Background
Bidirectional Forwarding Detection (BFD) is a fast fault detection protocol used to monitor links between network devices like routers and switches. It's purpose is to detect link failures (to quickly facilitate routing around them) rather than device failures which is an important distinction in the case of a clustered pair of Firewalls.
In a ClusterXL environment "Standby" cluster members do not respond to BFD. Hence when considering the configuration of BFD we need to pay attention to the underlying network fabric and parameters such as the ClusterXL dead timeout. Does the network topology require / warrant BFD and what is it really achieving for us?
Timers & Best Practices
- For a non-clustered security gateway the calculated BFD timeout should be at least 1 second, preferably 3 seconds (or more) for reliability. For more details, see RFC 5880.
- On Cluster Members, make sure the calculated timeout is longer than the time necessary for the cluster to complete an unattended failover in your environment. We recommend that you first test failover in your environment.
- Do not use the IP Reachability Detection feature in combination with the Graceful Restart feature in dynamic routing protocols, unless the routing protocols support the BFD "c-Bit".
Source: Check Point R82 Gaia Advanced Routing Admin Guide - IP Reachability Detection Configuring in Gaia Cl...
Access Policy
Routing related protocols such as BGP, OSPF etc need to be allowed by the security gateway access policy in order for routing adjacencies / neighbors to be able to form successfully. In general this traffic is not covered by implied rules.
Configuration of the necessary rules for common routing protocols are covered by the following knowledge article; similar rules are required to allow BFD traffic as an example (UDP destination ports control: 3784 & echo: 3785) e.g.
|
Source
|
Destination
|
Service
|
Action
|
Install On
|
|
BFD neighbors
Relevant Security Gateways
|
BFD neighbors
Relevant Security Gateways
|
BFD-Single_hop
|
Accept
|
Relevant Security Gateways
|
sk39960: How to allow Dynamic Routing protocols traffic (OSPF, BGP, PIM, RIP, IGRP) through Check Po...
Priority Queues
As relevant to BFD should be default in current versions, please see: sk105762: Firewall Priority Queues in R80.x / R81.x
CCSM R77/R80/ELITE
