Allow SD-WAN hubs to suppress BGP routes when all links to a spoke are down New
The feature enables hubs to detect when a spoke is dead (no SLA probes over a configurable duration) and suppress routes to that spoke. A BGP route-map-out is used to match this suppression status, and adjusts the multiple exit discriminator (MED) to inform BGP peers of the hub to direct traffic to the spoke through another hub.
config system sdwan
config health-check
edit <name>
set update-bgp-route {enable | disable}
next
end
end
config router route-map
edit <name>
config rule
edit 1
set match-suppress {enable | disable}
next
end
next
endconfig router bgp
config neighbor
edit <BGP peer IP>
set attribute-unchanged med
set route-map-out "suppress_dead_spoke"
next
end
end
Example
In this example:
-
Spoke-1 has two tunnels, H1_T11 and H1_T22, to Hub-1 and traffic from the external network to spoke-1 normally goes through Hub-1.
-
Spoke-1 has two other tunnels, H2_T11 and H2_T22, to Hub-2 and, if all links and tunnels between Spoke-1 and Hub-1 fail, it is expected that traffic from the external network to Spoke-1 will switchover to Hub-2 by advertising Spoke-1's routes with a higher MED from Hub-1 to the external network.
To configure Spoke-1:
config system sdwan
set status enable
config zone
edit "virtual-wan-link"
next
edit "overlay"
next
...
end
config members
...
edit 4
set interface "H1_T11"
set zone "overlay"
set source 172.31.0.65
...
next
edit 5
set interface "H1_T22"
set zone "overlay"
set source 172.31.0.65
...
next
...
edit 7
set interface "H2_T11"
set zone "overlay"
set source 172.31.0.65
...
next
edit 8
set interface "H2_T22"
set zone "overlay"
set source 172.31.0.65
...
next
...
end
config health-check
edit "HUB"
set server "172.31.100.100"
set embed-measured-health enable
set sla-id-redistribute 1
...
set members 4 5 7 8
config sla
edit 1
set link-cost-factor latency
set latency-threshold 100
next
end
next
end
end
To configure Hub-1:
-
Configure SD-WAN:
As long as one probe packet on a member is not received, the member will be considered as dead. If all members to Spoke-1 are dead, then Spoke-1's routes will be flagged as suppressed.
failtimecan be used to control convergence time.config system sdwan set status enable config zone edit "virtual-wan-link" next ... edit "overlay" next end config members edit 1 set interface "EDGE_T1" set zone "overlay" next edit 2 set interface "EDGE_T2" set zone "overlay" next ... end config health-check edit "rmt" set detect-mode remote set remote-probe-timeout 1000 set failtime 1 set recoverytime 1 set update-bgp-route enable set sla-id-redistribute 1 set members 1 2 config sla edit 1 set link-cost-factor remote ... next end next end end -
Configure route maps:
Suppressed routes are set with an MED of 999, and normal routes with an MED of 10.
config router route-map edit "ACTION_SUPPRESS" config rule edit 1 set match-suppress enable set set-metric 999 next edit 2 set set-metric 10 next end next end -
Configure BGP settings:
config router bgp ... config neighbor edit "172.31.0.129" ... set attribute-unchanged med ... set route-map-out "ACTION_SUPPRESS" next end end
To configure Hub-2:
-
Configure SD-WAN:
config system sdwan set status enable config zone edit "virtual-wan-link" next ... edit "overlay" next end config members edit 1 set interface "EDGE_T1" set zone "overlay" next edit 2 set interface "EDGE_T2" set zone "overlay" next ... end config health-check edit "rmt" set detect-mode remote set remote-probe-timeout 1000 set failtime 1 set recoverytime 1 set update-bgp-route enable set sla-id-redistribute 1 set members 1 2 config sla edit 1 set link-cost-factor remote ... next end next end end -
Configure route maps:
Suppressed routes are set with an MED of 999, and normal routes with an MED of 20.
