> Source: [sk185166](https://support.checkpoint.com/results/sk/sk185166)

# sk185166 - OSPF Routes Disappear After ClusterXL HA Failover When BFD Is Enabled with Extreme Switch Peers

| Property | Value |
|----------|-------|
| Solution ID | sk185166 |
| Date Created | 2026-07-17 |
| Last Modified | 2026-07-23 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * After a ClusterXL High Availability (HA) failover, OSPF routes are temporarily removed from the routing table before they are reinstalled, which causes a short routing outage.
* When BFD is enabled, the OSPF adjacencies reset during the HA failover.
* The event is visible in two places. On the adjacent Extreme Networks switch, the BFD debug log records that incoming BFD packets are discarded because the UDP source port changed - for example: *bfdRxPacket: BFD session's srcPort 50345 not same as incoming srcPort 56562. Discarded.* On the Check Point Security Gateway, you can correlate the same event in the routing daemon log */var/log/routed.log* , and by running `show ospf neighbors` (the adjacency resets) and `show route` (the OSPF routes are briefly removed and then relearned).

## Cause

The root cause is an interoperability limitation between how Check Point ClusterXL handles BFD across a failover and how the adjacent Extreme Networks switches identify a BFD session.

In ClusterXL High Availability, only the Active member sends and accepts BFD packets; the Standby member does not participate. When a failover occurs, the newly Active member takes over the BFD sessions from its own networking stack, and the UDP source port used for the outgoing BFD packets can change. Check Point does not guarantee that the BFD UDP source port stays identical across an HA failover.

Per the BFD standard, a session is demultiplexed by its BFD discriminators, not by the UDP source port. The Extreme switches, however, also validate the UDP source port as part of the session identity. When the source port changes after failover, the switch no longer recognizes the incoming packets as belonging to the established session and discards them.

With the BFD packets discarded, the BFD session times out on the switch side. The BFD timeout tears down the OSPF adjacency, and once the adjacency drops, the Security Gateway flushes the OSPF-learned routes from the kernel routing table. The routes are relearned a moment later, which produces the temporary routing outage.

**Important** - The trigger is the change of the BFD UDP source port across failover combined with the switch's port-based session validation. It is not a password, policy, or OSPF-configuration error on the Security Gateway.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content