BGP Convergence, Timers, and Stability Mechanisms
This domain tests how fast a failure is detected and propagated, and how you stop unstable peers from destabilising the router.
Timers
SR OS defaults: hold time 90 s, keepalive 30 s (one third of hold), connect-retry 120 s, min-route-advertisement 30 s. Hold time negotiates to the lower value, so a peer with 30 s hold brings the session down faster than your 90 s side expects. min-route-advertisement batches updates so a flapping prefix does not generate a burst of UPDATEs.
Fast detection
BFD on the neighbour (bfd-liveness) detects failure in hundreds of milliseconds rather than waiting up to 90 s for the hold timer; it is the only way to get sub-second BGP failover. rapid-withdrawal makes withdrawals propagate immediately instead of waiting for the decision process to settle. Note that BGP convergence always depends on IGP convergence to the next hop, so BFD on the IGP and next-hop tracking matter as much as the BGP timer.
Graceful restart and LLGR
With graceful-restart, a restarting speaker's peers preserve its routes as stale for stale-routes-time (default 360 s) and flush them at end-of-RIB if the peer returns. Helper mode must be enabled on the peer side. Long-lived graceful restart extends the concept to routes that cannot be re-established quickly.
Damping and limits
damp-peer penalises flapping sessions using half-life, suppress, reuse and max-suppress values; damp-withdraw penalises excessive withdrawals. prefix-limit caps what a peer can inject and can shut the session when exceeded. Both protect the router, but damping can hide a legitimate customer for hours, so it is normally applied only toward untrusted peers.
Worked example
A customer link fails with hold time 90 s and no BFD: detection takes up to 90 s, plus IGP and BGP propagation. Adding bfd-liveness with 300 ms × 3 brings detection under one second, and rapid-withdrawal removes the extra decision-process delay on the withdraw path. Setting hold time to 0 without BFD makes the failure undetectable by the timer at all.
Traps
- Setting hold time 0 believing it speeds convergence; it disables dead-peer detection.
- Enabling damping toward customers and suppressing their routes for hours after a brief flap.
- Forgetting that graceful restart is useless if the peer is not acting as a helper.