config router route-map edit "ACTION_SUPPRESS" config rule edit 1 set match-suppress enable set set-metric 999 next edit 2 set set-metric 20 next end next end -
Configure BGP settings:
config router bgp ... config neighbor edit "172.31.0.129" ... set attribute-unchanged med ... set route-map-out "ACTION_SUPPRESS" next end end
To test the configuration:
-
The SLA status detected by the remote health-check on Hub-1 indicates that the two connections between Hub-1 and Spoke-1 are alive:
# diagnose sys sdwan health-check remote Remote Health Check: rmt(2) Passive remote statistics of EDGE_T2(46): EDGE_T2_0(10.0.0.14): timestamp=10-15 15:59:46.694, src=172.31.0.65, latency=0.233, jitter=0.010, pktloss=0.000%, mos=4.404, SLA id=1(pass), rmt_ver=2, rmt_sla=in, rmt_prio=150, last_sla_change=10-15 15:06:36.610 Remote Health Check: rmt(1) Passive remote statistics of EDGE_T1(45): EDGE_T1_0(172.31.0.65): timestamp=10-15 15:59:46.694, src=172.31.0.65, latency=0.276, jitter=0.029, pktloss=0.000%, mos=4.404, SLA id=1(pass), rmt_ver=2, rmt_sla=in, rmt_prio=100, last_sla_change=10-15 15:06:36.609 DC1_A_FGT (root) (Interim)# diagnose sys link-monitor dynamic-bgp-peers 172.31.0.65(0): alive-count=2, total=2, route-suppressed=0, last_route_change=10-15 15:06:33.999
-
The external peer receives Spoke-1's routes from Hub-1 and Hub-2.
The route received from Hub-1 is set as MED 10 and preferred. The route received from Hub-2 is set as MED 20.
# get router info bgp network 10.0.3.0/24 VRF 0 BGP routing table entry for 10.0.3.0/24 Paths: (2 available, best #1, table Default-IP-Routing-Table) Advertised to non peer-group peers: 172.31.0.2 Advertised to peer-groups: "EDGE" Original VRF 0 65001 172.31.0.1 from 172.31.0.1 (172.31.0.1) Origin IGP distance 20 metric 10, localpref 100, valid, external, best Community: 10:2 Last update: Wed Oct 15 15:06:52 2025 Original VRF 0 65001 172.31.0.2 from 172.31.0.2 (172.31.0.2) Origin IGP distance 20 metric 20, localpref 100, valid, external Community: 10:2 Last update: Wed Oct 15 15:00:54 2025 -
Send traffic from external network to Spoke-1's network. The traffic will go through Hub-1 and reach Spoke-1 on H1_T11:
# diagnose sniffer packet any 'host 10.0.6.1' 4 interfaces=[any] filters=[host 10.0.6.1] 9.053176 H1_T11 in 10.0.6.1 -> 10.0.3.2: icmp: echo request 9.053584 port4 out 10.0.6.1 -> 10.0.3.2: icmp: echo request 9.053689 port4 in 10.0.3.2 -> 10.0.6.1: icmp: echo reply 9.053760 H1_T11 out 10.0.3.2 -> 10.0.6.1: icmp: echo reply 10.077224 H1_T11 in 10.0.6.1 -> 10.0.3.2: icmp: echo request 10.077354 port4 out 10.0.6.1 -> 10.0.3.2: icmp: echo request 10.077463 port4 in 10.0.3.2 -> 10.0.6.1: icmp: echo reply 10.077526 H1_T11 out 10.0.3.2 -> 10.0.6.1: icmp: echo reply ...
-
Disable H1_T11 on Spoke-1. Hub-1 will detect it and consider it as dead, as a result, traffic will switch to H1_T22.
