPv2 Virtual MAC Format: } \mathbf{00:00:5e:00:01:[\text{VRID}]}$ For example, VRRP group ID 10 ( $10 = 0x0A$ in hex) uses VMAC 00:00:5e:00:01:0a.

Master vs. Backup Election & Timers

Participating routers elect a single active Master Router; all other routers assume the Backup Router role:

Priority Hierarchy: Configured from 1 to 254 (default is 100). The router with the highest priority becomes the Master.
IP Address Owner: Priority 255 is reserved for the router whose physical interface IP address matches the Virtual IP address.
VRRP Advertisements: The Master transmits periodic VRRP Advertisement packets to multicast address 224.0.0.18 using IP Protocol 112 every 1 second (the advertisement interval).
Master Down Timer: Backup routers listen for advertisements. If an advertisement is not received before the Master Down Timer expires, the backup assumes the master has failed and transitions to the Master role: $\text{Master Down Timer} = (3 \times \text{Advertisement\_Interval}) + \text{Skew\_Time}$ $\text{Skew\_Time} = \frac{256 - \text{Priority}}{256}\text{ seconds}$

Preemption (`preempt`)

In Junos OS, preemption is enabled by default. If a primary router with priority 150 reboots, the backup router (priority 100) temporarily acts as Master. Once the primary router finishes booting, its superior priority immediately preempts the backup, restoring primary gateway mastership.

Dynamic Tracking (Interface & Route Tracking)

A critical failure scenario occurs when the Master router maintains a healthy LAN connection, but its upstream WAN uplink fails. If the Master continues sending VRRP advertisements on the LAN, client hosts continue sending outbound traffic to it, which is dropped at the broken WAN edge.

Junos solves this using dynamic tracking:

Interface Tracking: Automatically decrements the local VRRP priority if a monitored upstream interface loses carrier link.
Route Tracking: Decrements the VRRP priority if a specific routing table prefix (such as 0.0.0.0/0) disappears from inet.0.

Junos VRRP Configuration with Tracking:

[edit interfaces irb unit 10 family inet address 10.1.10.2/24]
user@EX4300# show
vrrp-group 10 {
    virtual-address 10.1.10.1;
    priority 150;
    preempt;
    accept-data;
    track {
        interface ge-0/0/0.0 {
            priority-cost 60;
        }
        route 0.0.0.0/0 routing-instance default {
            priority-cost 60;
        }
    }
}

In this example, Switch A normally operates with priority 150 (beating Switch B's priority of 100). If the upstream WAN uplink ge-0/0/0.0 fails, Junos automatically subtracts the priority-cost of 60, reducing Switch A's priority to 90 ( $150 - 60 = 90$ ). Because Switch B has priority 100 with preemption enabled, Switch B can preempt and assume the Master role, restoring the viable gateway path after convergence for client endpoints.

5. Verification & Diagnostics Commands

To verify VRRP operational state, VIP ownership, and dynamic tracking status, run show vrrp extensive:

user@EX4300> show vrrp extensive
Interface: irb.10, Interface index: 84, Address: 10.1.10.2/24
  Interface state: up, Group: 10, State: master
  Priority: 150, Advertisement interval: 1 sec, Authentication type: none
  Preempt: yes, Accept-data: yes
  Virtual IP address: 10.1.10.1
  Virtual MAC address: 00:00:5e:00:01:0a
  Master router: 10.1.10.2
  Tracking:
    Interface: ge-0/0/0.0, State: up, Priority cost: 60
    Route: 0.0.0.0/0, State: up, Priority cost: 60

To inspect hardware-assisted BFD sessions across transit routing links:

user@EX4300> show bfd session extensive
                                                  Detect  Transmit
Address                  State     Interface      Time    Interval  Multiplier
192.168.10.2             Up        ge-0/0/0.0     0.300   0.100     3
  Client: OSPF, TX interval: 0.100, RX interval: 0.100
  Session state: Up, Hardware-assisted: Yes

To verify Routing Engine switchover readiness under GRES and NSR:

user@EX4300> show system switchover
Graceful switchover: On
Configuration database: Ready
Kernel database: Ready
Peer state: Steady State

Official protocol references checked 2026-10-18: single-hop BFD and echo, multihop BFD.

Protocol Logging and Tracking Diagnostics

When gateway ownership changes unexpectedly, compare show vrrp extensive on both routers: base/current priority, tracked interface/route state, preemption and advertisement timing. Match those changes to show log messages and interface events. A tracked default route can disappear because routing policy changed even while physical carrier stays up; an interface track and a route track observe different conditions.

If ordinary state views do not explain VRRP transitions, Junos provides protocol traceoptions under protocols vrrp on supported releases. Use a bounded file and only the relevant supported flags, collect the transition evidence, then disable tracing. Apply the same bounded-diagnostic principle to BFD and routing clients: an operational BFD failure must be correlated with its negotiated timers and client action, not inferred from a configured minimum alone.

Test Your Knowledge

An enterprise network engineer configures BFD for OSPF on a 10GbE point-to-point link with matching peer timers, an operational negotiated interval of 100 ms, and multiplier 3. What nominal BFD detection time alerts OSPF to a loss of the monitored path?

100 milliseconds (one missed BFD interval)

40 seconds (the default OSPF dead interval)

300 milliseconds (three consecutive missed BFD intervals)

3 seconds (the minimum LACP timeout threshold)

Test Your Knowledge

In a VRRPv2 configuration on a Juniper EX switch, Switch A has a base priority of 130 and monitors an upstream WAN interface with track interface ge-0/0/0 priority-cost 40. Switch B has a base priority of 100 with preemption enabled. What happens to gateway mastership if Switch A's ge-0/0/0 interface experiences a link failure?

Switch A remains VRRP Master because its priority drops to 110, which still beats Switch B's priority of 100

Switch A and Switch B enter an active-active load sharing state because their priority difference is within 10 points

Switch B becomes Master, but Switch A continues answering ARP requests for the Virtual IP address

Switch A's priority drops to 90, allowing Switch B to preempt and become the active VRRP Master

Sections you finish are checked off in the contents.

Up Next

12.7 Unified ISSU: Requirements and Verification

Continue learning

JNCIS-ENT Enterprise Routing and Switching