BFD (Bidirectional Forwarding Detection)

BFD (Bidirectional Forwarding Detection)

Version Info

RouterOS 7.16 | Min: v7.0+ | 15 minutes | Intermediate

Tested on: 7.16 7.14

Version-specific notes

• v7.0+: Full BFD implementation with /routing bfd configuration
• v6.x: Limited support, different syntax (not covered here)

TL;DR (Quick Start)

For the impatient: enable BFD for BGP in RouterOS v7.

# Allow BFD on interface
/routing/bfd/configuration/add interfaces=ether1 comment="BGP peer link"

# Enable BFD on BGP connection
/routing/bgp/connection/set [find name=upstream] use-bfd=yes

# Verify session is up
/routing/bfd/session/print

Overview

What this does: BFD provides sub-second detection of link failures between network devices. Default settings detect failures in ~1 second (200ms interval x 5 multiplier), compared to BGP’s 180-second default hold time or OSPF’s 40-second dead interval.

When to use this:

• Redundant uplinks where fast failover is critical
• BGP peering with multiple upstream providers
• OSPF backbone links requiring rapid convergence
• Any scenario where routing protocol timers are too slow

Prerequisites:

• RouterOS v7.0 or higher
• BGP or OSPF configured
• Direct connectivity for single-hop BFD (multi-hop requires address configuration)
• Firewall allowing UDP 3784 (single-hop) or 4784 (multi-hop)
• Both peers must support BFD

v7 Behavior Change

In RouterOS v7, if use-bfd=yes is set on a BGP connection and the BFD session cannot establish, BGP will not come up. Only enable BFD when you’ve confirmed the peer supports it.

Configuration Steps

Step 1: Create BFD Configuration Entry

BFD requires explicit configuration entries to allow sessions on interfaces:

/routing/bfd/configuration/add interfaces=ether1 \
    min-tx=200ms min-rx=200ms multiplier=5 comment="BGP peer link"

Default timer values provide 1-second detection time (200ms x 5).

Step 2: Enable BFD on Routing Protocol

For BGP:

/routing/bgp/connection/set [find name=upstream] use-bfd=yes

For OSPF:

/routing/ospf/interface-template/set [find] use-bfd=yes

Step 3: Verify BFD Session

Check that the BFD session is established:

/routing/bfd/session/print

Expected output:

Columns: REMOTE-ADDRESS, LOCAL-ADDRESS, INTERFACE, STATE, MULTIHOP
# REMOTE-ADDRESS    LOCAL-ADDRESS     INTERFACE  STATE  MULTIHOP
0 192.168.1.2       192.168.1.1       ether1     up     no

Common Scenarios

Scenario: BFD for BGP Peer

Enable BFD for a single-hop BGP peer:

# Step 1: Allow BFD on the peering interface
/routing/bfd/configuration/add interfaces=ether1 comment="BGP to ISP"

# Step 2: Enable BFD on the BGP connection
/routing/bgp/connection/set [find name=isp-upstream] use-bfd=yes

# Step 3: Verify
/routing/bfd/session/print

Scenario: BFD for OSPF Neighbors

Enable BFD for all OSPF neighbors:

# Step 1: Create interface list for OSPF interfaces
/interface/list/add name=ospf-interfaces
/interface/list/member/add list=ospf-interfaces interface=ether2
/interface/list/member/add list=ospf-interfaces interface=ether3

# Step 2: Allow BFD on OSPF interfaces
/routing/bfd/configuration/add interfaces=ospf-interfaces comment="OSPF backbone"

# Step 3: Enable BFD in OSPF
/routing/ospf/interface-template/set [find] use-bfd=yes

# Step 4: Verify
/routing/bfd/session/print where state=up

Scenario: Multi-Hop BFD for eBGP

For eBGP peers not directly connected:

# Step 1: Create address list for allowed peers
/ip/firewall/address-list/add list=ebgp-bfd-peers address=198.51.100.1
/ip/firewall/address-list/add list=ebgp-bfd-peers address=203.0.113.1

# Step 2: Configure BFD for multi-hop (uses addresses, not interfaces)
/routing/bfd/configuration/add address-list=ebgp-bfd-peers

# Step 3: Enable BFD and multi-hop on BGP connection
/routing/bgp/connection/set [find name=ebgp-peer] use-bfd=yes multihop=yes

Multi-hop BFD uses UDP port 4784 instead of 3784.

