> Source: [sk180950](https://support.checkpoint.com/results/sk/sk180950)

# sk180950 - BFD session state is down at intervals of several hours

| Property | Value |
|----------|-------|
| Solution ID | sk180950 |
| Date Created | 2023-06-01 |
| Last Modified | 2023-06-06 |
| Technical Level | Advanced |
| Products | Security Gateway, Scalable Platforms |
| Versions | R81.10 (EOS), R81 (EOS), R81.10 (EOS) |

## Symptoms

- * The Bidirectional Forwarding Detection (BFD) session state is down at intervals of several (approximately three) hours, causing the re-negotiation of the Border Gateway Protocol (BGP) or the Open Shortest Path First (OSPF) protocol.

* The traffic capture shows that there is a delay in the sending or receiving of the BFD Control packets. To the user, it looks like the Security Gateway suddenly stops sending BFD Control packets and then detects that the BFD session is down.  

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk180950/bfd_capture202305051348441.png)  

* The `/var/log/routed_messages` file contains these logs:  

  ```
  [DATETIME] [HOSTNAME] routed[77147]: [routed] NOTICE:  bfd_refigure_reachability(2378): Entering
  [DATETIME] [HOSTNAME] routed[77147]: [routed] NOTICE:  ipreachdetect_set_reachable(1212): Monitoring <IP ADDRES>, phe->reachable 1, reachable 0
  [DATETIME] [HOSTNAME] routed[77147]: [routed] NOTICE:  bfd_refigure_reachability(2378): Entering
  [DATETIME] [HOSTNAME] routed[77147]: [routed] NOTICE:  bgp_peer_close(6319): closing peer <IP ADDRESS> [eBGP AS 16550], state is 6 (Established)
  [DATETIME] [HOSTNAME] routed[77147]: [routed] WARNING: bgp_event: peer <IP ADDRESS> [eBGP AS 16550] old state Established event IpReachabilityClose new state Idle
  ```

* The messages log shows that there was a clock sync event when the issue occurred:  

  ```
  [DATETIME] [HOSTNAME] ntpd[3983]: 0.0.0.0 061c 0c clock_step +4.718381 s
  [DATETIME] [HOSTNAME] ntpd[3983]: 0.0.0.0 0615 05 clock_sync
  ```

## Cause

The BFD network protocol uses a simple hello mechanism to detect failures in a network. Each time an NTP update occurs, there is a large time difference (approximately 4.7 seconds in this example) between the local and NTP servers. The time difference exceeds the negotiated BFD interval, and BFD notifies a failure.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content