Fast convergence: BFD, loop-free alternate fast reroute and CEF polarization

Why default convergence is too slow

When a link fails, recovery has several stages: detect the failure, tell other routers, recalculate paths and update the forwarding table. If the failure is a cable unplugged from the router itself, detection is fast. But if the link fails somewhere the router cannot see, such as inside a provider's Ethernet service, the routing protocol only notices when hellos stop: 40 seconds with default OSPF timers and 15 seconds with EIGRP. Voice calls drop long before that.

Bidirectional Forwarding Detection (BFD)

BFD (RFC 5880) is a lightweight hello protocol designed only to check that the forwarding path between two neighbours works. It sends small packets at short intervals, often 50 to 300 milliseconds, and declares the neighbour down after a set number are missed. Routing protocols register with BFD and react as soon as it reports a failure. Many platforms run BFD in hardware so short timers do not load the CPU.

interface GigabitEthernet0/1
 bfd interval 100 min_rx 100 multiplier 3
router ospf 1
 bfd all-interfaces
router eigrp 100
 bfd all-interfaces
router bgp 65010
 neighbor 192.0.2.1 fall-over bfd
show bfd neighbors

With these values a failure is detected in about 300 milliseconds. Both ends must run BFD with compatible settings. Very aggressive timers can cause false failures on busy or wireless links, so test before using them widely.

Loop-free alternate fast reroute

Even with fast detection, the router still has to recalculate. Loop-free alternate (LFA, RFC 5286) fast reroute calculates a backup next hop for each prefix in advance and installs it in the forwarding table alongside the primary. A neighbour qualifies as a loop-free alternate if its own best path to the destination does not come back through the protecting router. When the primary fails, forwarding switches to the backup in tens of milliseconds, while the routing protocol converges in the background.

router ospf 1
 fast-reroute per-prefix enable prefix-priority low
router eigrp CAMPUS
 address-family ipv4 unicast autonomous-system 100
  topology base
   fast-reroute per-prefix all
show ip ospf fast-reroute prefix-summary

EIGRP already keeps backup routes as feasible successors (see EIGRP fundamentals); LFA lets them be pre-installed in the forwarding table. In some topologies, especially rings, no directly connected neighbour is loop-free. Remote LFA (RFC 7490) solves this by tunnelling traffic, usually with MPLS LDP, to a router further away that can safely deliver it. Exact commands and support vary between platforms and software releases.

CEF polarization

When a router has several equal-cost paths, CEF shares traffic by hashing the source and destination addresses, so each flow sticks to one path. If every router in a hierarchy uses the same hash with the same input, a problem called CEF polarization appears. The first router sends, say, all "even" flows left and all "odd" flows right. The next router down the left path receives only "even" flows, hashes them the same way and sends them all down one of its links, leaving its other link idle.

Modern IOS uses the universal algorithm by default, which adds a random identifier unique to each router to the hash, so each layer splits traffic differently. You can also include Layer 4 port numbers so many flows between the same hosts spread out, or use different hash inputs at different layers.

ip cef load-sharing algorithm universal
ip cef load-sharing algorithm include-ports source destination
show ip cef exact-route 10.1.1.10 10.2.2.20

Real-world example: a regional bank's branches connect to two data centres over a provider Ethernet service. During a provider fault, the physical links stayed up, so OSPF took 40 seconds to notice and card payments failed. The bank enabled BFD on the WAN interfaces at 150-millisecond intervals and OSPF LFA on the hub routers. In the next provider outage, OSPF moved traffic in under a second and staff did not notice. A later review of link usage also found one data centre uplink nearly idle; enabling Layer 4 ports in the load-sharing hash spread traffic evenly.