Load balancing configuration to support multihop BFD (MBFD)

Support for multihop BFD (MBFD) was added to FortiOS 7.0.6 (see BFD for multihop path for BGP) and is supported by FortiGate-6000 and 7000 for FortiOS 7.0.10. Multihop BFD is supported for normal traffic and over IPsec VPN tunnels that are terminated by the FortiGate-6000 or 7000.

The multihop control protocol uses TCP and UDP traffic on port 4784. Multihop control traffic is not load balanced by DP or NP7 processors. Instead, a flow rule is used to send all multihop control traffic to a single FPC or FPM.

The following flow rule has been added to the FortiOS 7.0.10 default flow rules for traffic that cannot be load balanced to send all multihop control traffic to the primary FPC or FPM. This flow rule should be enabled if you configure multihop BFD support on your FortiGate-6000 or 7000.

config load-balance flow-rule

edit 22

set status disable

set vlan 0

set ether-type ip

set protocol udp

set src-l4port 0-0

set dst-l4port 4784-4784

set action forward

set forward-slot master

set priority 5

set comment "Flow Rule for Multihop BFD"

end

When upgrading to FortiOS 7.0.10, this flow rule will be added to the default flow rules configuration and will be disabled. You need to enable it if you want to use multihop BFD.

Resetting your FortiGate-6000 or 7000 running FortiOS 7.0.10 to factory defaults enables the multihop BFD flow rule.