Once probe packet cannot be received on the member from Spoke-1, no statistics will be shown, and the
alive-countis changed from2to1.# diagnose sys sdwan health-check remote Remote Health Check: rmt(2) Passive remote statistics of EDGE_T2(46): EDGE_T2_0(10.0.0.14): timestamp=10-15 16:14:56.136, src=172.31.0.65, latency=0.298, jitter=0.037, pktloss=0.000%, mos=4.404, SLA id=1(pass), rmt_ver=2, rmt_sla=in, rmt_prio=150, last_sla_change=10-15 15:06:36.610 Remote Health Check: rmt(1) Passive remote statistics of EDGE_T1(45): DC1_A_FGT (root) (Interim)# diagnose sys link-monitor dynamic-bgp-peers 172.31.0.65(0): alive-count=1,total=1, route-suppressed=0, last_route_change=10-15 15:06:33.999
# diagnose sniffer packet any 'host 10.0.6.1' 4 interfaces=[any] filters=[host 10.0.6.1] ...... 541.094223 port4 in 10.0.3.2 -> 10.0.6.1: icmp: echo reply 541.094279 H1_T22 out 10.0.3.2 -> 10.0.6.1: icmp: echo reply 542.103485 H1_T22 in 10.0.6.1 -> 10.0.3.2: icmp: echo request 542.103614 port4 out 10.0.6.1 -> 10.0.3.2: icmp: echo request 542.103737 port4 in 10.0.3.2 -> 10.0.6.1: icmp: echo reply 542.103794 H1_T22 out 10.0.3.2 -> 10.0.6.1: icmp: echo reply 543.113468 H1_T22 in 10.0.6.1 -> 10.0.3.2: icmp: echo request 543.113602 port4 out 10.0.6.1 -> 10.0.3.2: icmp: echo request
-
Disable H1_T22 on Spoke-1 as well. All connections between Hub-1 and Spoke-1 are dead. At this point, Spoke-1's routes will be flagged as
suppressedand set asmed 999, then advertised to the external peer. As a result, traffic will switch over to Hub-2 and reach Spoke-1 on H2_T11.The
alive-countis also changed from1to0and the route received from Hub-2 is set as med 20 and preferred.# diagnose sys sdwan health-check remote Remote Health Check: rmt(2) Passive remote statistics of EDGE_T2(46): Remote Health Check: rmt(1) Passive remote statistics of EDGE_T1(45): DC1_A_FGT (root) (Interim)# diagnose sys link-monitor dynamic-bgp-peers 172.31.0.65(0): alive-count=0,total=1, route-suppressed=1, last_route_change=10-15 16:29:20.629 DC3_FGT (root) (Interim)# get router info bgp network 10.0.3.0/24 VRF 0 BGP routing table entry for 10.0.3.0/24 Paths: (2 available, best #2, table Default-IP-Routing-Table) Advertised to non peer-group peers: 172.31.0.1 Advertised to peer-groups: "EDGE" Original VRF 0 65001 172.31.0.1 from 172.31.0.1 (172.31.0.1) Origin IGP distance 20 metric 999, localpref 100, valid, external Community: 10:2 Last update: Wed Oct 15 16:29:21 2025 Original VRF 0 65001 172.31.0.2 from 172.31.0.2 (172.31.0.2) Origin IGP distance 20 metric 20, localpref 100, valid, external, best Community: 10:2 Last update: Wed Oct 15 15:00:54 2025# diagnose sniffer packet any 'host 10.0.6.1' 4 interfaces=[any] filters=[host 10.0.6.1] ...... 141.569312 H2_T11 in 10.0.6.1 -> 10.0.3.2: icmp: echo request 141.569454 port4 out 10.0.6.1 -> 10.0.3.2: icmp: echo request 141.569571 port4 in 10.0.3.2 -> 10.0.6.1: icmp: echo reply 141.569630 H2_T11 out 10.0.3.2 -> 10.0.6.1: icmp: echo reply 142.579272 H2_T11 in 10.0.6.1 -> 10.0.3.2: icmp: echo request 142.579410 port4 out 10.0.6.1 -> 10.0.3.2: icmp: echo request 142.579535 port4 in 10.0.3.2 -> 10.0.6.1: icmp: echo reply 142.579599 H2_T11 out 10.0.3.2 -> 10.0.6.1: icmp: echo reply