Scenario: Interface Filtering (Allow/Forbid)

Control which interfaces can use BFD:

# Forbid BFD on management interface (specific rule first)
/routing/bfd/configuration/add interfaces=ether1 forbid-bfd=yes comment="No BFD on mgmt"

# Allow BFD on all other interfaces
/routing/bfd/configuration/add interfaces=all comment="Allow BFD elsewhere"

Order Matters

BFD configuration entries are order-sensitive (first match wins). Place specific forbid-bfd rules before general allow rules.

Scenario: Aggressive Timers for Critical Links

For fastest possible failover (50ms detection):

/routing/bfd/configuration/add interfaces=critical-uplink \
    min-tx=10ms min-rx=10ms multiplier=5 comment="50ms detection"

CPU Impact

Very aggressive timers increase CPU load. On loaded systems, this may cause false positives (BFD flapping). Use 200ms or higher on production routers.

Scenario: Custom Timers per Interface

Different detection times for different links:

# Fast detection for primary uplink
/routing/bfd/configuration/add interfaces=ether1 \
    min-tx=100ms min-rx=100ms multiplier=3 comment="300ms detection"

# Standard detection for backup
/routing/bfd/configuration/add interfaces=ether2 \
    min-tx=200ms min-rx=200ms multiplier=5 comment="1s detection"

Verification

Confirm BFD is working correctly:

Check 1: Verify BFD Sessions

/routing/bfd/session/print

Expected: All sessions showing state=up.

Check 2: Check Session Details

/routing/bfd/session/print detail

Expected: packets-rx and packets-tx incrementing.

Check 3: Verify Configuration

/routing/bfd/configuration/print

Expected: Entries allowing BFD on required interfaces.

Check 4: Check BGP BFD Status

/routing/bgp/session/print

Expected: BGP sessions established with BFD enabled.

Check 5: Check OSPF BFD Status

/routing/ospf/neighbor/print

Expected: OSPF neighbors with BFD enabled.

Check 6: Monitor BFD Events

/log/print where topics~"bfd"

Expected: No unexpected “down” events.

Troubleshooting

Symptom	Cause	Solution
BGP won’t establish	BFD configured but peer doesn’t support it	Verify peer supports BFD before enabling use-bfd=yes
BFD session stuck in “down”	No configuration entry for interface	Add /routing/bfd/configuration entry for the interface
”TTL check failed” in logs	Packet traversing extra hops	Verify direct connectivity; use multi-hop BFD if needed
Session flapping	Aggressive timers on loaded router	Increase min-tx/min-rx to 200ms or higher
BFD not transmitting	Interface matched by forbid-bfd rule	Check configuration order; move forbid rule or add explicit allow
Multi-hop BFD not working	Using interface filter for multi-hop	Use addresses or address-list for multi-hop, not interfaces
Interop issues with Cisco	Cisco has echo mode enabled	Disable echo on Cisco: no bfd echo
Session not restored after reboot	Configuration entry missing or disabled	Verify /routing/bfd/configuration entries exist

Debug: Enable BFD Logging

/system/logging/add topics=bfd action=memory
/log/print where topics~"bfd"

Debug: Check Session Statistics

/routing/bfd/session/print detail

Look for:

• state-changes: High count indicates instability
• packets-rx/packets-tx: Should be incrementing
• hold-time: Calculated detection time

Debug: Firewall Check

Ensure BFD traffic is allowed:

