Enabling Dedicated and Real-Time BFD on SRX Series Firewalls

Dedicated BFD

Enabling dedicated BFD impacts traffic throughput as one CPU core is removed from data plane processing.

To enable dedicated BFD on the SRX300, SRX320, SRX340, SRX345, SRX380, SRX1500, vSRX, and vSRX3.0 devices:

1. Include the dedicated-ukern-cpu statement at the [edit chassis] hierarchy level and then commit the configuration.

   1. [edit]

   2. user@host# set chassis dedicated-ukern-cpu

      user@host# commit

      The following warning message to reboot the system displays when you commit the configuration:

      warning: Packet processing throughput may be impacted in dedicated-ukernel-cpu mode. warning: A reboot is required for dedicated-ukernel-cpu mode to be enabled. Please use "request system reboot" to reboot the system. commit complete

2. Reboot the device to enable the configuration:

   1. user@host> request system reboot

3. Verify that dedicated BFD is enabled.

   user@host> show chassis dedicated-ukern-cpu

   Dedicated Ukern CPU Status: Enabled

Real-Time BFD

Enabling real-time BFD does not impact data plane performance. Higher priority is given to the Packet Forwarding Engine process handling BFD in distributed mode. This is suitable for scenarios where less than half of the maximum number of BFD sessions are being used. See this list for the maximum number of BFD sessions supported per SRX device.

Note:

For more information about BFD in distributed mode, see Understanding How BFD Detects Network Failures.

To enable real-time BFD on SRX300, SRX320, SRX340, and SRX345 devices:

1. Include the realtime-ukern-thread statement at the [edit chassis] hierarchy level and then commit the configuration.

   1. [edit]

   2. user@host# set chassis realtime-ukern-thread

      user@host# commit

      The following warning message to reboot the system displays when you commit the configuration:

      WARNING: realtime-ukern-thread is enable. Please use the command request system reboot.

2. Reboot the device to enable the configuration:

   1. user@host> request system reboot

3. Verify that real-time BFD is enabled.

   user@host> show chassis realtime-ukern-thread

   realtime Ukern thread Status: Enabled

BFD Support By SRX Platform

SRX Series Firewalls support the following maximum number of BFD sessions:

• Up to four sessions on SRX300 and SRX320 devices.

• Up to 50 sessions on SRX340, SRX345, and SRX380 devices.

• Up to 120 sessions on SRX1500 devices.

On all SRX Series Firewalls, high CPU utilization triggered for reasons such as CPU intensive commands and SNMP walks causes the BFD protocol to flap while processing large BGP updates. (Platform support depends on the Junos OS release in your installation.)

SRX Series Firewalls operating in chassis cluster mode support only BFD centralized mode.

The table below shows the BFD modes supported on each SRX Series Firewall.

Table 1: BFD Modes Supported on SRX Series Firewalls

SRX Series Firewall	Centralized BFD Mode	Distributed BFD	Real-Time BFD	Dedicated Core
SRX300	Default	Configuration	Configuration (Optional)	Not supported
SRX320	Default	Configuration	Configuration (Optional)	Not supported
SRX340	Default	Configuration	Configuration	Configuration (Optional)
SRX345	Default	Configuration	Configuration	Configuration (Optional)
SRX380	Default	Configuration	Configuration	Configuration (Optional)
SRX1500	BFD failure detection time > 500 ms and dedicated mode is not enabled	BFD failure detection time < 500 ms and dedicated mode is not enabled	Not supported	Configuration
SRX4100	BFD failure detection time > 500 ms	BFD failure detection time < 500 ms	Not supported	Not supported
SRX4200	BFD failure detection time > 500 ms	BFD failure detection time < 500 ms	Not supported	Not supported
SRX4600	BFD failure detection time > 500 ms	BFD failure detection time < 500 ms	Not supported	Not supported
SRX5000 line of devices with SPC2 card	Default	Not supported	Not supported	Not supported
SRX5000 line of devices with SPC3 card	BFD failure detection time > 500 ms	BFD failure detection time < 500 ms	Not supported	Not supported
vSRX	Default	Not supported	Not supported	Not supported