# Single-hop BFD
/ip/firewall/filter/add chain=input protocol=udp dst-port=3784 action=accept comment="BFD single-hop"

# Multi-hop BFD
/ip/firewall/filter/add chain=input protocol=udp dst-port=4784 action=accept comment="BFD multi-hop"

Common Mistakes

• Enabling BFD without peer support - v7 requires both peers to have BFD; BGP stays down if BFD fails
• Missing configuration entry - BFD won’t work without explicit /routing/bfd/configuration allowing it
• Wrong order of rules - forbid-bfd rules must come before allow rules to work correctly
• Using interfaces for multi-hop - Multi-hop BFD requires addresses or address-list, not interface filters
• Timers too aggressive - 10ms timers can cause false positives; start with 200ms defaults

Community Tips

Echo Mode Not Supported: MikroTik doesn’t support BFD echo mode. When peering with Cisco, disable echo on the Cisco side: no bfd echo

Timer Negotiation: BFD peers negotiate timers. Your router transmits at MAX(local-min-tx, remote-min-rx). Sessions that haven’t established use 1-second intervals.

Detection Time Calculation: Detection time = negotiated-interval x multiplier Default: 200ms x 5 = 1 second

Static Route Limitation: BFD cannot be used directly with static routes in RouterOS. Use OSPF or BGP for BFD-enabled failover.

BFD Timer Reference

Timer	Default	Description
min-tx	200ms	Minimum transmit interval
min-rx	200ms	Minimum receive interval
multiplier	5	Missed packets before failure
Detection time	1 second	min-rx x multiplier

Detection Time Examples

min-tx/min-rx	Multiplier	Detection Time
200ms	5	1 second
100ms	3	300ms
50ms	5	250ms
10ms	5	50ms

Related Topics

Routing Protocol Integration

• BGP - primary use case for BFD fast failover
• OSPF - OSPF neighbor failure detection
• Static Routes - BFD-triggered route changes

Route Management

• Routing Filters - react to BFD-triggered route changes
• Routing Tables - multiple tables with BFD monitoring

Network Infrastructure

• Firewall Basics - allow UDP 3784/4784
• VRRP - gateway redundancy with BFD

Monitoring

• Netwatch - alternative host monitoring
• Logging - log BFD session changes

Reference

• MikroTik BFD Documentation
• RFC 5880 - BFD Protocol
• RFC 5881 - BFD for IPv4 and IPv6 (Single Hop)
• RFC 5883 - BFD for Multihop Paths

Key Commands Reference

Command	Description
/routing/bfd/configuration/add	Create BFD policy entry
/routing/bfd/configuration/print	View BFD configuration
/routing/bfd/session/print	View active BFD sessions
/routing/bfd/session/print detail	View session details with counters

Configuration Properties

Property	Type	Default	Description
interfaces	interface-list	-	Interface filter for single-hop BFD
addresses	IP range	-	Address range for multi-hop filtering
address-list	string	-	Named address list for destination matching
vrf	string	main	Virtual routing instance
min-tx	time	200ms	Minimum transmit interval
min-rx	time	200ms	Minimum receive interval
multiplier	integer	5	Detection multiplier
forbid-bfd	yes/no	no	Block BFD on matching entries
disabled	yes/no	no	Disable configuration entry
comment	string	-	Description

Session Properties (Read-Only)

Property	Type	Description
remote-address	IP	Peer’s IP address
local-address	IP	Local source address
interface	string	Associated interface
state	up/down/init	Current session state
multihop	yes/no	Multi-hop session indicator
desired-tx-interval	time	Negotiated transmit interval
required-min-rx	time	Local minimum RX interval
remote-min-rx	time	Peer’s minimum RX interval
multiplier	integer	Detection multiplier
hold-time	time	Calculated detection time
packets-rx	integer	Received packet count
packets-tx	integer	Transmitted packet count
state-changes	integer	Session state transition count
uptime	time	Time since session established

Protocol Ports

Port	Protocol	Purpose
3784	UDP	Single-hop BFD control
4784	UDP	Multi-hop BFD control
3785	UDP	BFD echo (not supported on MikroTik)

Unsupported Features

Feature	Notes
Echo mode	Not implemented; disable on Cisco peers
Authentication	MD5/SHA not supported
Static route integration	Must use routing protocol for BFD